Privacy Policy

Status: May 2026

1. Data Protection at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data with which you can be personally identified.

2. Responsible Party

The party responsible for data processing on this website is:

Tortuga Vitalis AG
Grienbachstrasse 17
6300 Zug
Switzerland

Email: shop@tortuga-sense.com

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

3. Data Collection on Our Website

What data do we collect?

We collect the following data:

• Contact data (name, email address, phone number)
• Order data (delivery address, billing address, order history)
• Customer account data (username, encrypted password, order history)
• Payment information (processed encrypted via our payment service providers)
• Technical data (IP address, browser type, operating system, access times)
• Usage behavior (clicks, scrolling behavior, pages visited)
• Contact form data (name, email, phone, message)

What do we use your data for?

We use your data for the following purposes:

• Processing your orders and deliveries
• Managing your customer account
• Communicating regarding your orders
• Answering contact inquiries
• Improving our website and services
• Sending marketing emails (only with your consent)
• Notifications about product availability (only with your consent)
• Fulfilling legal retention obligations
• Analyzing user behavior for website optimization

How do we collect your data?

Your data is collected either by you providing it to us (e.g., when placing an order, creating a customer account, or via the contact form). Other data is automatically collected by our IT systems when you visit the website (e.g., technical data).

4. Customer Account

You have the option to create a customer account on our website. If you create a customer account, we store the following data:

• Name and email address
• Password (stored encrypted)
• Delivery address(es) and billing address(es)
• Order history
• Stored payment methods (references only, no complete card data)

Legal basis: Processing is based on Art. 6 para. 1 lit. b GDPR for the fulfillment of the contract and the provision of the customer account.

Storage period: Your customer account data will be stored until you delete your account. You can delete your account at any time in the account settings or contact us by email at shop@tortuga-sense.com.

Security: Your password is stored encrypted. We do not have access to your plain-text password. Please use a strong password and do not share your access data with third parties.

5. Legal Basis for Processing

We process your personal data in accordance with the Swiss Data Protection Act (DSG) and the General Data Protection Regulation (GDPR), where applicable.

Processing is based on the following legal grounds:

• Fulfillment of contract (Art. 6 para. 1 lit. b GDPR): For processing your orders and managing your customer account
• Consent (Art. 6 para. 1 lit. a GDPR): For marketing emails, cookies, and analysis tools
• Legitimate interest (Art. 6 para. 1 lit. f GDPR): For improving our website
• Legal obligation (Art. 6 para. 1 lit. c GDPR): Retention obligations

6. Data Transfer

We only share your data with third parties if:

• You have given your express consent
• It is necessary for the fulfillment of the contract (e.g., shipping service providers)
• There is a legal obligation

Our service providers and tools:

• Shopify Inc. (e-commerce platform, hosting, customer account management) - Canada/USA
• Swiss Post (shipping) - Switzerland
• Payment service providers (payment processing) - Switzerland/Europe/USA
• Google Analytics (website analysis) - USA
• Shopify Email (email marketing) - Canada/USA
• Reviews.io (product reviews) - UK
• Hotjar (user behavior analysis) - Malta/EU
• Back in Stock (product availability notifications) - USA
• Order Printer Pro (invoice creation) - USA

7. Storage Period

We only store your personal data for as long as necessary to fulfill the purposes or as required by legal retention periods.

• Order data: 10 years (legal retention obligation)
• Customer account data: Until you delete the account
• Contact form inquiries: 2 years after being answered
• Marketing consents: Until revoked
• Back-in-stock notifications: Until revoked or product availability
• Product reviews: Unlimited (until deleted upon request)
• Technical data: 90 days
• Google Analytics data: 14 months

8. Contact Form

If you send us inquiries via the contact form, your information from the inquiry form, including the contact details you provided, will be stored by us for the purpose of processing the inquiry and for follow-up questions.

The processing of this data is based on Art. 6 para. 1 lit. b GDPR, if your inquiry is related to the fulfillment of a contract or is necessary for carrying out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of inquiries directed to us (Art. 6 para. 1 lit. f GDPR).

The data you enter in the contact form will remain with us until you request its deletion, revoke your consent for storage, or the purpose for data storage no longer applies (e.g., after your inquiry has been processed). Mandatory legal provisions – especially retention periods – remain unaffected.

9. Cookies

Our website uses cookies. Cookies are small text files that are stored on your device. Some cookies are technically necessary, while others serve to analyze and improve our website.

Technically necessary cookies: These cookies are required for the website to function (e.g., shopping cart, login, customer account).

Analysis cookies: These cookies help us understand and improve the use of our website (e.g., Google Analytics, Hotjar).

Marketing cookies: These cookies are used to show you relevant advertising.

