Privacy Policy

The German version of this Privacy Policy is the legally binding version. This translation is provided for convenience only.

The protection of your personal data is important to us. This Privacy Policy informs you about what data we collect, how we use it, and what rights you have. It applies in accordance with the Swiss Federal Act on Data Protection (FADP, revised version in force since 1 September 2023) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller

NOKTO Sports
Owner: Jonas Schädeli
Mittlere Strasse 75B
3600 Thun
Switzerland
Email: hello@noktosports.com

2. Data We Collect

Order Data

When you place an order we process: name, delivery address, email address, payment information (via Shopify Payments), order history, and design and configuration data (via the NOKTO Customizer).

Account Data

When you create a customer account we store: name, email address, encrypted password, and saved designs and team projects.

Technical Data

When you visit the website the following data is collected automatically: IP address (anonymised), browser type and version, operating system, referrer URL, date and time of access. This data is required for the secure operation of the website and is not linked to personal data.

When you subscribe to the newsletter we store your email address. You can unsubscribe at any time via the unsubscribe link in the newsletter or by email.

3. Purposes and Legal Bases

Contract fulfilment: Processing, delivering, and settling payments for orders (CO Art. 184 / GDPR Art. 6(1)(b))
Customer account: Managing designs, projects, and order history (contract performance)
Newsletter: Sending marketing communications with your explicit consent (GDPR Art. 6(1)(a))
Website operation: Security, troubleshooting, improving the user experience (legitimate interests)
Legal obligations: Accounting, tax law (legal obligation)

4. Disclosure of Data to Third Parties

We only share your data where necessary for the performance of a contract or where required by law. Our service providers:

Shopify Inc. (Canada / USA): Operation of the online shop, payment processing, order management. Shopify is certified under the EU–US Data Privacy Framework.Privacy Policy
Vercel Inc. (USA): Hosting and delivery of the website. Vercel processes technical connection data.Privacy Policy
Sanity.io (USA): Content management system for the blog.Privacy Policy
MongoDB Atlas (MongoDB Inc.) (USA): Database service for stored designs, team projects, and customer data. Processing is based on standard contractual clauses.Privacy Policy
Judge.me (USA): Review platform. When you submit a review, your name and email address are transmitted to Judge.me.Privacy Policy
Shipping service providers: Delivery address and order number are shared for fulfilment purposes.

For transfers to third countries (USA) we rely on standard contractual clauses of the EU Commission or equivalent safeguards.

We do not share your data with third parties for marketing purposes without your consent.

5. Cookies and Tracking

Essential Cookies

We use technically necessary cookies for the operation of the website (session, shopping cart, authentication). These cookies are required for the basic functions of the shop and cannot be deactivated.

Functional Cookies

For language and regional preferences we set functional cookies (nokto_locale_chosen, nokto_country) that save your settings for future visits.

Analytics Cookies (Google Analytics)

With your consent we use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to statistically analyse the use of our website and improve our offering.

Google Analytics sets cookies that enable analysis of your usage behaviour. The information generated is generally transferred to a Google server in the USA and stored there. We use IP anonymisation (anonymize_ip) so that your IP address is truncated before transmission.

Purpose: Analysis of page views, time on site, visitor origin
Legal basis: Consent (GDPR Art. 6(1)(a) / FADP Art. 31)
Retention period: up to 14 months (configurable on Google's side)
Data transfer: USA (Google LLC), standard contractual clauses

You can withdraw your consent at any time with effect for the future by contacting us by email at hello@noktosports.com. The lawfulness of processing carried out prior to withdrawal is not affected.

For more information on data protection at Google: policies.google.com/privacy

6. Retention Periods

Order data and invoices are retained in accordance with statutory tax retention periods (10 years). Customer account data is stored for as long as the account is active. After account deletion, data is erased within 30 days unless a legal retention obligation applies.

Newsletter addresses are stored until you unsubscribe.

7. Your Rights

You have the right to:

Access the data stored about you (FADP Art. 25 / GDPR Art. 15)
Rectification of inaccurate data (GDPR Art. 16)
Erasure of your data where no legal retention obligation applies (GDPR Art. 17)
Restriction of processing (GDPR Art. 18)
Data portability in a commonly used format (GDPR Art. 20)
Objection to processing for marketing purposes (GDPR Art. 21)
Withdrawal of any consent given, at any time with effect for the future

For all enquiries regarding your data protection rights please contact: hello@noktosports.com

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or an EU supervisory authority.

8. Data Security

We use industry-standard security measures to protect your data, in particular SSL/TLS encryption for data transmission. Payment data is processed exclusively via the secure systems of Shopify Payments. We do not store credit card data.

9. Changes

We reserve the right to update this Privacy Policy as necessary. The current version is always available on this page. In the event of material changes, we will notify registered customers by email.