Privacy Policy
Last updated: April 12, 2026 · Operated by XxprezzLust Einzelunternehmen, Aegerten, Switzerland
Who we are
This Privacy Policy describes how Amorexa (amorexa.com) — the online storefront and trading name of XxprezzLust Einzelunternehmen, a sole proprietorship registered in Switzerland — collects, uses, and protects the personal data of visitors and customers.
| Data Controller | XxprezzLust Einzelunternehmen (trading as Amorexa) |
| Address | Mattenstrasse 5a, 2558 Aegerten, Switzerland |
| [email protected] | |
| Phone | +41 79 296 21 08 |
| VAT / UID | CHE-140.468.019 MWST |
| Representative | Gurpreet Singh |
| Jurisdiction | Canton of Bern, Switzerland |
We are committed to protecting your privacy and handling your personal data with transparency, in full compliance with the Swiss revised Federal Act on Data Protection (revDSG/nDSG), which entered into force on 1 September 2023, and the EU General Data Protection Regulation (GDPR) where applicable to EU residents.
Data we collect & why
We collect only the personal data necessary for the purposes described below.
| Category | Data collected | Purpose |
|---|---|---|
| Account & order data | Name, email, billing & shipping address, order history, payment confirmation | Processing and fulfilling orders; customer account management |
| Payment data | Transaction reference, payment method type (not full card number — processed by PCI-DSS gateway) | Secure payment processing; fraud prevention |
| Contact data | Email address, phone number, message content | Customer support; responding to enquiries |
| Usage & analytics data | IP address (anonymised), browser type, pages visited, session duration, referring URL | Website analytics (Google Analytics 4); site performance improvement |
| Marketing data | Email address, click & open behaviour (with consent) | Newsletter; promotional communications |
| Technical / log data | Server logs, error logs, security events | Security; debugging; legal compliance |
| Cookie data | Cookie identifiers, preferences (with consent) | Session management; analytics; personalisation |
We do not intentionally collect sensitive personal data (Art. 9 GDPR / Art. 5 revDSG) such as health data, racial or ethnic origin, political opinions, or biometric data.
Legal bases for processing (GDPR Art. 6 / revDSG Art. 6)
Every processing activity is tied to a specific legal basis. The following bases apply:
- Contract — Art. 6(1)(b) GDPR / Art. 6(2)(b) revDSG: Processing necessary for the performance of a purchase contract (order fulfilment, shipping, returns, customer account).
- Legal obligation — Art. 6(1)(c) GDPR / Art. 6(2)(c) revDSG: Processing required by applicable law (VAT records, accounting obligations under Swiss OR, fraud reporting).
- — Art. 6(1)(a) GDPR / Art. 6(2)(a) revDSG: Newsletter subscriptions, non-essential cookies (analytics, marketing). Consent is freely given, specific, and withdrawable at any time.
- Legitimate interest — Art. 6(1)(f) GDPR / Art. 6(2)(d) revDSG: Fraud prevention, IT security, website improvement (analytics with IP anonymisation), and strictly necessary cookies. We have conducted a balancing test — these interests do not override your fundamental rights.
Google services & third-party tools
We use the following Google and third-party services on amorexa.com. Each is activated only in accordance with the legal basis noted:
You can manage consent for analytics and marketing cookies via our Cookie Consent Banner or the "Cookie Settings" link in the footer. Withdrawing consent does not affect any prior lawful processing.
Google's privacy policy: policies.google.com/privacy. To opt out of Google Analytics specifically: Google Analytics Opt-out.
Cookies & tracking technologies
We use cookies and similar technologies on amorexa.com. Under the EU ePrivacy Directive and Swiss revDSG, we are required to obtain your prior informed consent for all non-essential cookies.
| Type | Examples | Consent required? |
|---|---|---|
| Strictly necessary | Cart session, CSRF token, login cookie (wordpress_logged_in_*) | No — required for core functionality |
| Functional / preferences | Language preference, currency setting | Where permitted, based on legitimate interest or user choice |
| Analytics | _ga, _gid (Google Analytics 4) | Yes — consent required |
| Marketing | _fbp (Meta), _tt_webid (TikTok), Google Ads | Yes — consent required |
You can change your cookie preferences at any time via the Cookie Settings link in our footer. For full details, please refer to our separate Cookie Policy.
