Privacy Policy

The German version of this Privacy Policy is the legally binding version. This translation is provided for convenience only.

The protection of your personal data is important to us. This Privacy Policy informs you about what data we collect, how we use it, and what rights you have. It applies in accordance with the Swiss Federal Act on Data Protection (FADP, revised version in force since 1 September 2023) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller

NOKTO Sports
Owner: Jonas Schädeli
Mittlere Strasse 75B
3600 Thun
Switzerland
Email: hello@noktosports.com

2. Data We Collect

Order Data

When you place an order we process: name, delivery address, email address, payment information (via Shopify Payments), order history, and design and configuration data (via the NOKTO Customizer).

Account Data

When you create a customer account we store: name, email address, encrypted password, and saved designs and team projects.

Technical Data

When you visit the website the following data is collected automatically: IP address (anonymised), browser type and version, operating system, referrer URL, date and time of access. This data is required for the secure operation of the website and is not linked to personal data.

When you subscribe to the newsletter we store your email address. You can unsubscribe at any time via the unsubscribe link in the newsletter or by email.

3. Purposes and Legal Bases

Contract fulfilment: Processing, delivering, and settling payments for orders (CO Art. 184 / GDPR Art. 6(1)(b))
Customer account: Managing designs, projects, and order history (contract performance)
Newsletter: Sending marketing communications with your explicit consent (GDPR Art. 6(1)(a))
Website operation: Security, troubleshooting, improving the user experience (legitimate interests)
Legal obligations: Accounting, tax law (legal obligation)

4. Disclosure of Data to Third Parties

We only share your data where necessary for the performance of a contract or where required by law. Our service providers:

Shopify Inc. (Canada / USA): Operation of the online shop, payment processing, order management. Shopify is certified under the EU–US Data Privacy Framework.Privacy Policy
Vercel Inc. (USA): Hosting and delivery of the website. Vercel processes technical connection data.Privacy Policy
Sanity.io (USA): Content management system for the blog.Privacy Policy
MongoDB Atlas (MongoDB Inc.) (USA): Database service for stored designs, team projects, and customer data. Processing is based on standard contractual clauses.Privacy Policy
Judge.me (USA): Review platform. When you submit a review, your name and email address are transmitted to Judge.me.Privacy Policy
Shipping service providers: Delivery address and order number are shared for fulfilment purposes.

For transfers to third countries (USA) we rely on standard contractual clauses of the EU Commission or equivalent safeguards.

We do not share your data with third parties for marketing purposes without your consent.

5. Cookies and Tracking

Essential Cookies

We use technically necessary cookies for the operation of the website (session, shopping cart, authentication). These cookies are required for the basic functions of the shop and cannot be deactivated.

Functional Cookies

For language and regional preferences we set functional cookies (nokto_locale_chosen, nokto_country) that save your settings for future visits.

Our Own Visit Statistics

To understand how our website is used, we keep our own simple visit statistics. We set no cookie for this and store no IP address. For as long as the tab is open, your browser receives a random session identifier in session storage (sessionStorage), which expires when the tab is closed. So that one person with several tabs is counted only once, we derive a one-way code from the IP address and browser identifier together with a random key that changes every day and is then deleted. The IP address itself is never stored, and the code cannot recognise you on another day. We record the pages viewed, the time and duration of the visit, the referring page (e.g. a search engine or an ad), device type (mobile or desktop), language, and the city and country that our hosting provider roughly derives from the connection. If you are signed in to your customer account, we link the visit to your account. In addition, we record the individual steps of a visit, for example the choices made in the configurator (cut, collar, fabric, pattern, colours, placements), quantities, the shopping cart and the move to checkout. Text you type and images you upload are not part of this. The data stays with us, is not shared with third parties and is deleted automatically after 30 days.

Purpose: Understanding website usage, improving our offering
Legal basis: Legitimate interest (GDPR Art. 6(1)(f) / FADP Art. 31)
Retention period: 30 days

Analytics Cookies (Google Analytics)

With your consent we use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to statistically analyse the use of our website and improve our offering.

Google Analytics sets cookies that enable analysis of your usage behaviour. The information generated is generally transferred to a Google server in the USA and stored there. We use IP anonymisation (anonymize_ip) so that your IP address is truncated before transmission.

Purpose: Analysis of page views, time on site, visitor origin
Legal basis: Consent (GDPR Art. 6(1)(a) / FADP Art. 31)
Retention period: up to 14 months (configurable on Google's side)
Data transfer: USA (Google LLC), standard contractual clauses

You can withdraw your consent at any time with effect for the future by contacting us by email at hello@noktosports.com. The lawfulness of processing carried out prior to withdrawal is not affected.

For more information on data protection at Google: policies.google.com/privacy

Session Analysis (Microsoft Clarity)

With your consent we use Microsoft Clarity (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA) to understand how visitors use our website. Clarity records mouse movements, clicks and scrolling and creates session recordings and heatmaps from them. Entries in form fields are masked and not recorded. Clarity is only loaded after you have accepted cookies in the cookie banner.

Purpose: Improving usability and the ordering process
Legal basis: Consent (GDPR Art. 6(1)(a) / FADP Art. 31)
Retention period: up to 13 months (on Microsoft's side)
Data transfer: USA (Microsoft Corporation), EU-US Data Privacy Framework and standard contractual clauses

You can withdraw your consent at any time with effect for the future by contacting us by email at hello@noktosports.com. For more information on data protection at Microsoft: privacy.microsoft.com/privacystatement

6. Retention Periods

Order data and invoices are retained in accordance with statutory tax retention periods (10 years). Customer account data is stored for as long as the account is active. After account deletion, data is erased within 30 days unless a legal retention obligation applies.

Newsletter addresses are stored until you unsubscribe.

7. Your Rights

You have the right to:

Access the data stored about you (FADP Art. 25 / GDPR Art. 15)
Rectification of inaccurate data (GDPR Art. 16)
Erasure of your data where no legal retention obligation applies (GDPR Art. 17)
Restriction of processing (GDPR Art. 18)
Data portability in a commonly used format (GDPR Art. 20)
Objection to processing for marketing purposes (GDPR Art. 21)
Withdrawal of any consent given, at any time with effect for the future

For all enquiries regarding your data protection rights please contact: hello@noktosports.com

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or an EU supervisory authority.

8. Data Security

We use industry-standard security measures to protect your data, in particular SSL/TLS encryption for data transmission. Payment data is processed exclusively via the secure systems of Shopify Payments. We do not store credit card data.

Access by our staff

So that we can support you with your designs, quotes and orders, our staff can access the data in your customer account and make changes there on your behalf — for example adjust a design or create a quote. Such access only happens for a specific reason, is limited in time and is logged; the log records which member of staff made which change and when. It does not give access to your password, your passkeys or your payment methods. We never place an order without your consent.

9. Changes

We reserve the right to update this Privacy Policy as necessary. The current version is always available on this page. In the event of material changes, we will notify registered customers by email.