Privacy Policy

Privacy Policy of Smoketown.ch
As of October 1, 2026

This privacy policy informs you about the personal data we process in connection with our online shop smoketown.ch, our customer accounts, our customer communication and our marketing measures, the purposes for which we do so and your rights. The Swiss Data Protection Act (DPA) is applicable. Where the EU/EEA General Data Protection Regulation (GDPR) applies in an individual case – in particular to persons residing in the Principality of Liechtenstein –, you will find additional information in Section 15.

1. Data Controller and Contact

The controller responsible for data processing in connection with the online shop smoketown.ch is:

Smoketown Rorschach GmbH
Thurgauerstrasse 4
9400 Rorschach
Switzerland
UID: CHE-289.091.614
Email: info@smoketown.ch
Telephone: +41 71 841 09 68

Where another Smoketown company (Smoketown Wil GmbH or Smoketown Arbon GmbH) is your contractual partner, e.g. for purchases made in one of its stores, that company is responsible for the corresponding processing. You can always direct your data protection concerns to the address above. The self-service terminal in Rorschach is subject to its own privacy policy for the self-service terminal.

2. Personal Data We Process

Depending on how you use our offers, we process the following categories of personal data in particular:

• Basic and contact details: Name, delivery and billing address, email address, telephone number.
• Order and contract data: products ordered, prices, order number, delivery and payment status, returns and complaints, order notes.
• Payment data: selected payment method, payment status and transaction details. We do not receive full card details; these are processed directly by the payment service provider.
• Age verification data: information about your age and, where we require proof of age, the proof you submit (e.g. a copy of an official identity document).
• Customer account data: registration details (email address), saved addresses, order history, settings.
• Communication data: content of emails, contact form, chat and telephone inquiries.
• Marketing data: newsletter registration or unsubscription, consents, sign-ups for availability notifications.
• Technical and usage data: IP address, date and time of access, browser and device information, pages visited, shopping cart contents, cookie and consent settings.
• Application data: information you submit to us via the application form (e.g. CV).

We receive most of this data directly from you. We also receive additional data from payment service providers (e.g. payment status), shipping service providers (e.g. delivery status), or it is generated when you use our website.

3. Visiting Our Website and Hosting

Our online shop is operated on the Shopify e-commerce platform. When you visit our website, technically necessary data (e.g. IP address, date and time, page visited, browser and device information) is processed to deliver the website, ensure its security and stability, and detect misuse. Our website's fonts are loaded via Shopify's infrastructure; we do not embed Google Fonts.

4. Ordering, Customer Accounts and Contract Processing

When you place an order with us, we process your basic, contact, order and payment data to conclude and fulfill the contract, send you order and shipping confirmations, process returns, complaints and rights of warranty, and fulfill our accounting and legal obligations. Mandatory information is marked during the ordering process; without it, we cannot fulfill your order.

You can use a customer account. You register with your email address and a confirmation code that we send you by email. In your customer account, you can view your orders and manage your addresses and newsletter settings. You can request the deletion of your customer account at any time; statutory retention obligations are reserved.

5. Payment

For payment processing, we pass the required data to your selected payment service provider. These providers process the data partly under their own responsibility and in accordance with their own privacy policies.

• Online payments (e.g. credit and debit cards, TWINT, PostFinance Pay and other payment methods displayed at checkout) are processed via Worldline (Worldline Group, including Worldline Schweiz AG, Zurich, and Worldline SA/NV, Brussels). You enter your payment data directly with Worldline or the respective payment method provider.
• Purchase on account: payment by invoice is facilitated via PostFinance Checkout (PostFinance AG, Bern; technical operation by Wallee Group AG, Winterthur) to Powerpay, a service of MF Group AG, St. Gallen. To check whether purchase on account is possible, MF Group AG conducts an identity and credit check and may obtain information from credit reporting agencies. MF Group AG decides whether purchase on account is offered, possibly automatically (see Section 14). The privacy policy of MF Group AG also applies.
• Advance payment: when paying by bank transfer, we receive the information necessary for allocating the payment from our bank (e.g. name, amount, payment reference).

