Privacy policy

Privacy Policy

Last updated: October 2026

1. Controller

The controller responsible for the processing of your personal data in connection with the online shop ayguey.shop ("Ay Güey Europe") is

MYMELANDO AG, Burgstad 2, 6402 Merlischachen, Switzerland (hereinafter "we")
Email: info@ayguey.shop
Telephone: +41 (0)43 548 74 70

Representative in the EU (Art. 27 GDPR): Monica Schuricht, Schramberger Strasse 24, 13467 Berlin, Germany, email: mymelando@datenschutzkonform.ch

2. Scope

This Privacy Policy applies to the processing of personal data in connection with our online shop, our websites, customer accounts, orders and the services we offer.

3. Applicable data protection law

We process personal data in accordance with the applicable data protection provisions, in particular the Swiss Federal Act on Data Protection (FADP) and, where applicable, the General Data Protection Regulation of the European Union (GDPR).

4. Principles of data processing

We process personal data in accordance with the principles of lawfulness, transparency, proportionality and purpose limitation, and we limit processing to what is necessary for the respective purposes.

5. What data we process

Depending on how you use our online shop, we, our processors or third parties process in particular contact, identification, order, delivery, payment, communication, device, usage and technical data. Specifically, the following data is processed:

When you place an order: name, delivery and billing address, email address, telephone number (optional), items ordered, payment method and payment status. Only the payment service provider sees your full card details.

Customer account: the data listed above as well as your order history and saved addresses.

Newsletter: email address, time of sign-up and confirmation.

Contact form: name, email and your message.

Product reviews: name, email address, item purchased and order date, your review (stars and text) and any photos or videos you choose to upload.

When you visit the website: technical data such as IP address, device type, browser, pages visited, date and time, referrer source (log data), and – only with your consent – cookies for analytics and marketing.

6. Why and on what basis we process your data

Processing of your order, shipping, payment, customer account, returns and warranty: performance of a contract, Art. 6(1)(b) GDPR

Responding to enquiries: steps prior to entering into a contract or legitimate interest, Art. 6(1)(f) GDPR

Accounting and retention of business records: legal obligation, Art. 6(1)(c) GDPR

Sending the newsletter: consent, Art. 6(1)(a) GDPR

Asking for a review by email: consent (newsletter subscription), Art. 6(1)(a) GDPR

Publishing your product review: consent given by submitting the review, Art. 6(1)(a) GDPR

Operation, security and fraud prevention of the website: legitimate interest, Art. 6(1)(f) GDPR

Analytics and marketing cookies: consent, Art. 6(1)(a) GDPR

Withdrawal function: If you declare your withdrawal via the withdrawal function on our website, we process the details entered there (name, details identifying the order such as the order number, e-mail address, and the date and time of receipt) in order to process the withdrawal, reverse the contract, send you the legally required acknowledgement of receipt on a durable medium and prove timely receipt. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and compliance with our legal obligations (Art. 6(1)(c) GDPR). The withdrawal function is provided via the Shopify app “EU Widerrufsbutton” of Visionz GmbH, Hildesheim (Germany); Visionz processes the data on our behalf as a processor. The data is stored for the duration of the statutory retention periods.

7. Third-party providers, processors and transfers of data abroad

We transfer personal data in particular to IT, hosting, payment, shipping, logistics, marketing, analytics, customer service and other service providers, insofar as this is necessary for the stated purposes and legally permissible. Where these service providers act on our behalf and where required by law, we conclude appropriate data protection agreements with them.

Certain service providers (Shopify, payment providers, Loox and, with your consent, Google and Meta, see Section 9) process data outside Switzerland and the EU, in particular in Canada, Israel and the USA. When transferring personal data to these countries, we rely on adequacy decisions (Canada, Israel, Data Privacy Framework USA) or ensure other appropriate safeguards (data processing agreement, EU Standard Contractual Clauses) or base the transfer on a statutory exception.

We use the following service providers, which process personal data on our behalf (processors) or as third parties or controllers (e.g. the payment providers):

7.1 Shopify as platform

Our shop runs on the e-commerce platform of Shopify International Ltd., Dublin (Ireland), together with Shopify Inc., Ottawa (Canada) and Shopify (USA) Inc. Shopify stores and processes your data on our behalf (hosting, checkout, customer accounts, payment processing, email delivery, fraud prevention) and may process it on servers in Canada, the USA and the EU. More information is available at shopify.com/legal/privacy.

This processing is based on a data processing agreement and the EU Standard Contractual Clauses or the adequacy decisions for Canada and the USA (Data Privacy Framework).

