Privacy Policy

1. Controller

Responsible for the processing of personal data in connection with the online shop ivape.ch:

Proyecto Iris GmbH, Gerechtigkeitsgasse 25, 8001 Zurich, Switzerland Email: i@ivape.ch

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP).

2. Data We Process

Order data: name, delivery address, email address, phone number (optional), date of birth (for the legally required age verification), ordered products and payment information (payment is processed directly by the payment service provider — we do not receive complete card data).

Technical data: when visiting the website, technically necessary data is processed (IP address, browser type, date and time of access) to the extent required for the operation and security of the website.

3. Purposes of Processing

We process personal data to fulfil orders (including shipping and payment), to comply with statutory age-verification obligations (Tobacco Products Act), for customer communication and to improve our offering.

4. Disclosure to Third Parties

Personal data is only disclosed to the extent necessary for contract fulfilment: to Swiss Post (shipping), to the payment service provider (payment processing), and to IT service providers that support the operation of the shop and are contractually bound to confidentiality. No disclosure for third-party advertising purposes takes place.

5. Cookies

The shop uses technically necessary cookies (e.g. for the cart, language selection and confirmation of the age check). These are required for the operation of the website. No advertising cookies are used.

Usage analytics with Microsoft Clarity: by clicking «Yes, I am 18+» in the age check, you consent to us analysing how our shop is used with Microsoft Clarity (Microsoft Ireland Operations Ltd., Dublin). Clarity records page views, clicks, scrolling and mouse movements and sets cookies for this (e.g. _clck, _clsk). What you type into form fields is not recorded. We use this analysis to find errors and make the shop easier to use. The data is stored on Microsoft servers, including in the USA. Microsoft may also use it for its own purposes under its own privacy statement. You can withdraw your consent at any time by deleting the ivape.ch cookies in your browser.

Audience measurement: we also count page views and loading times with Vercel Web Analytics and Vercel Speed Insights. These services set no cookies and build no profiles.

In addition, your browser stores the cart locally (local storage) and, after an order, the delivery address entered at checkout including the date of birth, so you do not have to retype it on your next purchase. This data stays on your device and is not transmitted to us. You can delete it at checkout at any time.

Customer account: if you log in under "My account", we send a login link to your email address (sent via our email service Brevo). After you click it, the shop sets a technically necessary cookie that keeps you logged in on this device for one year. It only contains your email address in signed form. Your orders and your level (Air, Pro, Ultra) are read directly from our shop system on every visit. We do not store any additional data for the account. "Log out" deletes the cookie.

Service emails about your order: if you enter your email address at checkout, we store it together with your cart (items and quantities only) on our shop server. If no order is placed within an hour, we remind you once by email; the entry is deleted after 7 days. If you ask to be notified when a sold-out item is back, we keep the address and item for at most 60 days. After an order we send you, a few days after shipping, a short help note for your device with a request for a review, and for refills a reminder before they run out. After signing up for the newsletter, two short welcome emails follow. Each of these reminders contains an unsubscribe link. Emails are sent via Brevo (Sendinblue SAS, France).

6. Retention

We retain personal data for as long as required for the stated purposes or by statutory retention obligations (e.g. 10-year accounting obligations).

7. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. Transmission is encrypted (TLS).

8. Your Rights

You have the right to information about the data processed about you, to rectification of inaccurate data, to deletion and to restriction of processing, insofar as no legal obligations prevent this. Send requests to i@ivape.ch.

9. Changes

We may amend this privacy policy at any time. The version published on this page applies.