You can adjust your browser settings so that you are informed about the setting of cookies and only allow cookies in individual cases. Disabling cookies may limit the functionality of our website.

Further information can be found in our Cookie Policy.

10. Your Rights

You have the following rights regarding your personal data:

• Right of access: You can request information about your stored data (Art. 15 GDPR)
• Right to rectification: You can request the correction of incorrect data (Art. 16 GDPR)
• Right to erasure: You can request the deletion of your data (Art. 17 GDPR)
• Right to restriction of processing: You can request the restriction of processing (Art. 18 GDPR)
• Right to data portability: You can receive your data in a structured format (Art. 20 GDPR)
• Right to object: You can object to the processing of your data (Art. 21 GDPR)
• Right to withdraw consent: You can withdraw granted consents at any time (Art. 7 para. 3 GDPR)
• Right to complain: You have the right to lodge a complaint with a data protection supervisory authority

To exercise your rights, please contact us at: shop@tortuga-sense.com

Competent supervisory authority:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern
Switzerland
Website: www.edoeb.admin.ch

11. Data Security

We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons.

Our website uses SSL encryption (HTTPS) for the secure transmission of confidential content. All payment data is transmitted encrypted and processed by certified payment service providers.

Passwords for customer accounts are stored encrypted and are not visible to us in plain text.

Our security measures are continuously improved in line with technological developments.

12. Newsletter & Marketing

If you subscribe to our newsletter, we will use your email address exclusively for sending information about our products and offers. You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in each newsletter email.

Processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Shopify Email: We use Shopify Email for sending our marketing emails. Shopify Email is a service provided by Shopify Inc. (Canada/USA). Your email address and name will be transmitted to Shopify. Processing is based on your consent (Art. 6 para. 1 lit. a GDPR).

13. Analysis Tools & Third-Party Services

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies to analyze website usage. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.

IP anonymization: We have activated IP anonymization on this website. This means that your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA.

Purpose: Google will use this information on our behalf to evaluate your use of the website, to compile reports on website activity, and to provide us with other services related to website and internet usage.

Legal basis: Processing is based on your consent (Art. 6 para. 1 lit. a GDPR).

Opt-out: You can prevent the storage of cookies by setting your browser software accordingly. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout

Storage period: The data sent by us and linked to cookies will be automatically deleted after 14 months.

Shopify Analytics

We use Shopify Analytics to analyze the use of our website. Shopify collects data such as IP address, browser type, and pages visited. Processing is based on our legitimate interest in analyzing and optimizing our website (Art. 6 para. 1 lit. f GDPR).

Hotjar

We use Hotjar to analyze user behavior (heatmaps, session recordings). Hotjar collects mouse movements, clicks, and scrolling behavior. The data is stored anonymously.

Legal basis: Processing is based on your consent (Art. 6 para. 1 lit. a GDPR).

Opt-out: You can disable Hotjar tracking at https://www.hotjar.com/policies/do-not-track/.

Storage period: Hotjar recordings are automatically deleted after 365 days.

Reviews.io

We use Reviews.io for product reviews. After your order, you will receive an email asking for a review. Your email address and order details will be transmitted to Reviews.io.

Legal basis: Processing is based on our legitimate interest in quality assurance and customer satisfaction (Art. 6 para. 1 lit. f GDPR).

You can object to the use at any time by contacting us at shop@tortuga-sense.com.

Back in Stock

If you sign up for product availability notifications, we will store your email address and the desired product. You will receive an email as soon as the product is back in stock.

Legal basis: Processing is based on your consent (Art. 6 para. 1 lit. a GDPR).

You can unsubscribe at any time by clicking the unsubscribe link in the notification email.

14. Social Media

We are present on the following social media platforms:

• Instagram
• LinkedIn

When you visit our social media profiles, your data is collected and processed by the respective platforms. We have no influence on the data processing by these platforms. For more information, please refer to the privacy policies of the respective platforms.

15. Product Reviews

If you submit a product review, it will be publicly displayed on our website. We recommend not publishing personal data in reviews. You can request the deletion of your review at any time by contacting us at shop@tortuga-sense.com.

16. Data Transfer to Third Countries

Some of our service providers (e.g., Shopify, Google Analytics, payment service providers) are based in the USA or other third countries outside the EU/EEA.

Data transfer is based on:

• EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR)
• Adequacy decisions of the EU Commission (Art. 45 GDPR)
• Your explicit consent (Art. 49 para. 1 lit. a GDPR)

We ensure that an adequate level of data protection is guaranteed when transferring data to third countries.

17. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Should we wish to use these procedures in the future, we will inform you separately and obtain your consent, if legally required.

18. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy to changed legal situations or changes in our services. The current version will always be found on this page. In the event of significant changes, we will inform you by email.