7.2 Payment providers

Payments are processed via Shopify Payments (Shopify Payments Europe Ltd., operated with Stripe) and, depending on the payment method selected, via Klarna Bank AB (Sweden), TWINT AG (Switzerland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), Apple Pay, Google Pay and Shop Pay.

The respective provider receives the data necessary for the payment (amount, name, address, email, payment method) and is, as a third party, itself the controller under data protection law for the respective data processing. More information on the data processing can be found in the privacy policies of the respective providers: Shopify Payments/Stripe (stripe.com/privacy), Klarna (klarna.com/de/datenschutz), TWINT (twint.ch/datenschutzerklaerung), PayPal (paypal.com/de/legalhub/privacy-full), Apple Pay (apple.com/legal/privacy), Google Pay (policies.google.com/privacy).

7.3 Shipping and logistics

To deliver your order, we pass on your name, address and, for delivery notifications, your email address or telephone number to Swiss Post or the parcel service engaged. Swiss Post processes your data as a controller and not as a processor. Further information is available in Swiss Post's privacy policy (post.ch/en/pages/footer/data-protection-and-legal).

EU orders are packed and shipped on our behalf by our logistics partner fultastic (Germany). fultastic is our processor and receives the order and address data required to process the order; a data processing agreement has been concluded. Further information is available in fultastic's privacy policy (fultastic.com/de-ch/datenschutz).

7.4 Newsletter

The newsletter is sent via Shopify Email. You sign up via the form on our website or at checkout. Where required by law, in particular for recipients in the EU, sign-up takes place using a double opt-in procedure: you receive a confirmation email, and your sign-up only becomes effective once you click the link.

We store the time of sign-up and, where applicable, of confirmation. Open and click rates are analysed in aggregated form. Further information on the associated data processing is available in Shopify's privacy policy (shopify.com/legal/privacy).

You can unsubscribe from the newsletter at any time via the link at the end of every newsletter or by sending a message to info@ayguey.shop.

7.5 Contact form

Enquiries submitted via the contact form are transmitted to us via Shopify Forms/Inbox and stored for processing.

7.6 Withdrawal function

The withdrawal function on our website is provided via the Shopify app “EU Widerrufsbutton” of Visionz GmbH, Hildesheim (Germany). Visionz processes the data entered in the withdrawal form (name, order number, e-mail address, time of receipt) on our behalf and sends the acknowledgement of receipt; a data processing agreement has been concluded. Visionz uses sub-processors for this: Fly.io, Inc. (USA) for hosting the application and database, and Brevo SAS (France) and Twilio SendGrid (USA) for sending e-mails. For transfers to the USA, we rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Further information can be found in the Visionz privacy policy (visionz.de/datenschutz).

7.7 Product reviews (Loox)

For product reviews we use the Shopify app “Loox” provided by Loox Online Ltd. (Israel). When you submit a review via the link in our email or on our website, Loox processes your name, email address, details of the item purchased and of your order, your review and any photos or videos on our behalf. So that we can mark a review as a “verified purchase”, Loox matches your email address against our order data.

Your review is shown on our website with your first name and the initial of your last name; your email address is not published. Reviews with four or five stars are shown immediately; we check the others before publication. We also publish critical reviews; we only withhold content that is offensive, off-topic or clearly untrue.

We have concluded a data processing agreement with Loox. Loox uses sub-processors, including Amazon Web Services, Google, DigitalOcean, Cloudflare and Twilio SendGrid (all USA). The European Commission has issued an adequacy decision for Israel, and Switzerland also recognises Israel as providing adequate data protection; for transfers to the USA, Loox relies on the EU Standard Contractual Clauses. For more information, see the Loox privacy policy (loox.app/legal/privacy-policy-end-users).

8. Cookies and consent

On your first visit, our cookie banner asks for your consent. We always set necessary cookies (shopping cart, checkout, language and country selection, security). We use analytics and marketing cookies (e.g. Google, Meta) only if you agree. The services we use for analytics and advertising are described in Section 9.

You can change your selection at any time via the "Cookie settings" link in the footer. This also applies to users in Switzerland: whatever you reject remains switched off.

An overview of the cookies set by Shopify is available at shopify.com/legal/cookies.

9. Analytics and advertising with Google and Meta

We use the following services only if you have consented to the "Analytics" or "Marketing" category in the cookie banner (Art. 6(1)(a) GDPR; for users in Germany additionally Section 25(1) of the German TDDDG). Without your consent, the corresponding cookies are not set. You can withdraw your consent at any time via the "Cookie settings" link in the footer; withdrawal takes effect for the future.

