Data protection

Controller

The controller responsible for processing your personal data in the amazingtoys.ch online shop and in the AMAZINGTOYS® Store is:

Amazing Enterprise AG
Zweierstrasse 123
8003 Zürich
Switzerland

Phone: +41 43 333 22 02
Email: service@amazingtoys.ch
Registered in the Commercial Register of the Canton of Zurich, UID: CHE-305.929.293

If you have any questions about data protection or wish to exercise your rights, you can contact us at any time using these details.

Contacting us

When the provider is contacted (for example via the contact form or by email), the user's details are stored in order to process the enquiry and in case follow-up questions arise.

Purchases and customer account

When you order in our online shop, we process the information required to conclude and perform the purchase contract: title, first and last name, billing and delivery address, email address, phone number (if provided), the items ordered and their prices, the payment and shipping method chosen, and the order, payment and shipping status.

We use this data to fulfil your order, to send you order and shipping confirmations, to handle queries, returns and warranty cases, and to invoice our services. Card and other payment details are collected directly by the payment service providers listed under «Payments»; we do not store any card numbers ourselves.

An order requires a customer account. In the customer account we also store your login details (the password only in encrypted form), saved addresses, your order history, your wishlist and your customer group. If you take part in our customer card programme, we also store your customer card level and your balance of VIP points.

To keep you signed in on your device, we use technically necessary cookies. The sign-in ends after 30 days without a visit, after 90 days at the latest, or as soon as you sign out. For the «Signed-in devices» overview in your customer account, we store the browser, the device type and the approximate location (city and country). We derive the location from your IP address; we do not store the IP address itself.

If you save a payment method for future purchases, we store in your customer account an encrypted reference from our payment service provider Payrexx, the payment type, for cards the brand, the last four digits and the expiry date, as well as the time of your consent and of the last use. Card numbers and other payment data are stored not by us but by Payrexx and the payment services involved (see «Payments»). We use this information only to pay for orders you place and – if you have taken out a subscription – its agreed renewals. The basis is the consent you give when saving the payment method. You can withdraw it at any time by removing the payment method in your customer account under «Payment methods». If you remove a payment method or delete your customer account, we also arrange for its deletion at Payrexx. After removal, we keep a record without the reference (payment type, last digits, time of consent and of removal) as proof of your consent until your customer account is deleted.

You can update the details in your customer account yourself at any time. You can request the deletion of your customer account by email to service@amazingtoys.ch. We are legally required to keep order and invoice data for ten years (Art. 958f of the Swiss Code of Obligations).

Shipping

To deliver your order, we pass on your name and delivery address and, where necessary for delivery and shipment notifications, your email address and phone number to the shipping company we have commissioned. The shipping company uses this information to deliver the parcel and to keep you informed about the delivery status, for example with shipment tracking or a notice of the delivery date.

We work with the following shipping companies:

• Die Schweizerische Post AG (Swiss Post), Wankdorfallee 4, 3030 Bern, Switzerland – for shipments within Switzerland. Data protection: www.post.ch
• DHL Express (Schweiz) AG – for shipments abroad. Data protection: www.dhl.com

For shipments abroad, we also transmit the information required for customs clearance, such as a description and the value of the goods. This information is passed on to the customs authorities of the country of destination. The shipping companies process the data partly under their own responsibility; their privacy policies also apply.

Buyback and PSA Grading

Buyback: If you sell us cards or collections, we record – via the check-in form at checkin.amazingtoys.ch or directly in the AMAZINGTOYS® Store – your first and last name, date of birth, address, email address and phone number. In addition, we record the items bought, the prices and the type of payout (cash or store credit). We use this information to call you up, to confirm your queue number by email, to process and book the buyback and to comply with legal obligations.

Before the payout, we check your ID. In our system we only record that the check has taken place. We send the confirmation of your queue number and any request for a review after the buyback by email via Klaviyo. You will only receive the newsletter if you select it at check-in and confirm the subscription by email.

