Data Controller

Dismart SAGL

Via Luganetto 4, 6962 Viganello (Ticino), Switzerland

E-mail: info@formichettihd.com

Website: https://optimistic-copper-mouse.192-250-229-19.cpanel.site

Dismart SAGL (hereinafter: “Company”, “we”, or “us”) is the data controller under the EU General Data Protection Regulation 2016/679 (“GDPR”) and the Swiss Federal Act on Data Protection, as revised with effect from 1 September 2023 (“nFADP”).

This Privacy Policy describes how we collect, use, and protect personal data obtained through the website formichettihd.com and related services (collectively, the “Service”). Please read it carefully before using our Service or placing an order.

1. Personal Data We Collect

We collect and process the following categories of personal data:

Data you provide directly:

• Full name
• E-mail address
• Billing and shipping address
• Phone number
• Payment information (processed by Stripe – see Section 5; we do not store full card details)
• Information relating to disputes or complaints you submit to us

Data collected automatically through technical means:

• Log files: IP address, browser type, device type, internet service provider (ISP), referring/exit pages, operating system, date/time stamps, and clickstream data.
• Cookies and similar technologies: session cookies, preference cookies, and – subject to your consent – analytics and marketing cookies. Please refer to our Cookie Policy for full details.
• Analytics data: aggregated information about how users interact with the Service, collected via analytics tools subject to your consent.

2. Purposes of Data Processing

We process your personal data for the following purposes:

• To fulfil and manage your orders, including processing payments, arranging delivery, and handling returns or warranty claims.
• To communicate with you regarding your order, shipping status, or account-related matters.
• To provide customer support and resolve disputes or complaints.
• To detect and prevent fraud and ensure the security of the Service.
• To improve the Service through anonymised or aggregated analytics.
• To send you marketing communications, including newsletters and promotional offers, where you have given us your explicit consent to do so.
• To comply with legal obligations, including Swiss accounting requirements and applicable tax law.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Art. 6 GDPR:

• Performance of a contract (Art. 6(1)(b) GDPR): Processing of name, contact details, shipping address, and order information is necessary to fulfil your purchase and deliver the goods you have ordered.
• Legal obligation (Art. 6(1)(c) GDPR): Retention of transaction and accounting data is required by Swiss commercial law (CO Art. 958f) and applicable tax regulations.
• Legitimate interests (Art. 6(1)(f) GDPR): Processing for fraud prevention, security, and service improvement, where these interests are not overridden by your rights.
• Consent (Art. 6(1)(a) GDPR): Processing for direct marketing communications and non-essential cookies (analytics, advertising) is carried out only where you have given us your explicit, freely given, and informed consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Recipients of Personal Data

We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly to the extent necessary:

• Payment processor: Stripe Payments Europe, Ltd., which processes payment transactions on our behalf under its own privacy policy and as a data processor under a Data Processing Agreement with us. Stripe’s privacy policy is available at https://stripe.com/privacy.
• Warranty matters: LSS Engineering S.r.l., the manufacturer of the products provided through the Services, to handle any warranty and other product related claims.
• Shipping and logistics carriers: FedEx, DHL, UPS, or other carriers as needed to fulfil delivery of your order.
• Hosting provider: Infomaniak Network SA, whose data centres are located in Switzerland, provides the infrastructure on which our Service operates.
• Analytics providers: Third-party analytics tools, subject to your cookie consent, as described in our Cookie Policy.
• Legal and professional advisors: Where required for the exercise or defence of legal claims.
• Public authorities: Where required by applicable law or a binding order.

All third parties acting as data processors are bound by Data Processing Agreements and are required to process personal data only in accordance with our instructions and this Privacy Policy.

5. Payment Processing – Stripe

Payment transactions on our Website are processed by Stripe Payments Europe, Ltd. (“Stripe”). When you enter your payment details at checkout, this information is transmitted directly and securely to Stripe. We do not receive or store your full card number, CVV, or other sensitive payment authentication data.

Stripe is certified to PCI-DSS Level 1, the highest level of payment security certification. For further information on how Stripe processes your data, please visit https://stripe.com/privacy.

