PRIVACY POLICY

Effective date: 17.09.2026

1. Introduction

This Privacy Policy describes how PokeAlp SNC (hereinafter “PokeAlp”, “we”, “our” or “us”), a general partnership registered in the commercial register of the Canton of Geneva under number CHE-214.976.233, collects, uses, stores and protects your personal data when you visit our website pokealp.ch (hereinafter the “Site”), place an order or interact with our services.

PokeAlp places particular importance on the protection of your personal data and is committed to processing it in accordance with the Swiss Federal Act on Data Protection (FADP) and, for customers residing in the European Union, the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

By using our Site, you acknowledge that you have read this Policy.

2. Data Controller

The controller responsible for processing your personal data is:

PokeAlp SNC
CHE-214.976.233
Geneva, Switzerland
Email: contact@pokealp.com

For any question regarding the protection of your data, you may contact us at the address above.

PokeAlp has not appointed a data protection officer (DPO) within the meaning of Article 37 GDPR, as such an appointment is not mandatory given the nature and volume of our processing activities.

3. Personal Data Collected

We collect the following categories of data:

3.1. Data you provide to us directly: first and last name, postal delivery and billing address, email address, telephone number (optional), payment information (processed directly by our payment provider; PokeAlp does not store any card numbers or bank details), and the content of your messages when you contact us.

3.2. Data collected when you create a customer account: login credentials (email and encrypted password), order history, saved delivery preferences.

3.3. Data collected automatically while you browse: IP address, browser type and version, operating system, pages visited and time spent on them, traffic source (referrer), cookie identifiers and similar technologies (see section 8), approximate location data (country, region) derived from the IP address.

3.4. Data collected via the newsletter: email address, date and time of subscription, topic preferences where applicable, open and click statistics.

4. Purposes and Legal Bases of Processing

We process your personal data for the following purposes:

4.1. Performance of your order and management of the contractual relationship: processing and tracking your orders, managing your customer account, communications relating to your orders (confirmations, shipments, tracking), handling returns and refunds, managing pre-orders. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

4.2. Legal and accounting obligations: invoicing, accounting, retention of proof of transactions, responding to requests from competent authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

4.3. Newsletter and marketing communications: sending newsletters, promotional offers and information about our new products. Legal basis: your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time via the unsubscribe link included in every email or by contacting us.

4.4. Statistical analysis and improvement of the Site: audience measurement and analysis of browsing behaviour via Google Analytics, optimisation of the user experience, analysis of Site performance. Legal basis: legitimate interest (Art. 6(1)(f) GDPR), namely the continuous improvement of our services and our Site.

4.5. Targeted advertising: conversion tracking and creation of advertising audiences via Meta Pixel (Facebook/Instagram), display of relevant advertisements on social networks. Legal basis: your consent (Art. 6(1)(a) GDPR), obtained via our cookie banner.

4.6. Security and fraud prevention: detection and prevention of fraudulent activity, protection of the Site against attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

5. Recipients of Data

Your personal data may be disclosed to the following categories of recipients:

5.1. Shopify International Limited (Dublin, Ireland): hosting of the Site, processing of orders and payments, management of customer accounts. Shopify acts as a processor and has its own privacy policy, available at shopify.com/legal/privacy.

5.2. Payment providers: transactions are processed by the payment providers integrated into Shopify (Shopify Payments, PayPal, etc.). PokeAlp never has access to your full card details.

5.3. Swiss Post: name, delivery address and telephone number (where applicable) for the delivery of your orders.

5.4. Google LLC (Google Analytics): anonymised or pseudonymised browsing data for statistical analysis purposes.

5.5. Meta Platforms Ireland Limited (Meta Pixel): data on interactions with the Site for advertising tracking purposes, subject to your consent.

5.6. Infomaniak Network SA (Geneva, Switzerland): additional hosting services (business email).

5.7. Newsletter provider: sending and management of email campaigns.

Under no circumstances do we sell, rent or transfer your personal data to third parties for commercial purposes unrelated to PokeAlp.

6. Data Transfers Outside Switzerland and the EU/EEA

Some of our service providers are located outside Switzerland and the European Economic Area, in particular:

6.1. Shopify Inc.: Canada and the United States. Canada benefits from an adequacy decision of the European Commission. For transfers to the United States, Shopify relies on the standard contractual clauses (SCCs) approved by the European Commission and on the EU-U.S. Data Privacy Framework.

6.2. Google LLC: United States. Google is certified under the EU-U.S. Data Privacy Framework and applies standard contractual clauses.

6.3. Meta Platforms, Inc.: United States. Meta relies on standard contractual clauses and the EU-U.S. Data Privacy Framework.

In all cases, we ensure that appropriate safeguards are in place in accordance with Article 46 GDPR and Article 16 FADP to protect your data during these transfers.

7. Retention Periods

We retain your personal data only for as long as necessary for the purposes for which it was collected:

7.1. Order related data (invoicing, accounting): 10 years from the transaction, in accordance with Swiss legal obligations regarding the retention of accounting records (Art. 958f of the Swiss Code of Obligations).

7.2. Customer account data: for as long as your account is active. In the event of prolonged inactivity (36 months without login or order), we will notify you before deleting your account.

