Privacy Policy
November 2026
Here you can find which data we process, the purposes for which we do so, to whom it is passed on, and what rights you have.
1Controller
The controller responsible for processing your data is Tortuga Vitalis AG, Grienbachstrasse 17, 6300 Zug, Switzerland. If you have questions about data protection, write to us at shop@tortuga-sense.com.
We process your data in accordance with the Swiss Federal Act on Data Protection. If we offer goods to you as a person in the European Union or analyse your usage behaviour with your consent, the EU General Data Protection Regulation (GDPR) also applies.
2Which data we process
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, email address, phone number (optional) | from you |
| Order data | Delivery and billing address, products ordered, order history | from you |
| Account data | Email address, saved addresses, subscriptions | from you |
| Payment data | Payment method and reference, for subscriptions an identifier of the payment method for recurring charges, no complete card details | Payment providers |
| Technical data | IP address, browser, operating system, time of access | automatically |
| Usage data | pages visited, clicks, time spent | automatically |
| Chat data | Questions and answers in the chat with Sense.ai | from you |
| Reviews | Text, stars, displayed name | from you |
| Messages | Enquiries via the contact form or by email | from you |
3Why we process them and on what basis
The table shows why we process your data and the legal basis we rely on under the GDPR.
| Purpose | Basis |
|---|---|
| Processing orders, delivery, payment, handling returns | Contract (Art. 6(1)(b) GDPR) |
| Managing the customer account and subscription | Contract (Art. 6(1)(b) GDPR) |
| Answering enquiries | Contract (lit. b) or our legitimate interest in replying to you (lit. f) |
| Answering product questions via Sense.ai | our legitimate interest in answering product questions quickly (lit. f) |
| Asking for a review after an order | our legitimate interest in feedback (lit. f); you can object at any time |
| Operating the shop securely, preventing misuse | our legitimate interest in a secure, functioning shop (lit. f) |
| Complying with statutory retention obligations | legal obligation (lit. c) |
| Enforcing or defending claims | our legitimate interest (lit. f) |
| Newsletter and availability notifications | your consent (lit. a) |
| Analysing usage behaviour (statistics, advertising on social media and Google and measuring its success, opens and clicks in emails) | your consent (lit. a) |
Where we rely on a legitimate interest, you can object (section 14).
For an order we need your name, your delivery and billing address, your email address and your payment details. Without this information we cannot conclude the contract. All other information is voluntary.
4Customer account
You can create a customer account, but you don't have to; ordering as a guest is also possible. Login works without a password: you enter your email address and receive a one-time code. We therefore do not store a password for you.
Your account stores your email address, your addresses, your orders and your subscriptions. You can have your account deleted at any time. Just send us a message.
We must keep invoices and accounting records for ten years even after an account has been deleted. This is required by the Swiss Code of Obligations. We no longer use these data for any other purpose.
5Who receives data
We only pass on your data where this is necessary for processing, you have consented or we are legally obliged to do so. Our service providers process data only on our behalf and according to our instructions.
We only use Hotjar, Google Analytics, Google Ads, Meta and the marketing features of Shopify and Klaviyo if you have consented in the cookie banner.
| Service | Purpose | Data | Location |
|---|---|---|---|
| Shopify | Shop, checkout, customer account | Order and account data | Ireland (EU), Canada |
| Purpur Ventures AG (Purpur Labs) | AI assistant Sense.ai | Chat content, technical data | Zug, Schweiz |
| Swiss Post | Shipping | Name, delivery address | Switzerland |
| Payment providers (Shopify Payments, PayPal, TWINT) | Payment processing | Payment data | Switzerland, EU, USA |
| Brightpearl | Inventory management, warehouse | Order and delivery data | United Kingdom |
| Order Printer Pro | Invoices and delivery notes | Invoice data | Denmark (EU) |
| Loop Returns | Returns | Order and contact data | USA |
| Klaviyo | Newsletter, availability notifications and transactional emails | Email address, name, purchasing behaviour, opens and clicks (only with consent) | USA |
| reviews.io | Product reviews | Email address, order data | United Kingdom |
| Hotjar | Usage analysis | Usage behaviour, shortened IP address | Malta |
| Google Analytics | Audience measurement | Usage behaviour, shortened IP address | Ireland, USA |
| Google Ads | Advertising and performance measurement | Usage behaviour, device and browser data | Ireland, USA |
| Meta | Advertising and performance measurement | Usage behaviour, device and browser data | Ireland, USA |
| Hextom | Translation and currency display | Language setting, technical data | Canada |
PayPal, TWINT and Shopify (for Shop Pay) partly decide themselves how they process your data. Their own privacy policies apply to this.