PSA Grading: If you book our grading service, we process your order as described under «Purchases and customer account» and additionally record the cards submitted, the processing status and the return. We submit the cards collectively in our name to PSA or CGC in the USA. In doing so, we transmit information about the cards but, as a rule, no information about you. As soon as your cards are back, we notify you by email.

AMAZINGTOYS® Store and checkout

When you shop in the AMAZINGTOYS® Store, we record the purchase in our checkout system (items, prices, payment method and time). If you show your customer card or give your customer account, we assign the purchase to your customer account; it then counts towards your customer card level and your VIP points. Without a customer card or customer account, you can also shop in the store without providing any personal details.

Card and TWINT payments at our terminals are processed by Worldline Schweiz AG. We do not receive full card numbers. We keep the checkout data for ten years, like other accounting records (Art. 958f of the Swiss Code of Obligations). For video surveillance in the store, see «Video surveillance».

AMAZINGTOYS® app

With the AMAZINGTOYS® app for iPhone (App Store) and Android (Google Play), you can shop in our online store, use your customer account and your VIP card, and receive information about new pre-orders (drops). The app displays the pages of our online store; the provisions described under «Purchases and customer account» and «Comments and reviews» therefore apply to purchases, the customer account and reviews. In addition, we process the following data in the app.

Staying signed in and deleting your account

Like the online store in the browser, the app keeps you signed in using technically necessary cookies. It appears in your customer account under «Signed-in devices» and can be signed out there at any time. In the app settings, you can request the deletion of your customer account. The request is sent to our customer service; we delete your data unless a statutory retention obligation applies.

Notifications about drops

If you turn on notifications, we receive a device identifier for notifications (push token): on the iPhone from Apple, on Android from Google (Firebase Cloud Messaging). We store it together with the topics you have chosen (e.g. Pokémon or Magic), the language and the app version and – if you are signed in – with your customer account. The notifications are delivered by the Apple Push Notification Service on the iPhone and by Firebase Cloud Messaging on Android. You can turn off individual topics in the app and notifications altogether in the settings of your iPhone or Android device at any time; we delete identifiers that have become invalid.

Notifications about promotions and new arrivals (Klaviyo)

We send notifications about promotions, new arrivals and offers via Klaviyo (Klaviyo, Inc., USA), which we also use for our newsletter (see «Klaviyo»). If you turn on notifications, the app transmits to Klaviyo the device identifier for notifications, whether notifications are allowed, whether you wish to receive promotions and new arrivals, and technical information such as the device model, operating system and app version. If you are signed in to the app, we link this identifier to your profile at Klaviyo (email address and internal customer ID of our online store) so that the notifications match your interests and you do not receive the same promotion twice; without signing in, the profile remains without a name or email address. If you tap such a notification, Klaviyo records the opening. If you sign out of the app, we separate the device from your profile again.

You can turn off notifications about promotions and new arrivals in the app at any time (app settings or the bell in the Drops section, switch «Promotions and new arrivals»); you will then continue to receive notifications about drops.

VIP card, Apple Wallet and Google Wallet

The VIP card in the app shows a QR code with your customer number so that we can assign your purchase in the store to your customer account. If you add the card to Apple Wallet on the iPhone, we create it on our server and update your points balance via Apple. On Android, you can add the card to Google Wallet; we then create it at Google with your name, customer number and points balance and update the points balance via Google. So that your device can show the card near the store, it contains the location of the store; your own location is not transmitted to us.

Location

The app only asks for your location if you choose to display the distance to the AMAZINGTOYS® Store in the «Store» section, and only while you are using the app. It always uses an approximate location. The distance is calculated on your device; we receive neither your coordinates nor the exact distance, but only a rough distance band for evaluation purposes (e.g. «under 2 km»). You can withdraw the permission in the settings of your iPhone or Android device at any time.

