Privacy Policy
This translation is provided for convenience; the German version is legally binding.
1. Controller
The controller responsible for processing your personal data on this website and for orders is:
Eichhorn Customs, owner Bastian Eichhorn
Bachwisstrasse 6
9100 Herisau
Switzerland
Phone: +41 76 461 75 70
Email: info@atonactive.com
For any questions about data protection and to exercise your rights, the best way to reach us is by email at info@atonactive.com.
2. Applicable law and legal bases
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, in particular because we offer goods to people in the EU, we also comply with the GDPR.
Under the GDPR we rely on the following legal bases:
- Art. 6(1)(a) GDPR: your consent, for example for publishing a review;
- Art. 6(1)(b) GDPR: performance of a contract with you or pre-contractual measures, for example ordering, payment, delivery, customer service and participation in the partner programme;
- Art. 6(1)(c) GDPR: compliance with legal obligations, for example bookkeeping and retention obligations or acknowledging receipt of a withdrawal;
- Art. 6(1)(f) GDPR: legitimate interests, for example the secure and stable operation of the website, protection against misuse, consistent presentation of the website, answering enquiries and attributing orders to our partners.
3. Summary
- There are no customer accounts, no newsletter, no analytics or advertising services, no social media plugins and no tracking cookies.
- We process your data only to provide the website, handle orders and withdrawals, answer your enquiries, run our partner programme and – with your consent – publish your review.
- The partner programme also works without cookies: a partner code is only transmitted to Stripe with the order via the page address or the order field (section 13).
- Recipients are our hosting provider (Simply.com, Denmark), our payment service provider (Stripe, Ireland and USA), our logistics partner (CJ Dropshipping, China) together with the carriers, and Google (fonts, Ireland and USA).
4. Visiting the website, hosting and server log files
Our website and our email mailboxes are operated by Simply.com A/S, Højvangen 4, 8660 Skanderborg, Denmark. Simply.com processes the data on our behalf on servers in Denmark.
When you visit the website, your browser automatically transmits data that is stored in server log files: IP address, date and time of access, page or file requested, the website you came from (referrer), browser type and operating system, status code and amount of data transferred.
We need this data to deliver the website, ensure its stable operation and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. The log files are stored only as long as necessary for these purposes and then deleted.
5. Fonts from Google (Google Fonts)
Our pages load the “Sora” font from Google servers (fonts.googleapis.com and fonts.gstatic.com). Your browser connects to Google and transmits your IP address and technical information about the browser and the page visited. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Transfer to Google LLC in the USA is possible.
The purpose is a consistent and legible presentation of the website. The legal basis is Art. 6(1)(f) GDPR. Google LLC is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. More information: policies.google.com/privacy.
6. Cookies and tracking
Our website itself does not set cookies and does not use analytics, tracking or advertising services. When you are redirected to Stripe Checkout (checkout.stripe.com) for payment, Stripe may use its own cookies and similar technologies there, mainly for secure payment and fraud prevention. Stripe is responsible for this; details can be found in Stripe’s privacy policy.
We do not use cookies or comparable storage technologies for our partner programme either; a partner code is only passed on via the page address (section 13).
7. Orders
When you place an order, we process your name, billing and delivery address, email address, phone number, the goods ordered, quantity and price, any promotion code, any partner code (section 13), the time of the order, the payment status, your acceptance of the Terms and any other information you provide in Stripe Checkout.
We use this data to conclude and perform the contract, send you the confirmation and tracking number, deliver the goods, handle complaints and withdrawals and keep our accounts. The legal bases are Art. 6(1)(b) and (c) GDPR. Without this information we cannot conclude a contract with you.
Buying a walking aid may allow conclusions to be drawn about your health. We therefore use your order data exclusively for the purposes stated and not for advertising or profiling.
8. Payment via Stripe
For payment we use Stripe Checkout from Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When you click “Buy now!”, our server transmits the order details (product, quantity, price and, where applicable, the partner code) to Stripe and you are redirected to Stripe’s payment page.
There Stripe processes your payment data (for example card details), name, email address, phone number, addresses and device and connection data such as your IP address in order to process the payment and prevent fraud. We do not receive your full card details. We receive the payment status and the information we need to process the order.
