Privacy Policy
This Privacy Policy explains how Maysun AG (Hinterbergstrasse 17, 6330 Cham, Switzerland) and its affiliates ("we", "Maysun") collect, process, and protect your personal data. It applies to all personal data collected from our customers, visitors, and other online users ("Users", "you") when utilizing our websites, purchasing our physical products (including Maysun drinks and shots), or interacting with our online shop (collectively, the "Services").
We reserve the right to amend this Privacy Policy at any time to ensure compliance with changing legal frameworks or to reflect changes in our data processing activities. We will inform you of any material updates in an appropriate manner, such as by posting the updated version on our website or, where appropriate, notifying you via email.
Our Services may contain links to third-party websites or applications. Your interactions on those external platforms are governed exclusively by the privacy policies and terms of those third parties. Maysun does not control and is not liable for the privacy practices of third-party platforms. We encourage you to review their policies carefully.
Purposes and Legal Bases of Data Processing
We process personal data in accordance with applicable data protection laws. We process your personal data for the following purposes:
- Contractual Obligations
- To process, fulfill, and deliver your orders (including shipping, logistics, customs clearance, and handling returns or refunds) and to manage your user account. This includes the management and billing of our subscription services (recurring deliveries of our products), as well as sending necessary service notifications regarding your active subscription, such as upcoming renewals or billing updates.
- Communication & Support
- To respond to your inquiries, provide order status updates (including delivery tracking), and send transaction-related notifications.
- Legitimate Interests
- To maintain, secure, and optimize the performance and user-friendliness of our website; to detect and prevent fraud, system abuse, or illegal activities; and to perform business analysis and product optimization.
- Direct Marketing
- To send you newsletters, promotional materials, or updates regarding our physical products (provided you have opted in, or as permitted under applicable fair competition laws if you are an existing customer). You may unsubscribe from promotional emails at any time.
- Legal Compliance
- To comply with statutory duties, including tax and commercial bookkeeping retention requirements, food safety standards, and mandatory age verification for energy drink purchases.
Types of Data We Process
Depending on how you interact with our Services, we process the following categories of personal data:
- Contact, Reviews & Delivery
- First and last name, billing address, shipping address (including company name for B2B customers), telephone number, and email address.
- Account Information
- Username, password, order history, and account settings.
- Payment Details
- Payment method tokens and transaction details (such as PayPal ID, Klarna, or Apple Pay tokens). For users subscribed to our recurring delivery services, we securely store payment tokens provided by our payment processors (e.g., Stripe) to enable automated recurring billing. We do not store full or raw credit card details on our own servers.
- Technical & Usage Data
- IP address, device type, operating system, browser settings, date and time of access, and cookie identifier tokens (see our Cookie Policy for details).
- Verification Data
- Date of birth and age, strictly used to verify that you meet the minimum age requirements to purchase restricted products, such as energy drinks.
Technical and Organizational Data Security
We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, misuse, or alteration. Our security practices are regularly reviewed and updated to align with industry standards.
Disclosure and Transfer of Personal Data
We do not sell your personal data. We only share your personal data with third parties if necessary to fulfill our contract with you, to comply with legal requirements, or to protect our legitimate interests. Recipient categories include:
- Affiliated Group Companies
- For internal administration purposes.
- Logistics & Shipping Partners
- Such as Swiss Post, DHL, DPD, and other fulfillment providers, to deliver and track your physical orders.
- Payment Service Providers
- Such as PayPal, Klarna, Apple Pay, and credit card processors, to securely process payments and perform fraud checks.
- IT & Infrastructure Providers
- Such as hosting partners, database administrators, and email marketing services, to support our digital operations.
- Customs & Tax Agents
- If we ship to the EU under Delivered Duty Paid (DDP) terms, we disclose transaction and shipping data to customs brokers and tax authorities to handle import VAT and duty compliance.
- Authorities
- Public offices, courts, or regulatory bodies, if we are under a legal or regulatory obligation to do so.
International Data Transfers
We process and store your personal data primarily in Switzerland and the European Economic Area (EEA).
However, in connection with the third-party tools and services we utilize (such as payment processors, IT hosters, and analytics providers), personal data may be transferred to and processed in countries outside Switzerland or the EEA, most notably the United States of America (USA) and potentially other countries globally.
If data is transferred to a country without an adequate level of data protection (such as the USA, absent specific adequacy arrangements), we ensure appropriate safeguards are in place — specifically by implementing the EU Standard Contractual Clauses (SCCs), recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC), or by relying on recognized adequacy frameworks such as the Swiss–U.S. Data Privacy Framework.
Data Retention Period
We store your personal data only as long as necessary to fulfill the purposes for which it was collected, or as required by statutory retention laws. For active subscription accounts, we retain your data for the entire duration of your active subscription. Upon cancellation of your subscription, the general statutory retention periods (such as the 10-year retention under commercial and tax laws) will commence.
Under Swiss and EU commercial and tax laws, transaction data, invoices, and contracts must generally be retained for a period of 10 years. Other personal data, such as website log data or newsletter registration details, are deleted or anonymized once the operational or communication purpose ceases to exist.
Your Rights
You have the following statutory rights regarding your personal data, subject to local legal conditions and limitations:
- Right of Access
- The right to request information about whether and how we process your personal data, and to obtain a copy of it.
- Right to Rectification
- The right to demand that inaccurate or incomplete personal data be corrected.
- Right to Erasure
- The right to be forgotten: to request deletion of your personal data, unless we are legally obligated or have a prevailing interest to retain it.
- Restriction & Objection
- The right to restrict or object to certain processing activities, such as direct marketing or processing based on legitimate interests.
- Data Portability
- The right to receive your personal data in a structured, commonly used, and machine-readable format.
- Withdraw Consent
- Where our processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
EU Representative · Art. 27 GDPR
Raimundo Agudo Suarez
Appointed as our point of contact for EU data subjects and supervisory authorities, as we are located outside the EU/EEA and actively offer our Services to customers within it.
ragudo@maysungaming.com
To exercise your rights, send a request to our data protection team at support@maysungaming.com with your name and the details of your request. We handle every request promptly and, in any event, within the statutory period of one month.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
Supervisory Authority · Switzerland
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, CH-3003 Bern
www.edoeb.admin.ch
If you are located in the EU/EEA, you also have the right to file a complaint with your local national data protection authority.