Usage analysis with Google Analytics for Firebase

To improve the app, we analyse how it is used: sections and store pages viewed (without search terms or order numbers in the address), search queries, drops and notifications tapped, use of the VIP card, as well as technical information such as the device model, operating system version (iOS or Android), app version, language and approximate region. For this we use Google Analytics for Firebase from Google Ireland Limited or Google LLC. The app receives a random identifier; if you are signed in, we also transmit your customer number so that we can combine usage across several devices – never your name or your email address. Without your permission for tracking (see below), we do not use an advertising ID for this and do not use the data for advertising.

Crash reports with Firebase Crashlytics

If the app crashes, it sends a crash report to Firebase Crashlytics (Google): technical information about the error, the device model, operating system and app version and – if you are signed in – your customer number so that we can trace a reported error.

Tracking only with your permission

The app asks you whether it may track your activity across other companies' apps and websites: on the iPhone via the iOS dialog (App Tracking Transparency), on Android via its own dialog in the app. Only if you choose «Allow» do we use your device's advertising ID for measuring and personalising advertising (Google) and load, in the store pages of the app, the services we use in the online store for advertising and reach measurement – Google Analytics and Google Ads via Google Tag Manager, Meta (Facebook and Instagram), TikTok and Microsoft Clarity – each as described in the corresponding sections. If you choose «Ask App Not to Track» (on Android: «Don't allow») or have not yet decided, the app does not load these services; you can continue to use the HubSpot chat, which then sets no tracking cookies. You can change your choice at any time: on the iPhone in the iPhone settings under «Privacy & Security» → «Tracking», on Android in the app settings under «Tracking».

Retention

Google Analytics deletes usage data linked to your app identifier or customer number after 14 months without new use; crash reports after 90 days. We and Klaviyo store push identifiers as long as notifications are turned on and the identifier is valid; for your profile at Klaviyo, the provisions described in the «Klaviyo» section apply.

Competitions

For competitions, for example on Instagram, we process the information required for participation and processing: your username on the platform, your messages and reactions in the context of the competition and, if you provide it, your email address. For communication on Instagram we use ManyChat (see «ManyChat»).

If you win, we notify you by direct message and ask for the information needed to deliver the prize, such as your name and address. You will only be subscribed to the newsletter if you expressly choose this and confirm it by email. The terms of participation of the respective competition and the privacy policy of the platform also apply.

Comments and reviews

If users leave comments on the blog or other posts, their IP addresses are stored. This is done for the provider's security, in case someone writes unlawful content in comments and posts (insults, prohibited political propaganda, etc.). In such a case the provider itself can be held liable for the comment or post and therefore has an interest in the identity of the author.

Integration of third-party services and content

It may happen that third-party content is embedded within this online offering, such as videos from YouTube, map material from Google Maps, RSS feeds or graphics from other websites. This always requires that the providers of this content (hereinafter referred to as “third-party providers”) are aware of the users' IP address. Without the IP address they would not be able to send the content to the browser of the respective user. The IP address is therefore necessary for this content to be displayed. We endeavour to use only content whose respective providers use the IP address solely to deliver the content. However, we have no influence over whether third-party providers store the IP address, for example for statistical purposes. Where this is known to us, we inform users about it.

Access data/ server log files

The provider (or its web space provider) collects data about every access to the offering (so-called server log files). The access data includes:

Name of the web page accessed, file, date and time of access, volume of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider. The provider uses the log data only for statistical analyses for the purposes of operating, securing and optimising the offering. However, the provider reserves the right to check the log data subsequently if specific indications give rise to a justified suspicion of unlawful use.

Cookies privacy policy

Our website uses so-called cookies. These are small text files that are stored on your device with the help of the browser. They do no harm. We use cookies to make our offering user-friendly. Some cookies remain stored on your device until you delete them. They enable us to recognise your browser on your next visit. If you do not want this, you can set up your browser so that it informs you when cookies are set and you allow this only in individual cases. If cookies are deactivated, the functionality of our website may be limited.

We store your choice in the cookie settings in the cookies «cookie-preference» and «cookie-config-hash» for 365 days. After that, we will ask you again. You can change your choice at any time using the «Cookie settings» button at the top of this page.