For certain purposes, such as fraud prevention and compliance with its own legal obligations, Stripe is itself responsible. Stripe carries out automated checks; as a result a payment may be declined in individual cases. Stripe may transfer data to Stripe, Inc. in the USA; for this Stripe relies on the EU-US and Swiss-US Data Privacy Framework and on standard contractual clauses. The legal bases are Art. 6(1)(b) GDPR and, for fraud prevention, Art. 6(1)(f) GDPR. More information: stripe.com/privacy.
9. Shipping by our logistics partner
For shipping we pass your name, delivery address, email address, phone number and the goods ordered to our logistics partner CJ Dropshipping (Yiwu Cujia Trade Co., Ltd., Yiwu, Zhejiang Province, China). CJ Dropshipping packs and ships the goods and passes the data on to the carriers involved, in the destination country usually the national postal or parcel service. For customs clearance, the customs authorities also receive the necessary information (recipient, goods, value).
The purpose is delivery including tracking, delivery notifications and customs clearance. The legal basis is Art. 6(1)(b) GDPR.
Transfer to China: There is neither an adequacy decision of the European Commission nor a recognition by the Swiss Federal Council for China. The level of data protection may therefore be lower than in the EU and Switzerland; in particular, access by state authorities cannot be ruled out. We transfer the data because this is necessary for the performance of the purchase contract with you, i.e. delivery of the goods (Art. 49(1)(b) GDPR, Art. 17(1)(b) FADP). We only pass on the data needed for shipping.
10. Contact by email, phone and contact form
If you email us, call us or use the contact form, we process your name, email address or phone number, the content of your message or call and any other information you provide. The contact form opens your own email program; no data is stored on our website. Emails are stored at Simply.com in Denmark.
We use the information to answer your enquiry, for example product questions, trade and affiliate enquiries or your request to be informed about the next delivery. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR.
Please only send us health information that is necessary for your question. We use such information exclusively to answer your enquiry.
11. Online withdrawal (“Cancel contract”)
If you withdraw from a contract via our Cancel contract page, we process your name, email address, order details (order number or order date), your optional message and the date and time of receipt. We use this to send you the legally required acknowledgement of receipt by email and to receive a notification ourselves. To protect against misuse, we briefly store an irreversible hash of your IP address in order to limit too many requests in a short time.
The legal bases are Art. 6(1)(b) and (c) GDPR and, for misuse protection, Art. 6(1)(f) GDPR. We keep withdrawal data like other contract documents (section 15); we use the IP hash only for this limit; entries older than one hour are deleted automatically the next time the form is used.
12. Reviews (“Write a review”)
If you submit a review using the “Write a review” form, we process your star rating, your review text, the name you enter, your email address, your order number or order date and the date and time of receipt. We use this information to check against our order data that you have bought the product, to send you a short acknowledgement by email, to contact you if we have questions and to publish the review on atonactive.com after the check. Only the name you entered, the stars, the text (on the pages in the other language, where applicable, with a translation labelled as such), the date and, once checked, the note “Verified purchase” are published; we do not publish your email address or order details. Reviews are never published automatically. We store the information on our hosting provider’s web server (section 4) in a password-protected administration area that is not publicly accessible and through which only we check, publish, hide or delete reviews. To protect against misuse, we briefly use an irreversible hash of your IP address, as for the online withdrawal (section 11).
The legal basis is your consent (Art. 6(1)(a) GDPR; under the FADP likewise your consent, Art. 31(1) FADP) and, for misuse protection, Art. 6(1)(f) GDPR. You can withdraw your consent at any time with effect for the future by email to info@atonactive.com; we will then remove the review from the website. This does not affect the lawfulness of processing carried out before the withdrawal.
We display published reviews for as long as we offer the product or until you withdraw your consent. We delete unpublished reviews no later than twelve months after receipt. We keep your email address and order details together with the review so that we can document the check and match a withdrawal of consent, and delete them no later than twelve months after the review has been removed.