Google Analytics 4. We use Google Analytics to analyse how visitors use our shop (e.g. pages visited, time spent, origin of the visit, shopping cart and purchases) in order to improve our offering and website. For this purpose, cookies or a random identifier are stored on your device. Google Analytics 4 does not store full IP addresses. We receive the analyses only in aggregated form. We have limited data retention in Google Analytics to 14 months.

Google Signals. If you are signed in to your Google account and have allowed personalised advertising there, Google may link your use of our shop across devices (Google Signals). We receive only aggregated statistics, no information about individual persons. You can switch this off in your Google account settings at myadcenter.google.com.

Google Ads – conversion tracking. If you arrive at the shop via one of our Google ads, Google stores a cookie that allows us to recognise whether a purchase or newsletter sign-up subsequently took place ("conversion"). This is how we measure the success of our advertising. In this process, your email address from the order may be transmitted to Google in encrypted (hashed) form so that Google can attribute the purchase to the ad; Google does not use this information to create a profile about you.

Google Ads – remarketing and audiences. With your consent, we add you to visitor lists (e.g. "viewed a product", "abandoned the shopping cart") so that we can later show you ads for our products on Google, YouTube and websites in the Google network. Google may also use these lists to reach people with similar interests. Membership in these lists lasts a maximum of 180 days.

Consent Mode. Our shop communicates your cookie selection to Google (Google Consent Mode). If you have not consented, the Google services do not set cookies and do not use identifiers; in that case Google may at most receive technical signals without any personal reference (e.g. that a page was accessed), which are used only for aggregated estimates.

Provider Google. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may also be transmitted to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. Further information: policies.google.com/privacy and policies.google.com/technologies/partner-sites. Ad settings: myadcenter.google.com.

Meta Pixel and Conversions API. With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It records which pages you visit and whether you make a purchase, so that we can measure the success of our advertising on Facebook and Instagram and show you ads there (remarketing). In addition, we transmit purchase events to Meta server-side (Conversions API); contact data is transmitted only in encrypted (hashed) form. We and Meta are joint controllers for the collection and transmission of the data to Meta (Art. 26 GDPR); the relevant agreement is available at facebook.com/legal/controller_addendum. Meta is the controller for the further processing. Data may be transmitted to Meta Platforms, Inc. in the USA, which is certified under the EU-US and the Swiss-US Data Privacy Framework. Further information: facebook.com/privacy/policy; ad settings: facebook.com/adpreferences.

Cookie retention periods. Google analytics cookies (e.g. "_ga") up to 2 years, Google advertising cookies up to 13 months, Meta cookies (e.g. "_fbp") up to 3 months, in each case unless you delete them earlier or withdraw your consent.

10. Customer account

The customer account is optional. You log in using a one-time code sent to your email address or via the shop. In your account you can view your orders and manage your addresses.

You can have your account deleted at any time via info@ayguey.shop. We then retain order data only for as long as statutory retention obligations require.

11. Retention period

Certain data, in particular business, accounting and transaction data, may be stored beyond the duration of the business relationship due to statutory retention obligations.

Order and invoice data: 10 years (accounting obligation under the Swiss Code of Obligations and German Commercial Code/Fiscal Code)

Customer accounts: are deleted within 30 days of your deletion request; we retain order data for as long as statutory retention obligations require.

Newsletter data: After you unsubscribe, we no longer use your email address for the newsletter; it is deleted within 30 days, provided there is no customer account and no order.

Contact enquiries: are deleted no later than 12 months after completion.

Product reviews: remain published until you ask us to delete them or we remove them. You can request deletion of your review at any time by writing to info@ayguey.shop.

Log data: after 30 days, unless a security incident requires longer retention.

12. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests, as well as the right to withdraw consent at any time. To exercise your rights, please contact info@ayguey.shop.

You have the right to report a matter to or lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data does not comply with data protection law. You may do so with the supervisory authority in the country of your place of residence or place of work, or at the place or in the country where the alleged data protection infringement occurred. In Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, CH-3003 Bern, www.edoeb.admin.ch).

13. Automated decision-making and children's data

We do not make decisions based solely on automated processing that have legal effects.

Our offering is generally directed at persons who have reached the legally required minimum age for concluding the relevant contracts. We do not knowingly collect data from children where this is prohibited by law.

14. Changes to this Privacy Policy

We will amend this Privacy Policy if our services or the legal situation change. The version published on ayguey.shop at the relevant time applies.