Disclosure to advertising networks

To advertise our offering on other websites and platforms and to measure the success of our advertising, we pass on usage data to advertising networks. These are in particular:

• Google (Google Ireland Limited, Ireland, and Google LLC, USA) – Google Ads and Google Analytics
• Meta (Meta Platforms Ireland Limited, Ireland, and Meta Platforms, Inc., USA) – advertising on Facebook and Instagram
• TikTok (TikTok Technology Limited, Ireland, and affiliated companies)
• Microsoft (Microsoft Corporation, USA) – Microsoft Clarity, linked to Microsoft Advertising

The data passed on includes in particular pages visited and products viewed, search terms, basket actions and purchases (items, order value, currency and order number), technical information such as IP address, browser and device, cookie and device identifiers, and identifiers from ads you clicked. For purchases, we may also transmit your email address or phone number in encrypted form (as a hash value) so that the platform can attribute a purchase to the relevant ad.

Some of this data is sent to the advertising networks not directly from your browser but via our own tracking servers (banana.amazingtoys.ch and capig.amazingtoys.ch). These servers are operated on our behalf by the service provider Stape.

The advertising networks also process this data for their own purposes, for example to improve their advertising systems, and are responsible for this themselves. If you are logged in to the platform concerned, it may link the data to your account. The data may be transferred to the USA and other countries; the providers rely on the Swiss-U.S. Data Privacy Framework or on standard contractual clauses.

We use this data to show people who have visited our online shop suitable ads on the platforms, including ads featuring products from our range (retargeting). We create target groups, for example visitors from recent weeks or previous buyers, and measure which ads lead to visits and purchases.

You can restrict personalised advertising in the ad settings of the platform concerned, for example at Google under myadcenter.google.com and at Meta under facebook.com/adpreferences. You can also block or delete cookies in your browser or contact us (see «Controller»).

Profiling

Profiling is the automated evaluation of personal data to assess personal aspects such as interests or likely behaviour. We use profiling in the following cases:

• Newsletter and emails: If you have subscribed to our newsletter, we use Klaviyo to evaluate whether you open our emails and which links you click, and which products you view, add to your basket or buy. On this basis we send you, for example, reminders about an unfinished purchase or about products you viewed, as well as offers that match your previous purchases.
• Customer card: Based on your purchases, we assign your customer account to a level of our customer card programme. Your benefits depend on the level.
• Advertising: The advertising networks (see «Disclosure to advertising networks») create target groups and interest profiles from your usage behaviour so that suitable ads can be shown to you.
• Analysis: With Google Analytics and Microsoft Clarity, we evaluate usage behaviour using pseudonymous identifiers in order to improve our online shop.
• Invoice: If you choose to pay by invoice, CembraPay AG checks your creditworthiness automatically. The result determines whether payment by invoice is offered to you. You can state your point of view and request that the decision be reviewed by a person; to do so, contact CembraPay or us. Irrespective of this, you can choose another payment method at any time.

You can object to profiling for advertising purposes at any time, for example by unsubscribing from the newsletter via the unsubscribe link in every email or by contacting us.

Disclosure abroad

We generally process personal data in Switzerland. However, some of the service providers and recipients named in this privacy policy also process personal data abroad. This applies in particular to:

• EU and EEA states, in particular Ireland (e.g. Apple, Google, Meta, TikTok, Stripe), Luxembourg (PayPal), France (Stape) and Germany (HubSpot). According to Annex 1 of the Swiss Data Protection Ordinance (DPO), these states ensure an adequate level of data protection.
• USA, e.g. Apple, Google, Meta, Microsoft, HubSpot, Klaviyo and ManyChat. Since 15 September 2024, the Swiss Federal Council has recognised an adequate level of data protection for companies certified under the Swiss-U.S. Data Privacy Framework. For recipients without this certification, we rely on the standard contractual clauses of the European Commission, which are recognised by the Federal Data Protection and Information Commissioner (FDPIC).
• Other countries: Individual providers, such as TikTok or PayPal, may also process data in other countries, for example in the United Kingdom or Singapore. Here too, the providers rely on an adequate level of data protection in the recipient country or on standard contractual clauses.
• Deliveries abroad: For orders delivered abroad, we pass on the information required for delivery and customs clearance to the country of destination. This is necessary for the performance of the contract.