13. Partner programme
Partners: If you sign up using the form on our partner programme page, we process your name or company, email address, country, the details of your recommendation channel (for example website or social media profile), your message, whether you state that you have already bought from us, your IBAN if you choose to provide it, and the date and time of receipt. We receive a notification by email (showing the IBAN only in shortened form) and send you a short acknowledgement. If we accept you as a partner, we additionally store your partner code, bank details and payout notes, internal notes, the orders attributed to you (date, quantity, amount paid and refunded, commission) and the payouts. We use this information to review your application, run the partner programme, calculate commissions and pay them out by bank transfer, and keep our accounts. We store the information on our hosting provider’s web server (section 4) in a password-protected administration area that is not publicly accessible. To protect against misuse, we briefly use an irreversible hash of your IP address, as for the online withdrawal (section 11). The legal bases are Art. 6(1)(b) GDPR (application and participation), Art. 6(1)(c) GDPR (bookkeeping) and, for misuse protection, Art. 6(1)(f) GDPR.
Customers: If you arrive on our website via a partner link (for example www.atonactive.com/?ref=CODE) or enter a code in the “Partner code (optional)” order field, our server transmits this code to Stripe together with the order details when you click “Buy now!” (section 8). Stripe stores it as additional information (metadata) with the checkout session and the payment. We use the code only to attribute the order to the partner and calculate the commission; to check for prohibited self-referrals we compare the email address of the order with that of the partner. We do not use cookies or comparable storage technologies (such as localStorage or sessionStorage) for attribution: the code is only contained in the address of the page you visit, is appended to internal links during your visit and fills in the order field. You can clear the field before buying. The code does not change the price. The partner does not receive any personal data about you, in particular not your name, address or email address, but only the number of units sold and the amount of their commission. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in remunerating our partners correctly.
14. Recipients and transfers abroad
- Simply.com A/S, Denmark: hosting of the website and email mailboxes (on our behalf);
- Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., USA: payment processing and fraud prevention;
- Yiwu Cujia Trade Co., Ltd. (CJ Dropshipping), China: packing and shipping;
- carriers and customs authorities: delivery and customs clearance;
- our bank: transfer of commissions to partners (name, IBAN, amount);
- Google Ireland Limited, Ireland, and Google LLC, USA: provision of fonts;
- authorities where we are legally obliged, and where applicable fiduciary or tax advisers to fulfil our bookkeeping obligations.
Denmark and Ireland are part of the EU; Switzerland considers the EU to provide adequate data protection. Switzerland, where we are based, is recognised by the European Commission as providing an adequate level of data protection. Transfers to the USA (Stripe, Inc., Google LLC) are based on the EU-US and Swiss-US Data Privacy Framework in which these companies participate, supplemented by standard contractual clauses. For transfers to China see section 9.
15. Retention period
- We keep order and invoice data, withdrawals and correspondence relevant to accounting for ten years (Art. 958f Swiss Code of Obligations).
- We delete other enquiries once they have been dealt with and no further retention is necessary, for example for the duration of possible warranty claims.
- If you would like to be informed about the next delivery, we store your email address until we have informed you or you tell us you no longer wish to receive a message.
- We delete partner applications that do not lead to a partnership no later than six months after receipt. We store partner data for the duration of the partnership and delete it afterwards unless we are obliged to retain it; we keep statements and payout records for ten years (Art. 958f Swiss Code of Obligations).
- Server log files see section 4; IP hashes of the online withdrawal see section 11; reviews see section 12; partner programme see section 13.
16. Your rights
Within the scope of applicable law you have the right to access your personal data, to rectification, erasure and restriction of processing, to receive or transfer your data and to withdraw any consent given at any time with effect for the future.
Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.
To do so, please email info@atonactive.com. We may ask you to verify your identity. Statutory retention obligations may prevent erasure; in that case the data will be blocked and not used for any other purpose.
17. Complaints to a supervisory authority
You can lodge a complaint with a data protection supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. In the EU you can contact in particular the supervisory authority of the country in which you live or work; an overview is available from the European Data Protection Board.
18. No automated decisions
We do not make automated individual decisions and do not carry out profiling. For Stripe’s automated fraud checks see section 8.
19. Data security
The connection to our website is encrypted (HTTPS). We take appropriate technical and organisational measures to protect your data against loss and unauthorised access.
20. Changes
We update this privacy policy when our services or the legal situation change. The version published on this website applies.