Privacy Policy

As of February 2026

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to personally identify you.

2. Responsible body

The entity responsible for data processing on this website is:

Tortuga Vitalis AG
Girenbachstrasse 17
6300 train
Switzerland

E-mail: shop@tortuga-sense.com

The responsible body is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

3. Data collection on our website

What data do we collect?

We collect the following data:

• Contact details (name, email address, telephone number)
• Order details (delivery address, billing address, order history)
• Customer account data (username, encrypted password, order history)
• Payment information (is processed encrypted via our payment service providers)
• Technical data (IP address, browser type, operating system, access times)
• Usage behavior (clicks, scrolling behavior, pages visited)
• Contact form data (name, email, phone, message)

What do we use your data for?

We use your data for the following purposes:

• Processing your orders and deliveries
• Managing your customer account
• Communication regarding your orders
• Responding to contact requests
• Improving our website and services
• Sending marketing emails (only with your consent)
• Notifications about product availability (only with your consent)
• Compliance with statutory retention obligations
• Analyzing user behavior for website optimization

How do we collect your data?

Your data is collected in two ways: firstly, when you provide it to us (e.g., when placing an order, creating a customer account, or via the contact form); and secondly, automatically by our IT systems when you visit the website (e.g., technical data).

4. Customer account

You have the option to create a customer account on our website. When you create a customer account, we store the following data:

• Name and email address
• Password (stored encrypted)
• Delivery address(es) and billing address(es)
• Order history
• Saved payment methods (references only, no full card details)

Legal basis: The processing is based on Art. 6 para. 1 lit. b GDPR for the performance of the contract and for the provision of the customer account.

Data retention period: Your customer account data will be stored until you delete your account. You can delete your account at any time in your account settings or by emailing us at Contact shop@tortuga-sense.com .

Security: Your password is encrypted and stored securely. We have no access to your plaintext password. Please use a strong password and do not share your login details with anyone.

5. Legal basis for processing

We process your personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR), where applicable.

The processing is carried out on the following legal bases:

• Contractual performance (Art. 6 para. 1 lit. b GDPR): For processing your orders and managing your customer account.
• Consent (Art. 6 para. 1 lit. a GDPR): For marketing emails, cookies and analytics tools
• Legitimate interest (Art. 6 para. 1 lit. f GDPR): To improve our website
• Legal obligation (Art. 6 para. 1 lit. c GDPR): Retention obligations

6. Data Sharing

We only share your data with third parties if:

• They have expressly consented
• This is necessary for the fulfillment of the contract (e.g., shipping service providers)
• There is a legal obligation.

Our service providers and tools:

• Shopify Inc. (e-commerce platform, hosting, customer account management) - Canada/USA
• Swiss Post (Shipping) - Switzerland
• Payment service provider (payment processing) - Switzerland/Europe/USA
• Google Analytics (website analytics) - USA
• Shopify Email (email marketing) - Canada/USA
• Reviews.io (product reviews) - UK
• Hotjar (user behavior analysis) - Malta/EU
• Back in Stock (Notifications when product is available) - USA
• Order Printer Pro (Invoicing) - USA

7. Storage duration

We only store your personal data for as long as is necessary to fulfill the purposes or as required by statutory retention periods.

• Order data: 10 years (legal retention requirement)
• Customer account data: Until you delete the account
• Contact form inquiries: 2 years after response
• Marketing consents: Until revoked
• Back-in-stock notifications: Until further notice or product availability
• Product reviews: Unlimited (until deleted upon request)
• Technical specifications: 90 days
• Google Analytics data: 14 months

8. Contact form

If you send us inquiries via contact form, your information from the inquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions.

The processing of this data is based on Article 6(1)(b) GDPR if your request is related to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, the processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Article 6(1)(f) GDPR).

The data you enter in the contact form will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g., after your inquiry has been processed). Mandatory legal provisions – in particular, retention periods – remain unaffected.

9. Cookies

Our website uses cookies. Cookies are small text files that are stored on your device. Some cookies are technically necessary, while others help us analyze and improve our website.

Technically necessary cookies: These cookies are required for the website to function (e.g. shopping cart, login, customer account).

Analytics cookies: These cookies help us to understand and improve the use of our website (e.g. Google Analytics, Hotjar).

Marketing cookies: These cookies are used to show you relevant advertising.

You can adjust your browser settings to notify you when cookies are being set and to allow cookies only in individual cases. Disabling cookies may limit the functionality of our website.

For more information, please see our Cookie Policy .