6. Shipping

For delivery, we pass your name, delivery address and, where necessary for delivery, contact details to Swiss Post (Post CH AG, Bern). We deliver exclusively to Switzerland and Liechtenstein.

7. Age Verification

In accordance with the Tobacco Products Act, we may only supply tobacco products, e-cigarettes and related products to adults; we also sell corresponding accessories exclusively to persons aged 18 or over as part of our own company policy. We therefore ask you to confirm that you are an adult when you visit our website; your confirmation is stored in a cookie in your browser so that the prompt does not appear again on every visit.

We may also request proof of age at any time. We send you this request as a transactional email via the email service Brevo (Brevo GmbH, Berlin). We use the submitted proof of age exclusively for age verification and to demonstrate compliance with supply regulations. We retain it only for as long as necessary for these purposes.

8. Fraud Prevention and Security

To protect against fraud, misuse and payment defaults, and to ensure the security of our systems, we process order, payment and technical data. Shopify and the payment service providers may also perform automated checks (e.g. risk analyses of orders and payments). If we suspect misuse, we may review, refuse to fulfill, or cancel an order.

9. Communication with You

If you contact us by email, telephone, contact form, chat or by another means, we process your details to answer your inquiry. For email communication, we also use Microsoft's Outlook.com service. The chat on our website is provided via Shopify Inbox (Shopify). If you contact us via WhatsApp, WhatsApp's privacy policy also applies; please do not send us any sensitive data through it.

10. Newsletters, Direct Marketing and Notifications

Newsletters: we generally only send you promotional emails if you have registered or consented, e.g. via the registration form on our website, in your customer account, or via the unselected checkbox at checkout. Depending on the region, additional confirmation of your registration by email may be required (double opt-in). For registration forms and sending, we use Shopify features (Shopify Forms and Shopify Messaging). This may allow us to determine whether an email was delivered and opened and whether links were clicked.

Direct marketing to customers: where permitted under Art. 3 para. 1 lit. o UWG, we may send information about our own similar products to customers whose email address we received in connection with a purchase, even without their consent, provided we informed them when collecting the address that they could decline such emails.

Unsubscription: you can decline or unsubscribe from promotional emails free of charge at any time – via the unsubscribe link in any promotional email, in your customer account, or by sending a message to info@smoketown.ch.

Availability notifications: for sold-out products, you can be informed via the "Notify me when available" function. For this purpose, we use the "Kbite: Back In Stock, Notify Me" app by DEVSQUAT SOLUTIONS, New Delhi, India. Your provided contact details (e.g. email address or telephone number) and the desired product are processed. The script of this app can determine your country using a Cloudflare service based on your IP address. You can unsubscribe from the notification at any time.

Reminders about incomplete orders: if you have started checkout but not completed it, we may send you a reminder by email. You can object to such reminders at any time.

11. Reviews and Trusted Shops

The Trusted Shops SE trust badge (Subbelrather Str. 15c, 50823 Cologne, Germany) is embedded on our website. It displays our Trusted Shops reviews and may offer Trusted Shops services (e.g. buyer protection). When you visit, technical data (e.g. IP address, date and time, browser details) is transmitted to Trusted Shops. After an order, order data (e.g. order number, order total, purchased products and your email address, which may be pseudonymised) may be transmitted to Trusted Shops to offer you buyer protection and, if applicable, invite you to leave a review. We and Trusted Shops are jointly responsible for the embedding of the trust badge. Further information can be found in the Trusted Shops privacy policy.

12. Customer Feedback and Applications

Customer feedback: via our feedback function (e.g. /pages/feedback), you can provide us with anonymous feedback. We store the responses without a name, email address, telephone number or order number and without linking them back to you. The technical provision is handled by Cloudflare (Cloudflare, Inc., USA) and Shopify.

Applications: if you apply via the application form on our website, your details are received via a Cloudflare service (Cloudflare, Inc., USA) and forwarded to us by email via Brevo (Brevo GmbH, Berlin); the application is not stored in the form service itself. We use application data exclusively for the application process, not for marketing and not together with customer data.