Standard contractual clauses are model contracts in which the recipient undertakes to ensure an adequate level of data protection. They can partly compensate for weaker legal protection in the recipient country, but cannot completely rule out access by authorities abroad. You can request a copy of the safeguards using the contact details under «Controller», insofar as they are not publicly available.

Privacy policy for the use of the Facebook pixel

On our website we use a so-called tracking pixel from Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Facebook Inc. 1601, Willow Road Menlo Park, CA 94025, USA. We use the Facebook pixel in order to track the success of our own Facebook advertising campaigns and to optimise the delivery of Facebook advertising campaigns to interested target groups.

After a click on a Facebook advertisement, or when you visit our website, a cookie is stored on your device by means of the pixel on our website. The cookie processes data about whether you reached our website via a Facebook advertisement and makes it possible to analyse the user's behaviour through to the completion of a purchase. This allows us to track the success rate of our Facebook advertising campaigns. In addition, the pixel processes data about the fact that you have visited our website and makes it possible to tailor the advertising shown on Facebook to your interests.

The Facebook pixel integrated on our website establishes a direct connection to Facebook's servers when our website is visited. The information generated by the cookie about your use of this website (including your IP address) is transmitted to Facebook in the USA. Facebook ensures an adequate level of data protection by means of the EU standard contractual clauses. You can obtain a copy of the contractual clauses here: https://www.facebook.com/legal/EU_data_transfer_addendum

The data collected is anonymous for us and does not allow us to draw any conclusions about the user. If you are registered with Facebook, Facebook can associate the recorded information with your account. Even if you do not have a Facebook account, or are not logged in when visiting our website, it is possible for Facebook to process and store your IP address and further identifying data.

The legal basis for the data processing is your consent pursuant to Art. 6 para. 1 a) GDPR.

You can withdraw your consent to data processing by the Facebook pixel for our web domain at any time with effect for the future by adjusting your preferences in our cookie settings. You can also prevent cookies from being set by adjusting the corresponding settings in your Facebook account at https://www.facebook.com/settings?tab=ads.

Privacy policy for the use of Klaviyo

Our email newsletters are sent via the technical service provider “Klaviyo”, 225 Franklin St, Boston, MA 02110, USA (http://www.klaviyo.com/), to which we pass on the data you provide when registering for the newsletter. This transfer takes place pursuant to Art. 6 para. 1 lit. f GDPR and serves our legitimate interest in using an effective, secure and user-friendly newsletter system. Please note that your data is generally transferred to a Klaviyo server in the USA and stored there.

Klaviyo uses this information to send the newsletters on our behalf. Klaviyo does not use the data of our newsletter recipients to contact them itself or to pass it on to third parties.

To protect your data in the USA, we have concluded a data processing agreement (“Data Processing Agreement”) with Klaviyo, in which Klaviyo undertakes to protect our users' data, to process it on our behalf in accordance with its data protection provisions and in particular not to pass it on to third parties.

We also use Klaviyo for notifications about promotions and new arrivals in our app; for details, see «AMAZINGTOYS® app».

You can view Klaviyo's data protection provisions here: https://www.klaviyo.com/privacy

Privacy policy for the use of HubSpot

For our customer service we use HubSpot, software provided by HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA, with its European branch HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland. Our HubSpot data is stored in a data centre in the EU (Germany). We use HubSpot for the following purposes:

• Customer service by email: We handle email enquiries in HubSpot. In doing so, we store your name, your email address, the content of your message and our replies and, if you provide it, your order number.
• Chat on our website: If you use the chat window, we store the chat history and the information you provide in the chat. In the chat, an AI assistant from HubSpot (Breeze), which draws on information from our website, replies first. Enquiries it cannot answer are taken over by our team.
• Visitor recognition: When you visit our website, HubSpot loads a tracking code. It sets the cookies «hubspotutk» and «__hstc» (visitor identification, up to 6 months), «__hssc» (30 minutes) and «__hssrc» (until the end of the browser session) and records pages visited, time, referring page, IP address and information about your browser and device. This allows us to link a chat or an enquiry to the pages visited beforehand.
• Forms: Information you enter in forms on our website, such as your email address, may be transmitted to HubSpot and linked to your contact.