10. Your rights

You have the following rights regarding your personal data:

• Right of access: You can request information about your stored data (Art. 15 GDPR)
• Right to rectification: You can request the correction of inaccurate data (Art. 16 GDPR)
• Right to erasure: You can request the erasure of your data (Art. 17 GDPR)
• Restriction of processing: You can request the restriction of processing (Art. 18 GDPR)
• Data portability: You can receive your data in a structured format (Art. 20 GDPR)
• Right to object: You can object to the processing of your data (Art. 21 GDPR)
• Withdrawal of consent: You can withdraw your consent at any time (Art. 7 para. 3 GDPR)
• Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority.

To exercise your rights, please contact us at: shop@tortuga-sense.com

Competent supervisory authority:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern
Switzerland
Website: www.edoeb.admin.ch

11. Data security

We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorized persons.

Our website uses SSL encryption (HTTPS) for the secure transmission of confidential information. All payment data is transmitted in encrypted form and processed by certified payment service providers.

Passwords for customer accounts are stored encrypted and are not visible to us in plain text.

Our security measures are continuously improved in line with technological developments.

12. Newsletter & Marketing

When you subscribe to our newsletter, we use your email address exclusively for sending you information about our products and offers. You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in any newsletter email.

The processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time without affecting the lawfulness of the processing carried out before the withdrawal.

Shopify Email: We use Shopify Email to send our marketing emails. Shopify Email is a service provided by Shopify Inc. (Canada/USA). Your email address and name will be transmitted to Shopify. This processing is based on your consent (Art. 6 para. 1 lit. a GDPR).

13. Analytics Tools & Third-Party Services

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies to analyze website usage. The information generated by the cookie about your use of this website is generally transmitted to and stored on a Google server in the USA.

IP anonymization: We have activated IP anonymization on this website. This means that your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA.

Purpose: Google will use this information on our behalf to evaluate your use of the website, to compile reports on website activity, and to provide us with other services relating to website activity and internet usage.

Legal basis: The processing is based on your consent (Art. 6 para. 1 lit. a GDPR).

Opt-out: You can prevent the storage of cookies by adjusting your browser settings accordingly. Furthermore, you can prevent Google from collecting and processing the data generated by the cookie by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout

Storage period: The data we send and which is linked to cookies is automatically deleted after 14 months.

Shopify Analytics

We use Shopify Analytics to analyze the use of our website. Shopify collects data such as IP address, browser type, and pages visited. This processing is based on our legitimate interest in analyzing and optimizing our website (Art. 6 para. 1 lit. f GDPR).

Hotjar

We use Hotjar to analyze user behavior (heatmaps, session recordings). Hotjar records mouse movements, clicks, and scrolling behavior. The data is stored anonymously.

Legal basis: The processing is based on your consent (Art. 6 para. 1 lit. a GDPR).

Opt-out: You can disable Hotjar tracking at https://www.hotjar.com/policies/do-not-track/ .

Storage period: Hotjar recordings are automatically deleted after 365 days.

Reviews.io

We use Reviews.io for product reviews. After your order, you will receive an email requesting a review. Your email address and order details will be transmitted to Reviews.io.

Legal basis: The processing is based on our legitimate interest in quality assurance and customer satisfaction (Art. 6 para. 1 lit. f GDPR).

You can object to this use at any time by contacting us at Contact shop@tortuga-sense.com .

Back in Stock

If you sign up for product availability notifications, we will save your email address and the product you requested. You will receive an email as soon as the product is back in stock.

Legal basis: The processing is based on your consent (Art. 6 para. 1 lit. a GDPR).

You can unsubscribe at any time by clicking on the unsubscribe link in the notification email.

14. Social Media

We are present on the following social media platforms:

• XXX (to be determined)

When you visit our social media profiles, your data will be collected and processed by the respective platforms. We have no control over the data processing by these platforms. For more information, please refer to the privacy policies of the respective platforms.

15. Product Reviews

When you submit a product review, it will be publicly displayed on our website. We recommend that you do not include any personal information in your reviews. You can request the deletion of your review at any time by contacting us at Contact shop@tortuga-sense.com .

16. Data transfer to third countries

Some of our service providers (e.g. Shopify, Google Analytics, payment service providers) are based in the USA or other third countries outside the EU/EEA.

Data transmission is based on:

• EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR)
• Adequacy decisions of the EU Commission (Art. 45 GDPR)
• Your explicit consent (Art. 49 para. 1 lit. a GDPR)

We ensure that an adequate level of data protection is guaranteed when data is transferred to third countries.

17. Automated decision-making and profiling

We do not use automated decision-making or profiling as defined in Article 22 of the GDPR. Should we wish to use these procedures in the future, we will inform you separately and obtain your consent where legally required.

18. Changes to this Privacy Policy

We reserve the right to amend this privacy policy to reflect changes in the law or modifications to our services. The current version can always be found on this page. We will inform you of any significant changes via email.