6. International Data Transfers

Dismart SAGL is established in Switzerland. Switzerland is recognised by the European Commission as providing an adequate level of data protection for transfers of personal data from the EU/EEA. Accordingly, transfers of personal data from EU/EEA customers to Dismart SAGL are lawful under Art. 45 GDPR without requiring additional safeguards.

Where personal data is transferred to other third-party recipients located outside Switzerland or the EU/EEA (for example, certain analytics or logistics providers), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or we rely on an adequacy decision where applicable.

7. Data Retention

We retain personal data for the following periods:

• Order and transaction data: Retained for 10 years from the date of the transaction, as required by Swiss commercial law (CO Art. 958f) for accounting records, and for as long as may be necessary in connection with any warranty claim or product liability matter arising from the relevant order.
• Account and customer profile data: Retained for as long as your account is active. Upon account deletion, personal data is deleted unless retention is required for legal or dispute resolution purposes.
• Dispute and complaint data: Retained until the dispute is resolved and for a further period of up to 5 years to cover the applicable statute of limitations.
• Fraud prevention data: Where there is a reasonable suspicion of criminal activity or the provision of false information, data may be retained for up to 10 years.
• Marketing data: Retained until you withdraw your consent or unsubscribe.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

8. Cookies and Tracking Technologies

We use cookies and similar technologies on our Website. Essential cookies are strictly necessary for the operation of the Website and cannot be disabled. Non-essential cookies – including analytics and marketing cookies – are only activated with your prior, explicit consent via our cookie consent mechanism.

Full details of the cookies we use, their purpose, duration, and the third parties involved are set out in our Cookie Policy, available at formichettihd.com/cookie-policy.

You can manage or withdraw your cookie consent at any time through the cookie settings panel on our Website, or by adjusting your browser settings.

9. Your Rights

Subject to the conditions set out in applicable law, you have the following rights in relation to your personal data:

• Right of access (Art. 15 GDPR): To obtain confirmation of whether we process your personal data and, if so, to receive a copy.
• Right to rectification (Art. 16 GDPR): To have inaccurate personal data corrected without undue delay.
• Right to erasure (Art. 17 GDPR): To request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations.
• Right to restriction (Art. 18 GDPR): To request that we restrict the processing of your data in certain circumstances.
• Right to data portability (Art. 20 GDPR): To receive your personal data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR): To object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, to withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, please contact us at info@formichettihd.com. We will respond within one month of receiving your request. We may ask you to verify your identity before proceeding.

10. Direct Marketing

We will only send you direct marketing communications (including newsletters and promotional offers) if you have given us your explicit consent to do so. Each marketing communication will include an unsubscribe link, and you may also change your preferences at any time by contacting us at info@formichettihd.com.

We do not share your personal data with third-party advertisers for their own marketing purposes.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encrypted data transmission (HTTPS/TLS), access controls, and data processing agreements with all third-party processors.

Payment data is handled exclusively by Stripe and is subject to PCI-DSS Level 1 security standards. We do not store full payment card details on our systems.

Despite these measures, no transmission over the internet is completely secure. If you become aware of any security concern, please contact us at info@formichettihd.com.

12. Supervisory Authorities and Complaints

If you believe that our processing of your personal data is unlawful or that we have failed to comply with our obligations under applicable data protection law, you have the right to lodge a complaint with a supervisory authority.

• Swiss users: The Federal Data Protection and Information Commissioner (FDPIC), available at https://www.edoeb.admin.ch.
• EU/EEA users: The national data protection authority in your country of residence. A list of EU national data protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We would, however, welcome the opportunity to address your concern directly before you approach a supervisory authority. Please contact us at info@formichettihd.com in the first instance.

13. Amendments to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we do, we will update the version date at the top of this document and, where changes are material, notify you by email or by a prominent notice on the Website. Your continued use of the Service after publication of a revised Privacy Policy constitutes acceptance of the updated terms.

14. Contact

For any questions, requests, or concerns relating to this Privacy Policy or our data processing practices, please contact us at:

Dismart SAGL

Via Luganetto 4, 6962 Viganello (Ticino), Switzerland

E-mail: info@formichettihd.com

We aim to respond to all data protection enquiries within one month.