HubSpot processes the data on our behalf. Access from the USA is possible; HubSpot is certified under the Swiss-U.S. Data Privacy Framework and also uses standard contractual clauses. You can block or delete the cookies in your browser. Further information: legal.hubspot.com

Privacy policy for the use of Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transferred to a Google server in the USA and stored there. If IP anonymisation is activated on this website, however, your IP address will first be truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. Google will use this information to evaluate your use of the website, to compile reports on website activity for website operators and to provide further services connected with the use of the website and of the internet. Google may also transfer this information to third parties where this is required by law or insofar as third parties process this data on Google's behalf. The IP address transmitted by your browser within the scope of Google Analytics will not be combined with other Google data.

You can prevent the installation of cookies by adjusting your browser software accordingly; we point out, however, that in this case you may not be able to use all functions of this website to their full extent. By using this website you consent to the processing of the data collected about you by Google in the manner described above and for the purpose stated above.

Privacy policy for the use of Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or statistics tools and other technologies on our website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any analyses of its own. It merely serves to manage and deliver the tools integrated through it. However, Google Tag Manager does record your IP address, which can also be transferred to Google's parent company in the United States.

Google Tag Manager is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the fast and uncomplicated integration and management of various tools on its website. Where corresponding consent has been requested, the processing takes place exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent can be withdrawn at any time.

Privacy policy for the use of Microsoft Clarity

On our website we use Microsoft Clarity, an analytics service provided by Microsoft Corporation, USA, and affiliated companies. We use it to examine how visitors use our website, in order to improve usability, our offering and our advertising and to detect technical problems.

Among other things, Clarity records pages visited, clicks, scrolling and mouse movements, the duration of the visit as well as technical details about the browser and device. The IP address is used to determine the approximate location. From this data Clarity creates aggregated representations of usage behaviour, so-called heatmaps, and replays of individual website visits, so-called session recordings. Content displayed on the website may form part of these recordings.

In addition, we transmit certain shop actions, for example searches, basket actions and completed purchases, as well as the order value and the currency in the case of purchases. Pseudonymous user and session identifiers may be used to match this with our Google Analytics analyses. The connections with Google Analytics and Google Ads support the analysis of our website and advertising activities.

Clarity uses cookies and similar technologies. These include in particular “_clck” for recognising a browser and “_clsk” for grouping several page views into one session. Microsoft may use further cookies for analytics, advertising and operational purposes. The data is not necessarily anonymous, as identifiers make it possible to recognise and link activities.

The data collected is transmitted to Microsoft and may also be processed outside Switzerland, in particular in the USA. Microsoft also processes data for its own purposes, in particular to provide and improve its services and for Microsoft Advertising. Microsoft may also use non-personal data for research and development. Further information is contained in the Microsoft privacy statement.

According to current Microsoft documentation, session recordings are generally retained for 30 days. Flagged sessions or sessions saved as favourites, as well as heatmap and click data, are retained for up to nine months. Information on retention

You can block or delete cookies via your browser settings. However, this does not necessarily prevent every collection of usage data. As a means of objecting to Clarity telemetry, Microsoft names the selection of Microsoft via the Digital Advertising Alliance and supports the browser signal Global Privacy Control. Further information can be found in the Clarity privacy information.