13. Cookies, Consent Management and Analysis

Our website uses cookies and similar technologies (e.g. local storage in the browser). We use technically necessary cookies so that the shop functions, e.g. for the shopping cart, checkout, login, security, age verification and saving your cookie settings. We only use additional cookies and technologies if you choose to do so in the cookie banner. The categories are:

• Necessary: required for the operation of the website; always active.
• Statistics: for analysing the use of our shop, in particular with the analysis function integrated into Shopify (Shopify Analytics).
• Marketing: for marketing and retargeting functions of Shopify and the installed apps.
• Preferences: for saving settings that make it easier for you to use the website.

For the cookie banner and the storage of your consent, we use Consentmo (iSense Ltd, Sofia, Bulgaria; hosting in the EU). Your selection, date and time, browser and device details, as well as a truncated IP address are logged. You can change your settings at any time via the cookie banner or the corresponding link on our website and revoke consent with future effect.

We currently do not use any third-party analysis or advertising tracking services such as Google Analytics, Google Ads, the Meta Pixel or the TikTok Pixel on our website.

The "Shopify Network Intelligence" function is enabled in Shopify's privacy settings. Shopify may use data from the use of our shop under its own responsibility, e.g. for fraud detection and to improve its services. Further information can be found in the Shopify privacy policy.

14. Automated Individual Decisions

We do not make any automated individual decisions that have legal effects on you or significantly affect you. MF Group AG (Powerpay) checks whether purchase on account is offered; it may use automated processes for this purpose. In this case, you can contact MF Group AG, state your position and request a review by a person.

15. Additional Information for Persons in the EEA (in Particular Liechtenstein)

Where the GDPR applies to our processing, in particular because we offer goods to persons in the Principality of Liechtenstein, we base the processing on the following legal bases:

• performance of a contract and pre-contractual measures (Art. 6 para. 1 lit. b GDPR), e.g. order, customer account, payment, shipping, return and complaint;
• legal obligation (Art. 6 para. 1 lit. c GDPR), e.g. age verification and retention obligations;
• legitimate interests (Art. 6 para. 1 lit. f GDPR), e.g. secure operation of the website, fraud prevention, customer communication, direct marketing within the legally permitted scope;
• consent (Art. 6 para. 1 lit. a GDPR), e.g. newsletter, availability notifications, statistics, marketing and preference cookies. You can revoke consent at any time with future effect.

Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), as well as the right to object at any time to processing based on reasons arising from your particular situation and to direct marketing (Art. 21). You can also lodge a complaint with a supervisory authority (Art. 77), in Liechtenstein with the Liechtenstein Data Protection Authority (see Section 19).

16. Recipients and Data Processors

We only pass on personal data where this is necessary for the stated purposes, provided for by law, or where you have consented. Recipients include in particular:

• Shopify (contractual partner: Shopify International Limited, Dublin, Ireland, with group companies, in particular Shopify Inc., Canada) as the operator of the shop platform incl. checkout, customer account, analysis, forms, email sending, chat and automations;
• payment service providers: Worldline, PostFinance AG and Wallee Group AG, as well as MF Group AG (Powerpay), see Section 5;
• shipping service provider: Post CH AG;
• Brevo GmbH (sending transactional emails and forwarding applications);
• Cloudflare, Inc. (provision of form and feedback functions);
• Microsoft (Outlook.com email service);
• iSense Ltd / Consentmo (cookie banner and consent management);
• DEVSQUAT SOLUTIONS (availability notifications, "Kbite" app);
• Trusted Shops SE (trust badge, buyer protection and reviews);
• other IT and software service providers that assist us in operating and managing the online shop (e.g. apps for invoice printing, translation, search, inventory and assortment planning, as well as AI-powered assistance tools);
• within the Smoketown Group, Smoketown Wil GmbH and Smoketown Arbon GmbH, where this is necessary for order fulfillment, customer service or store services;
• authorities, courts, legal representatives and debt collection service providers, where we are obliged or entitled to do so, or where this is necessary to enforce or defend claims.