7.3. Browsing data and cookies: see section 8 (duration varies depending on the cookie).

7.4. Newsletter data: until you withdraw your consent (unsubscribe).

7.5. Data relating to a dispute or complaint: for the duration of the dispute and the applicable limitation periods.

7.6. Prospect data (customers who have not placed an order): 3 years from the last contact.

Once these periods have expired, your data is irreversibly deleted or anonymised.

8. Cookies and Similar Technologies

8.1. What is a cookie? A cookie is a small text file placed on your device when you visit a website. It allows information about your browsing to be stored.

8.2. Cookies used on our Site:

Strictly necessary cookies: these cookies are essential for the Site to function (shopping cart management, login session, security). They do not require your consent. Duration: session or up to 12 months depending on the cookie. Set by: Shopify.

Analytics cookies (Google Analytics): these cookies allow us to measure Site traffic, analyse visitor behaviour and improve our services. The data is pseudonymised (IP anonymisation enabled). Duration: up to 26 months. Set by: Google LLC. Legal basis: your consent.

Advertising cookies (Meta Pixel): these cookies allow us to measure the effectiveness of our advertising campaigns on Facebook and Instagram and to show you targeted advertisements on these platforms. Duration: up to 180 days. Set by: Meta Platforms Ireland Limited. Legal basis: your consent.

Functional cookies: these cookies remember your preferences (language, currency, cart contents) to improve your experience. Duration: up to 12 months. Set by: Shopify. Legal basis: legitimate interest.

8.3. Managing your preferences. On your first visit, a cookie banner allows you to accept or refuse non-essential cookies. You can change your preferences at any time via the “Manage cookies” link in the footer of the Site. You can also configure your browser to block or delete cookies. Please note that disabling certain cookies may affect the functioning of the Site.

8.4. To learn more about cookies and how to manage them, you can visit www.allaboutcookies.org.

9. Your Rights

In accordance with the FADP and the GDPR, you have the following rights regarding your personal data:

9.1. Right of access (Art. 25 FADP, Art. 15 GDPR): you may obtain confirmation as to whether or not data concerning you is being processed, and obtain a copy of it.

9.2. Right to rectification (Art. 32(1) FADP, Art. 16 GDPR): you may request the correction of inaccurate or incomplete data concerning you.

9.3. Right to erasure / “right to be forgotten” (Art. 17 GDPR): you may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw your consent. This right does not apply where processing is necessary to comply with a legal obligation (in particular accounting obligations).

9.4. Right to restriction of processing (Art. 18 GDPR): you may request the restriction of the processing of your data in certain cases provided for by the GDPR.

9.5. Right to data portability (Art. 28 FADP, Art. 20 GDPR): you may receive your data in a structured, commonly used and machine readable format and transmit it to another controller.

9.6. Right to object (Art. 21 GDPR): you may object at any time to the processing of your data based on legitimate interest, including profiling. Where you object to processing for direct marketing purposes, the objection applies automatically and unconditionally.

9.7. Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

9.8. Right not to be subject to automated decision making (Art. 22 GDPR, Art. 21 FADP): PokeAlp does not make any fully automated decisions that produce legal effects concerning you or similarly significantly affect you.

10. Exercising Your Rights

To exercise any of your rights, please send your request by email to contact@pokealp.com, stating your identity (first name, last name, email address associated with your account) and the right you wish to exercise.

We undertake to respond to your request within 30 days of receipt. This period may be extended by a further 60 days in the event of complexity or a high number of requests, in which case we will inform you.

Exercising your rights is free of charge. However, in the case of manifestly unfounded or excessive requests (in particular because of their repetitive nature), we reserve the right to charge a reasonable fee or to refuse to act on them, in accordance with Article 12(5) GDPR.

11. Complaints to a Supervisory Authority

If you consider that the processing of your personal data infringes your rights, you may lodge a complaint with the competent supervisory authority:

For Switzerland: Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.

For France: Commission nationale de l’informatique et des libertés (CNIL), www.cnil.fr.

For Germany: the competent authority is the Federal Commissioner for Data Protection and Freedom of Information (BfDI), www.bfdi.bund.de, or the data protection authority of the federal state in which you reside (Landesdatenschutzbeauftragter).

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration, including: SSL/TLS encryption of all communications between your browser and our Site, hosting on secure servers (Shopify, Infomaniak), access to data restricted to strictly authorised persons, customer account passwords stored in encrypted form (hashing), and PCI DSS compliance ensured by our payment providers.

Despite these measures, no data transmission or storage system can guarantee absolute security. In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible in accordance with Articles 33 and 34 GDPR and Article 24 FADP.

13. Data of Minors

Our Site is not intended for persons under the age of 16. We do not knowingly collect personal data from minors under 16. If we learn that data of a minor under 16 has been collected without the consent of the holder of parental authority, we will delete it as soon as possible. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at contact@pokealp.com.

14. Changes to this Policy

We reserve the right to modify this Privacy Policy at any time. Any changes will be published on this page with an updated effective date. In the event of a substantial change, we will inform you by email or by a visible notice on the Site. We encourage you to consult this page regularly.

15. Contact

For any question regarding this Privacy Policy or the protection of your personal data, please contact us:

PokeAlp SNC
Email: contact@pokealp.com
Website: www.pokealp.ch