Privacy policy for the use of TikTok

On our website we use the TikTok pixel. The TikTok pixel is a TikTok advertiser tool from the two providers TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, WeWork, 125 Kingsway, London, WC2B 6NH, United Kingdom (together “TikTok”). The TikTok pixel is a snippet of JavaScript code that enables us to understand and track the activities of visitors on our website. For this purpose, the TikTok pixel collects and processes information about the visitors to our website or about the devices they use. The data collected via the TikTok pixel is used for the targeting of our advertisements, for improving ad delivery and for personalised advertising. For this purpose, the data collected on our website by means of the TikTok pixel is transmitted to TikTok. Some of this data is information that is stored on the device you use. In addition, cookies are also used via the TikTok pixel, by means of which information is stored on the device you use. Such storage of information by the TikTok pixel, or access to information that is already stored on your device, only takes place with your consent. Further information on how TikTok processes personal data, including the legal basis on which TikTok relies and the options for exercising your rights vis-à-vis TikTok, can be found in TikTok's privacy policy at https://www.tiktok.com/legal/privacy-policy?lang=de-DE.

Privacy policy for the use of ManyChat

On our website we use ManyChat Pixel, a mobile marketing platform.

The service provider is the American company ManyChat Inc. 535 Everett Avenue, Apartment 312, Palo Alto, CA 94301, USA.

ManyChat also processes data about you in the USA, among other places.

As the basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, i.e. in particular in the USA) or for a transfer of data to such countries, ManyChat uses so-called standard contractual clauses (= Art. 46 para. 2 and 3 GDPR). Standard contractual clauses (Standard Contractual Clauses - SCC) are model templates provided by the EU Commission and are intended to ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. Through these clauses ManyChat undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find more information about the standard contractual clauses and about the data processed through the use of ManyChat in the Privacy Policy at https://manychat.com/privacy.html.

Privacy policy for the Mobile Services of Amazing Enterprise AG

The Amazing Enterprise AG mobile messaging services (hereinafter the “Service”) are operated by Amazing Enterprise AG (“Amazing Enterprise AG”, “we” or “us”). Use of the Service requires acceptance of these general terms and conditions (“Mobile Terms”).

We reserve the right to change or discontinue the Service or individual functions at any time without prior notice. To the extent permitted by law, we may also amend these Mobile Terms at any time. Continued use of the Service after such changes take effect is deemed to be acceptance of the amended terms.

By agreeing to the SMS/text message services of Amazing Enterprise AG, you consent to receiving recurring SMS/text messages from and on behalf of Amazing Enterprise AG at the mobile number you have provided, even if your number is registered on a state or national “do not call” list. Text messages may be sent using an automatic dialling system or other technologies. Messages may contain information such as updates, notifications and other service-related content (e.g. order or account notifications) as well as promotional content such as promotions and marketing offers (e.g. basket reminders).

Voluntary participation and costs You understand that participation in this programme is voluntary and is not a condition for making a purchase from Amazing Enterprise AG. There are no direct costs for the Service; however, you are responsible for all fees and charges that your mobile provider levies in connection with text messages. Message frequency may vary. SMS and data rates from your mobile provider may apply. For further information, please refer to your mobile phone contract or contact your provider.

Unsubscribing You can cancel the Service at any time by sending the keyword “STOP” to AMAZINGTOYS® or by clicking the unsubscribe link (if available) in a text message. After unsubscribing you will receive a confirmation message and no further messages will be sent to your mobile device unless they are initiated by you. If you participate in several mobile programmes of Amazing Enterprise AG, you must, unless otherwise provided by law, unsubscribe from each programme separately by following the instructions in the respective Mobile Terms.

Customer support For support or questions, send the keyword “HELP” to AMAZINGTOYS® or write an email to service@amazingtoys.ch.

Changes and liability We reserve the right to change the short codes or telephone numbers used for the Service at any time and to inform you of such changes. Messages sent to a changed number or short code may under certain circumstances not be received, and we accept no responsibility for such cases. The mobile providers that support the Service are not liable for delayed or undelivered messages. You undertake to provide us with a valid mobile number. If you obtain a new mobile number, you must register for the Service again with the new number.

To the extent permitted by law, we are not liable for failed, delayed or misdirected deliveries of information, for any errors in the information sent, or for actions that you take or refrain from taking on the basis of the information provided or of the Service.