6Transfer abroad
Some of our service providers are based outside Switzerland and the EU, namely in the USA, Canada and the United Kingdom.
According to the Federal Council and the EU Commission, Canada and the United Kingdom are countries with adequate data protection; within the EU, the GDPR applies directly. For recipients in the USA, we rely on the Data Privacy Framework if the recipient is certified under it, otherwise on the standard contractual clauses of the EU Commission, which are also recognised by the Federal Data Protection and Information Commissioner. You can obtain a copy of these safeguards on request at shop@tortuga-sense.com.
7How long we keep data
| Data | Duration |
|---|---|
| Invoices and accounting records | 10 years, legal obligation |
| Customer account | until you have it deleted |
| Enquiries via the contact form | 2 years after completion |
| Newsletter consent | until withdrawn |
| Product reviews | until deleted at your request |
| Analytics data | 14 months (cookies may remain on your device longer, see cookie policy) |
| Availability notification | until the notification is sent or until withdrawn |
8Cookies
We use cookies. Necessary cookies keep the shop working. We only set all other cookies with your consent.
Which cookies these are and how to change your selection is described in the cookie policy. You can change your selection at any time via «Cookie settings» in the footer.
9Newsletter and advertising
We only send you the newsletter if you have subscribed and confirmed your subscription via the link in our confirmation email. We use your address for information about our products and offers.
With your consent, we analyse whether you open our emails and which links you click, and take your previous purchases into account. This allows us to send you content that suits you.
You can unsubscribe at any time, via the link in every email or by sending us a message. After unsubscribing, you will continue to receive emails about your orders.
10Product reviews
After an order, we ask you by email for a review. We point this out to you when you order. If you do not want such a request, you can object at any time, via the link in every request or by sending us a message. If you submit a review, it appears publicly in the shop with deinem Vornamen und dem ersten Buchstaben deines Nachnamens. Do not publish any personal information there.
Only customers who bought the product from us can leave a review. The request is only sent for actual orders.
You can have your review deleted at any time.
11Social media
We are present on Instagram and LinkedIn. We are jointly responsible with Meta and LinkedIn respectively for the statistics on our profiles. The platforms have published agreements on this in which they assume primary responsibility: Agreement by Meta and Agreement by LinkedIn. You can assert your rights with us or directly with the platform. Otherwise, the platforms process your data according to their own rules.
12Sense.ai, our AI assistant
On the product pages, Sense.ai answers your questions about our products. Sense.ai is an AI system; you are not chatting with a human. The service is operated by Purpur Ventures AG (Purpur Labs), Zug, Schweiz, on our behalf.
We process your questions and the answers in order to reply to you, suggest suitable products and improve the assistant. Use is voluntary.
Sense.ai does not give medical advice. Please do not enter any information about illnesses, medication, pregnancy or allergies in the chat. For such questions, contact your doctor or pharmacy.
13Data security
The connection to our shop is encrypted. Payment data are transmitted in encrypted form and processed by certified payment providers. We do not see complete card details.
We take appropriate technical and organisational measures to protect your data and adapt them on an ongoing basis.
14Your rights
You have the right to access your data, to have incorrect information corrected, to erasure, to restriction of processing and to receive your data in a common format.
Right to object: where we rely on a legitimate interest, you can object at any time on grounds relating to your particular situation. You can object to the use of your data for advertising at any time without giving reasons; we will then no longer use it for this purpose.
You can withdraw any consent you have given at any time. Processing carried out before withdrawal remains unaffected.
To do so, write to us at shop@tortuga-sense.com. We will reply within 30 days. To ensure we do not disclose data to the wrong person, we may ask you to prove your identity.
You can also lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern; in the EU with the data protection authority of your country of residence, for example the data protection authority in Vienna or the data protection authority of your German federal state.
15No automated individual decisions
We do not make decisions about you based solely on automated processing. Should this change, we will inform you in advance.
16Changes to this policy
We adapt this policy when our services or the legal situation change. The version currently in force is published on this page.
Privacy Questions
Write to us via the contact form or at shop@tortuga-sense.com. We will get back to you within 24 hours.