Privacy policy
PRIVACY POLICY
-
DATA CONTROLLER
The party responsible for processing personal data is:
5 Mountains Longevity AG
Maneggplatz 34
CH-8041 Zurich
Switzerland
Email: info@drink5m.com
This Privacy Policy applies to www.drink5m.com, the online store, customer accounts, and the related contact, ordering, and marketing processes.
The Swiss Federal Act on Data Protection, or FADP, and, where applicable, the European Union General Data Protection Regulation, or GDPR, apply.
-
PERSONAL DATA WE PROCESS
Depending on how the services are used, we process in particular:
• Identity and contact information, such as name, address, email address, and telephone number
• Order, contract, payment, shipping, and return information
• Account, communications, support, chat, and review information
• Marketing preferences and records of consent or withdrawal
• Technical information, such as IP address, device, browser, log, cookie, and usage data
• Location or regional information where required for language, currency, market assignment, and shipping
We receive data directly from users, from orders and customer accounts, from devices and browsers, and from payment, shipping, platform, and sales partners.
-
PURPOSES AND LEGAL BASES
We process data to provide the store, fulfill orders, verify payments, deliver merchandise, manage customer accounts, respond to inquiries, prevent misuse and fraud, comply with legal obligations, and establish, exercise, or defend legal claims.
Where the GDPR applies, we rely on:
• Performance of a contract and precontractual measures
• Compliance with legal obligations
• Consent
• Legitimate interests
Our legitimate interests include secure and efficient store operations, fraud prevention, customer service, audience measurement, improvement of our offerings, and direct marketing to the extent permitted by law.
Required information must be provided so that we can process an order or inquiry. Without it, the relevant service cannot be provided.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects for customers.
-
STORE OPERATIONS AND SERVICE PROVIDERS
Our online store is operated through Shopify. Shopify International Limited, Shopify Inc., and affiliated companies may process data as processors or independent controllers.
Shopify provides hosting, checkout, customer accounts, store functions, security, and technical infrastructure.
We disclose data only where required for the purposes described above or where another legal basis exists. Recipients include, in particular:
PAYMENTS
Wallee AG, PostFinance, PayPal, card networks, banks, and other payment providers selected at checkout.
Payment providers process payment and fraud-prevention data under their own privacy terms.
SHIPPING AND TRACKING
Swiss Post, UPS, and other logistics providers displayed at checkout. Synctrack may be used for transmitting shipment data to PayPal.
EMAIL AND NEWSLETTERS
Seguno or Shopify infrastructure may be used for managing and sending messages.
CUSTOMER REVIEWS
Loox may process data when a review is submitted or a review invitation is lawfully sent.
CHAT AND SUPPORT
Shopify Messaging, Shopify Inbox, and support systems authorized by us may be used to process customer inquiries.
CONSENT MANAGEMENT
Complianz may be used to display the cookie banner and document selected privacy settings.
LOCALIZATION
Shopify Markets, Translate & Adapt, and Geolocation – GLC may be used for language, currency, region, and market assignment.
STORE FUNCTIONS AND AUTOMATION
Apex Cart Progress Bar, Shopify Flow, Marketplace Connect, and authorized administrative, automation, and assistance tools may be used for shopping cart functions, order processing, sales, or internal store processes.
Service providers receive only the data required for their respective tasks and are contractually or legally obligated to maintain appropriate data protection.
-
COOKIES, ANALYTICS, AND ADVERTISING
We use technically necessary cookies and similar technologies so that the store, shopping cart, checkout, security, language selection, and customer account function properly.
Where required by law, analytics and marketing technologies are used only after consent is provided through the cookie banner.
Consent may be changed or withdrawn through the cookie settings at any time with effect for the future.
With consent, Google Analytics 4 and Google Ads, provided by Google Ireland Limited or Google LLC, may be used for audience measurement, performance analysis, and interest-based advertising.
Device, cookie, usage, and truncated IP data may be processed and linked with Google services. Embedded YouTube content may transmit data to Google or YouTube when played.
Technically necessary processing is carried out to perform contracts and based on our legitimate interest in operating a secure and functional store.
Analytics and advertising technologies that require consent are based on that consent.
-
CONTACT, CHAT, WHATSAPP, AND NEWSLETTERS
When you contact us, we process the information provided to respond to the inquiry, initiate or perform a contract, and maintain appropriate records.
If contact is made voluntarily through WhatsApp, WhatsApp Ireland Limited and affiliated Meta companies process communications and connection data under their own terms.
We send newsletters and other electronic advertising based on consent or another legal authorization.
Consent may be withdrawn at any time through the unsubscribe link or by emailing info@drink5m.com.
Service, security, and order-related messages are not affected by the withdrawal of marketing consent.
-
CUSTOMER ACCOUNTS, ORDERS, AND REVIEWS
We use information from customer accounts and orders for contract performance, support, accounting, fraud prevention, returns, and legally required documentation.
Payment information is processed primarily and directly by the selected payment providers. We generally receive only status and transaction information.
When customers submit a review, their name or chosen display name, review, images, and product reference may be published.
Review invitations are sent only to the extent permitted by law. We may review, block, or remove unlawful, misleading, or irrelevant content.
-
INTERNATIONAL DATA TRANSFERS
Shopify and other service providers may process data in Switzerland, the European Economic Area, the United States, Canada, and other countries.
Where a country does not provide a level of data protection recognized as adequate by law, we use appropriate safeguards, particularly recognized standard contractual clauses and any supplements required under Swiss law.
Where applicable, recipients may also be certified under a recognized data privacy framework. Statutory exceptions remain reserved.
-
RETENTION
We retain data for as long as required for the relevant purpose, as long as legitimate business interests exist, or as required by law.
Contract, order, and accounting records are generally retained for the statutory retention period, typically up to ten years.
Support data is deleted or anonymized after the matter has been completed unless retention or evidentiary interests require otherwise.
Marketing data is retained until consent is withdrawn, an objection is made, or the purpose no longer applies.
-
DATA SECURITY
We implement appropriate technical and organizational security measures and use encrypted connections.
No system can provide absolute security. Access is limited to persons and service providers who require it for their tasks.
-
RIGHTS OF INDIVIDUALS
Subject to the applicable legal requirements, individuals may:
• Request access to their personal data
• Request correction or deletion
• Request restriction of processing
• Request the provision or transfer of their data
• Withdraw consent
• Object to certain processing activities
Withdrawal applies prospectively and does not affect the lawfulness of processing carried out before the withdrawal.
Requests should be sent to info@drink5m.com.
To prevent unauthorized disclosure, we may require proof of identity.
Individuals also have the right to file a complaint with the Swiss Federal Data Protection and Information Commissioner, or FDPIC, or, where the GDPR applies, the competent European data protection authority.
-
CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy to reflect changes in legal, technical, or operational circumstances.
The version published on this website at the relevant time applies. Material changes will be communicated in an appropriate manner where required by law.