Who we share your data with
We do not sell, rent, or trade your personal data. We share data only where necessary for the purposes described in this policy:
- Shipping carriers (DHL, Swiss Post) — name, address, phone for delivery
- Payment processor (WooPayments, built on Stripe infrastructure) — transaction data for secure payment
- Email service provider — email address for transactional and marketing emails (with consent)
- Google LLC — analytics and advertising data (with consent, under SCC)
- Meta Platforms — advertising pixels (with consent, under SCC)
- Legal authorities — where required by Swiss or applicable EU law, court order, or regulatory obligation
- WordPress / WooCommerce (Automattic) — platform and comment data; privacy policy at automattic.com/privacy
All processors are contractually bound to process data only on our documented instructions and in compliance with applicable data protection law (Art. 28 GDPR / Art. 9 revDSG Data Processing Agreements).
International data transfers
Some of our service providers (e.g. Google, Meta, TikTok) are based in the United States, which is a third country without an adequacy decision equivalent to Switzerland for all transfer mechanisms. Where personal data is transferred outside Switzerland or the EEA, we ensure one of the following safeguards applies:
- Standard Contractual Clauses (SCCs) — approved by the European Commission and recognised by the FDPIC for transfers from Switzerland
- EU–US Data Privacy Framework — where the recipient is certified thereunder
- FDPIC adequacy decisions — for transfers to countries recognised as providing adequate protection under Swiss law
Retention periods
We retain personal data only as long as necessary for the stated purpose or as required by law.
| Data type | Retention period | Reason |
|---|---|---|
| Order & transaction records | 10 years | Swiss accounting law (OR Art. 958f) |
| Customer account data | Duration of account + 2 years after last activity | Contract; warranty claims |
| Support correspondence | 3 years | Warranty; dispute resolution |
| Analytics data (GA4) | 14 months (Google default, adjustable) | Aggregated analytics |
| Newsletter / marketing | Until consent withdrawn + 1 year | Consent-based |
| Server logs | 90 days | Security; debugging |
| Cookie consent records | 3 years | Legal compliance; proof of consent |
After the applicable retention period, data is securely deleted or anonymised.
Your rights
Under the Swiss revDSG and the EU GDPR, you have the following rights regarding your personal data. To exercise any right, please contact us at [email protected]. We will respond within 30 days (GDPR) or within a reasonable period under revDSG.
Right of access (Art. 15 GDPR)
You may request a copy of all personal data we hold about you, free of charge.
Right to rectification (Art. 16)
You may request correction of inaccurate or incomplete personal data.
Right to erasure (Art. 17)
You may request deletion of your personal data where there is no legitimate reason for continued processing.
Right to restriction (Art. 18)
You may request that we limit processing of your data under certain conditions.
Data portability (Art. 20)
You may request your data in a structured, machine-readable format to transfer to another provider.
Right to object (Art. 21)
You may object to processing based on legitimate interests, including direct marketing at any time.
Withdraw consent (Art. 7(3))
Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
Right to complain
You may lodge a complaint with the Swiss FDPIC (fdpic.ch) or, for EU residents, your national supervisory authority.
EU residents: You may contact your national data protection authority. List available at: edpb.europa.eu
Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These include:
- 256-bit SSL/TLS encryption for all data transmitted via amorexa.com
- PCI-DSS compliant payment processing (card data never stored on our servers)
- Access controls limiting data access to authorised personnel only
- Regular security monitoring and server log review
- WordPress security hardening (updated plugins, strong passwords, 2FA for admin access)
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Art. 33 GDPR, and affected individuals without undue delay where required.
Children's privacy (18+)
Amorexa is an adult-only store. Our products and services are exclusively intended for persons aged 18 years or older. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted personal data to us, please contact us immediately at [email protected] and we will delete the data without delay.
Changes to this policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or via a prominent notice on our website.
We encourage you to review this policy periodically. Where required, we will notify users of material changes through appropriate website notices or updated consent tools.
Contact & complaints
For any questions about this Privacy Policy, to exercise your rights, or to report a concern, please contact us:
Data Controller Contact
XxprezzLust Einzelunternehmen (trading as Amorexa)
Mattenstrasse 5a, 2558 Aegerten, Switzerland
VAT: CHE-140.468.019 MWST
[email protected] ·
+41 79 296 21 08
Monday – Friday, 09:00 – 18:00 CET
Swiss supervisory authority: www.fdpic.ch (FDPIC)