Privacy policy

Last updated: July 23, 2026

1. Data Controller

The controller responsible for processing your personal data on sonicsmile.shop is:

SonicSmile GmbH
St. Karli-Strasse 13c
6004 Lucerne
Switzerland

Email: support@sonicsmile.shop

For the processing of personal data of individuals in the European Union, the General Data Protection Regulation (GDPR) applies. For individuals in Switzerland, the Swiss Federal Act on Data Protection (FADP) additionally applies.

2. Legal Bases for Processing

We process personal data on the following legal bases:

  • Article 6(1)(b) GDPR – Performance of a contract or steps prior to entering into a contract, for example in connection with orders, delivery, payment, and withdrawal from a contract.

  • Article 6(1)(c) GDPR – Compliance with legal obligations, such as commercial and tax-related record retention requirements.

  • Article 6(1)(f) GDPR – Legitimate interests, including fraud prevention, IT security, and responding to inquiries.

  • Article 6(1)(a) GDPR in conjunction with Section 25 TDDDG (Germany) – Your consent, particularly for all cookies that are not technically necessary as well as for analytics and marketing services.

You may withdraw your consent at any time with effect for the future.

3. Hosting and Shop Platform

Our online store is operated using the Shopify platform. For customers in the European Economic Area (EEA), the service provider is Shopify International Limited, Dublin, Ireland.

On our behalf, Shopify processes all data generated through the use of our online store, including order data, account information, usage data, and server log files containing your IP address, date and time of access, browser type, and operating system.

The processing is based on a Data Processing Agreement pursuant to Article 28 GDPR. The processing of server log files is based on our legitimate interest in ensuring the secure and reliable operation of our online store.

4. Order Processing

When you place an order, we process the information you provide, including:

  • First and last name

  • Billing and shipping address

  • Email address

  • Telephone number (where applicable)

  • Order details

  • Payment information

We share this data with:

  • Our payment service providers, Stripe Payments Europe Ltd., Dublin, Ireland, and PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Credit card and bank account details are processed exclusively by these providers and are not accessible to us.

  • Our fulfillment and shipping providers, onefulfillment GmbH, Herbolzheim, Germany, and fultastic GmbH, Bettwiesen, Switzerland, as well as the shipping carriers DHL, Austrian Post, and Swiss Post, to the extent necessary for delivery.

  • Our tax advisor and the competent tax authorities where required by law.

The legal basis is Article 6(1)(b) GDPR. The retention of invoice data is based on Article 6(1)(c) GDPR.

5. Customer Account

You may create a customer account, but you are not required to do so. Guest checkout is always available.

Within your customer account, we store your login credentials and order history. You may request deletion of your account at any time. Statutory retention obligations for completed orders remain unaffected.

6. Electronic Right of Withdrawal

You may exercise your statutory right of withdrawal online using the "Withdraw Contract" button.

For this purpose, we process only:

  • Your name

  • Information identifying the contract, typically your order number

  • Your email address for the legally required confirmation of receipt

  • Any optional information you voluntarily provide in the free-text field

The legal basis is Article 6(1)(b) and (c) GDPR.

We retain your withdrawal declaration and the confirmation of receipt for a period of three years from the end of the calendar year in which the withdrawal was received, in order to demonstrate timely processing.

7. Contact Requests and Customer Support

If you contact us by email or via our contact form, we process the information you provide to respond to your request.

The legal basis is:

  • Article 6(1)(b) GDPR for contract-related inquiries; or

  • Article 6(1)(f) GDPR for all other inquiries.

8. Consent Management

We use Pandectes to obtain and manage your cookie consent.

Your consent decision, a timestamp, and technical information are stored to document your consent in accordance with legal requirements.

The legal basis is Article 6(1)(c) GDPR.

You may change your preferences at any time using the "Cookie Settings" link in the footer of our website.

9. Cookies

We use technically necessary cookies that are essential for the operation of our online store, shopping cart, and checkout process.

The legal basis is Section 25(2) TDDDG in conjunction with Article 6(1)(f) GDPR.

All other cookies, particularly those used for analytics and marketing purposes, are only placed with your explicit consent.

10. Analytics and Marketing

The following services are only used with your prior consent.

These services may collect information about your behavior on our website, including pages visited, products viewed, shopping cart activities, purchases, your IP address, and device information. Based on this data, pseudonymous user profiles may be created.

Meta Pixel and Conversions API

Provider: Meta Platforms Ireland Limited, Dublin, Ireland.

We use these services to measure the effectiveness of our advertising on Facebook and Instagram and to deliver targeted advertisements.

Meta and we are jointly responsible for the collection and transmission of data pursuant to Article 26 GDPR. Meta is solely responsible for any subsequent processing.

Google Ads, Google Analytics, and Google Tag

Provider: Google Ireland Limited, Dublin, Ireland.

These services enable us to measure conversions resulting from our advertisements, analyze the use of our online store, and display remarketing advertisements.

TikTok Pixel

Provider: TikTok Technology Limited, Dublin, Ireland.

We use TikTok Pixel to measure the effectiveness of our advertising campaigns on TikTok.

11. Email Marketing

We use Omnisend to send newsletters and automated emails.

Registration is carried out using the double opt-in procedure. After subscribing, you will receive a confirmation email containing a verification link. We will only send newsletters after your confirmation.

We log your subscription, confirmation, and IP address in order to document your consent.

We also analyze whether and when you open our emails and which links you click in order to improve our communications.

The legal basis is Article 6(1)(a) GDPR.

You may unsubscribe at any time using the unsubscribe link included in every email.

12. International Data Transfers

As a Swiss company, we also process personal data in Switzerland.

Switzerland benefits from an adequacy decision issued by the European Commission, meaning its level of data protection is recognized as equivalent to that of the European Union.

Some of the service providers listed above process personal data in the United States.

Where applicable, such transfers are based on the adequacy decision relating to the EU–U.S. Data Privacy Framework, provided that the relevant provider is certified under that framework. Otherwise, transfers are based on the European Commission's Standard Contractual Clauses (Article 46 GDPR).

13. Data Retention

We retain personal data for the following periods:

  • Order and invoice data: up to ten years in accordance with commercial and tax law retention requirements.

  • Customer account data: until you request deletion.

  • Withdrawal declarations: three years from the end of the calendar year in which they were received.

  • Customer inquiries: until the inquiry has been fully resolved and for up to three additional years where necessary.

  • Newsletter data: until you withdraw your consent.

  • Consent records: three years after the consent expires or is withdrawn.

  • Analytics and marketing data: according to the respective provider's retention periods, but no longer than fourteen months.

14. Your Rights

You have the right to:

  • Access your personal data (Article 15 GDPR)

  • Rectify inaccurate personal data (Article 16 GDPR)

  • Request erasure of your personal data (Article 17 GDPR)

  • Request restriction of processing (Article 18 GDPR)

  • Receive your personal data in a portable format (Article 20 GDPR)

  • Object to processing based on legitimate interests (Article 21 GDPR)

You may also withdraw any consent you have given at any time with future effect.

To exercise your rights, simply contact us at:

support@sonicsmile.shop

You also have the right to lodge a complaint with a competent data protection supervisory authority, particularly in your country of residence.

For individuals in Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

15. Changes to this Privacy Policy

We may update this Privacy Policy whenever our data processing practices or the applicable legal requirements change.

The version published on this website at the time of your visit shall apply.