Data processors process personal data on our behalf and according to our instructions. Payment service providers, Swiss Post and Trusted Shops also process data partly under their own responsibility.

17. Disclosure to Third Countries

Some of the recipients mentioned process personal data outside Switzerland, in particular in EU/EEA states (e.g. Ireland, Germany, Belgium, Bulgaria, Netherlands, Liechtenstein), Canada, the USA and India.

• The EU and EEA states, as well as Canada (for the private sector), ensure adequate data protection in accordance with Annex 1 of the Data Protection Ordinance (DPO).
• In the USA, adequate data protection applies only to organisations certified under the Swiss-U.S. Data Privacy Framework. Cloudflare, Inc. and Microsoft Corporation state that they are certified accordingly. Shopify supports transfers to the USA and other countries without adequate data protection based on standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) or binding corporate rules.
• At Trusted Shops, processing may take place in the USA and Israel; Israel guarantees an adequate level of data protection under Annex 1 of the Swiss Data Protection Act, while Trusted Shops relies on the certification of its service providers under the Data Privacy Framework or on standard contractual clauses for the USA.
• In the “Kbite” app, your contact details may be processed in India for availability notifications. India does not guarantee an adequate level of data protection; disclosure is permitted because it is necessary to provide the notification you requested (Art. 17 para. 1 lit. b Swiss Data Protection Act).

You can request further information about these guarantees from us.

18. Retention and deletion

We only retain personal data for as long as is necessary for the respective purpose, as long as statutory retention obligations exist, or if we have a legitimate interest (e.g. to assert or defend claims during limitation periods). In particular, the following criteria apply:

• We retain order, invoice, and accounting data in accordance with statutory retention obligations (10 years for business records and accounting documents, Art. 958f Swiss Code of Obligations).
• We process customer account data for as long as the customer account exists; thereafter, only as long as retention obligations or outstanding claims exist.
• We process data for newsletters and notifications until you unsubscribe; we retain proof of consent or unsubscription for as long as it is required for verification purposes.
• We only retain proof of age for as long as is necessary to verify age and demonstrate compliance with age restrictions.
• We retain inquiries and correspondence for as long as is necessary to process them and respond to any follow-up questions or in connection with a contract.
• We retain application data until the completion of the application process, unless you have consented to a longer retention period or an employment relationship is established.
• Technical data and cookies are deleted according to the timeframes specified in the settings or by the providers.

19. Your rights

Under applicable data protection law, you have the following rights in particular:

• to request information about whether and which personal data we process about you (Art. 25 Swiss Data Protection Act);
• to request the correction of inaccurate personal data;
• to request the deletion of your personal data or object to its processing, unless statutory obligations or overriding interests prevent this;
• to request the provision or transfer of certain personal data in a commonly used electronic format (Art. 28 Swiss Data Protection Act);
• to revoke a granted consent at any time with future effect.

You can send your inquiries by email to info@smoketown.ch or by post to the address specified in Section 1. You can also submit inquiries about your customer data via our Data Requests page. To prevent misuse, we may need to verify your identity. Individuals in the EEA also have the rights specified in Section 15.

You also have the right to lodge a complaint with the competent supervisory authority:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch
• Liechtenstein: Liechtenstein Data Protection Authority, Kirchstrasse 8, P.O. Box 684, 9490 Vaduz, www.datenschutzstelle.li

20. Data security

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, and misuse. Data transmission on our website is encrypted (HTTPS). Only persons who require access to customer data to perform their duties are granted access.

21. External links and social networks

Our website contains links to external offers, such as YouTube videos, Google Maps (route planning to our branches), WhatsApp, and our social media profiles. The content provided by these third parties is not embedded in our website; data is only transmitted when you click on such a link. The privacy policies of the respective providers apply to the linked offers.

22. Changes to this Privacy Notice

We may update this Privacy Notice at any time, in particular if we change our data processing practices or if new legal requirements come into effect. The version published on our website at the time will apply.