Payments

We use specialised service providers in order to be able to process our customers' payments securely and reliably. The legal texts of the individual service providers, such as general terms and conditions (GTC) or privacy policies, apply in addition to the processing of payments.

We use in particular:

• PayPal: Processing of payments; providers: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) / PayPal Pte. Ltd. (Singapore); data protection information: privacy policy https://www.paypal.com/ch/webapps/mpp/ua/privacy-full?locale.x=de_CH, “Statement on cookies and tracking technologies” https://www.paypal.com/ch/webapps/mpp/ua/cookie-full?locale.x=de_CH.
• Payrexx: Processing of payments; provider: Payrexx AG (Switzerland); data protection information: “Policies” including privacy policy https://www.payrexx.com/de/rechtliches/.
• Stripe: Processing of payments; providers: Stripe Inc. (USA) / Stripe Payments Europe Limited (SPEL, Ireland) for users in the European Economic Area (EEA) and in Switzerland as well as partly in the United Kingdom / Stripe Payments UK Limited (United Kingdom) and Stripe Capital Europe Limited (Ireland) partly for users in the United Kingdom; data protection information: “Stripe Privacy Center” https://stripe.com/de-ch/legal/privacy-center, privacy policy https://stripe.com/de-ch/privacy, cookie policy https://stripe.com/de-ch/legal/cookies-policy.
• TWINT: Processing of payments in Switzerland; provider: TWINT AG (Switzerland); data protection information: privacy policy https://www.twint.ch/datenschutz/, “Security to Swiss standards” https://www.twint.ch/privatkunden/support/sicherheit/.
• Invoice: Processing of payments in Switzerland; provider: CembraPay AG (Switzerland); data protection information: privacy policy https://cembrapay.ch/de/privacy, “Data protection information on the credit check” https://cembrapay.ch/de/creditcheck.

For saved payment methods (see «Purchases and customer account»), Payrexx stores the payment data in the form of an authorisation (tokenisation) and charges it on our behalf. For TWINT, the authorisation also exists in your TWINT app and can be cancelled there.

Extensions for the website

We use extensions for our website in order to be able to use additional functions.

We use in particular:

Google reCAPTCHA: Spam protection (distinguishing between desired comments from humans and unwanted comments from bots as well as spam); provider: Google; Google reCAPTCHA-specific information: “What is reCAPTCHA?” https://developers.google.com/recaptcha?hl=de.

Data security

We take appropriate technical and organisational measures in order to achieve a level of security appropriate to the risk. However, it is not possible for us to guarantee complete security of the data.

Access to our website is secured by transport encryption implemented by SSL/TLS protocols, in particular HTTPS. In most web browsers this is indicated by a padlock symbol in the address bar.

As with any digital communication, our digital communication is also subject to mass surveillance by security authorities, without any specific occasion or suspicion, both in Switzerland, in the rest of Europe, in the USA and in other countries. We have no direct influence on how intelligence services, police authorities and other security bodies process personal data.

Video surveillance

We use video surveillance to prevent criminal offences and to secure evidence in the case of criminal offences, as well as to exercise our domiciliary rights. Insofar as and to the extent that the General Data Protection Regulation (GDPR) is applicable, these are overriding legitimate interests pursuant to [Art. 6 para. 1 lit. f GDPR](https://steigerlegal.ch/dsgvo/dsgvo-6/).

We store recordings from our video surveillance for as long as they are required for securing evidence.

We may secure recordings on the basis of legal obligations, in order to enforce our own legal claims and where criminal offences are suspected, and transmit them to the competent bodies, in particular to judicial or law enforcement authorities.

Your rights

In principle you have the rights to information, rectification, erasure, restriction, data portability, withdrawal and objection. If you believe that the processing of your data infringes data protection law or that your data protection rights have otherwise been violated in some way, you can lodge a complaint with the supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC).

Withdrawal, changes, corrections and updates

Users have the right to receive information free of charge upon request about the personal data that has been stored about them. In addition, users have the right to rectification of incorrect data and to blocking and erasure of their personal data, provided that no statutory retention obligation precludes this.