Privacy policy

As of 30 October 2026

This privacy policy explains which personal data we process when you visit sunmatched.com, order from our shop, return a product, apply as a dealer or creator, or contact us. We collect only the data we need.

1. Who is responsible

Responsible for processing your personal data (the controller) is:

For all questions about data protection, and to exercise your rights, write to info@dunkel-engineering.ch.

2. Which laws apply

We are based in Switzerland. The Swiss Federal Act on Data Protection (FADP), in force in its revised form since 1 September 2023, applies to our processing.

We also deliver to Liechtenstein. Liechtenstein is part of the European Economic Area (EEA), where the EU General Data Protection Regulation (GDPR) applies. Where the GDPR applies to our processing of data of people in Liechtenstein, this policy also gives the information it requires. Where we name a legal basis below, it is the legal basis under the GDPR. Swiss law does not require a legal basis for each processing activity.

3. Visiting our website

No cookies, no tracking

Our website does not use cookies. We do not use tracking, analytics or advertising tools, and we do not create user profiles. All fonts, images and scripts come from our own server. We do not load any content from third parties.

Shopping cart and saved details

Our shop keeps your shopping cart in the local storage of your browser (localStorage), so that it is not lost when you move between pages. This is technically necessary for the cart to work. The data stays on your device. We receive it only when you place an order.

If you tick "Remember my details on this device" in the checkout, your browser also stores your contact and delivery details there, so that you do not have to enter them again next time. The box is not ticked by default. If you untick it with your next order, the details are removed. You can also delete this data at any time by clearing your browser's data for our website.

Legal basis: for the cart, our legitimate interest in a working shop (Art. 6(1)(f) GDPR); for the saved details, your consent (Art. 6(1)(a) GDPR).

Server log files

Each time you open a page, our hosting provider automatically records:

• your IP address,
• the date and time,
• the page or file you requested (URL),
• information about your browser and operating system (user agent).

In addition, our shop writes technical logs, for example about errors, sent emails and messages from our payment service provider. These logs can contain your email address or your order number.

We use this data only to run the website and the shop securely and reliably, for example to detect and stop attacks and to find errors. We delete the log files after 6 months at the latest. If we need certain entries to investigate a specific attack, we keep them until the investigation is complete.

Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

Spam protection

To protect our forms and the checkout against abuse, our server keeps a pseudonymised form of your IP address (a hash value) to limit the number of requests per hour. It deletes it automatically after 24 hours. We do not use any external spam protection service.

Legal basis: our legitimate interest in protecting our website against abuse (Art. 6(1)(f) GDPR).

4. Orders

When you order, we process:

• your name, your company name if you give one, and your delivery address,
• your email address,
• your phone number, if you give it (optional),
• the products you ordered, prices, discounts and shipping costs,
• the payment method and payment status,
• any note you add, and our correspondence with you about the order, for example about returns or warranty claims.

We use this data to carry out the contract: to deliver, to process the payment, to send you the order confirmation and other order emails, and for customer service, returns and warranty. We also keep it because accounting and tax law require us to.

To order, you must give us your name, delivery address and email address. Without them, we cannot accept your order.

Your order page can only be opened with the personal link in your order confirmation. Please do not pass this link on.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations under accounting and tax law (Art. 6(1)(c) GDPR).

Payment

Payments by card (Visa, Mastercard), Apple Pay, Google Pay and TWINT are processed by our payment service provider Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (Stripe). To prepare the payment, we pass on the order number, the amount, the ordered items and your email address. You enter your payment details on the secure payment page of Stripe. Depending on the payment method, Stripe may ask for further details there, for example your name, country or postal code. Stripe runs this page and is responsible for the technologies used on it, for example cookies needed for the payment and for fraud prevention.

We never see your full card details. We only receive the payment status and basic information about the payment, for example the card type.

Stripe processes payment data partly on our behalf and partly under its own responsibility, for example to prevent fraud and to meet its legal obligations, such as anti-money-laundering rules. Its privacy policy: https://stripe.com/ch/privacy

To carry out a card payment, the transaction data also goes to the card network (Visa or Mastercard) and to the bank that issued your card. If you use Apple Pay, Google Pay or TWINT, Apple, Google or TWINT also process data, under their own privacy policies.

If you pay by bank transfer, we receive the information your bank sends with the payment, such as your name, your account number (IBAN) and the payment reference.

Delivery

To deliver your order, we pass on to Swiss Post the data needed for delivery: your name and delivery address and, where needed for the delivery, your phone number if you gave it.

Returns and withdrawal

If you return a product or withdraw from a contract, for example with our online form, we process the details you give us: your name, email address, order number, the products concerned, the date of receipt and your statement. We send you an acknowledgement by email. We need this data to handle the return and the refund. We keep your statement and our acknowledgement with the order records as evidence.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations (Art. 6(1)(c) GDPR).

5. Dealer applications

If you apply to become a dealer, we process the details in your application: company name, contact person, email address, country, website, type of business, expected units per year and your message. We use them to review your application and to contact you. We send you a confirmation email.

Legal basis: steps prior to a contract at your request (Art. 6(1)(b) GDPR) and our legitimate interest in finding suitable partners (Art. 6(1)(f) GDPR).

6. Creator and influencer applications

If you apply for a cooperation as a creator or influencer, we process the details in your application: your name, email address and country, the links to your channels, your followers or subscribers and average views, your topics and languages, your idea and your message. We may look at the public content of the channels you name. We use this to decide on a cooperation and to contact you. We send you a confirmation email.

Legal basis: steps prior to a contract at your request (Art. 6(1)(b) GDPR) and our legitimate interest in finding suitable partners (Art. 6(1)(f) GDPR).

7. Contact form and email

If you write to us through the contact form or by email, we process your name, your email address, your message and any other details you send. We use them to answer you. If you use the form, we send you a confirmation email.

Legal basis: if your message relates to a contract or a possible contract, Art. 6(1)(b) GDPR; otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

If you report a safety problem or an accident with one of our products, we record it, investigate it and keep a record of what we did. As the manufacturer, we have to monitor the safety of our products (Art. 6(1)(c) and (f) GDPR).

8. Who receives your data

We pass on personal data only where this is necessary for the purposes described above:

• Payment: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; for payments also the card networks, the banks involved, Apple, Google and TWINT (see section 4).
• Delivery: Swiss Post.
• Hosting and email: Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (GE), Switzerland. It hosts our website, our shop and our email, and it sends our order, application and contact emails. It stores the data in data centres in Switzerland.
• Our accountant, tax and legal advisers, and authorities, where this is necessary or required by law, for example for tax purposes.

Our hosting provider processes the data only on our behalf and according to our instructions. We do not sell personal data, and we do not use it for advertising.

9. Data processing outside Switzerland

We store your data in Switzerland. Some recipients also process data in other countries:

• Stripe processes payment data in Ireland and other countries of the EU/EEA. The Swiss Federal Council recognises that these countries have an adequate level of data protection.
• Stripe can also transfer data to companies of its group in the USA and in other countries. For the USA, Stripe relies on its certification under the Swiss–US Data Privacy Framework, which the Federal Council recognises as providing adequate protection for certified companies, and otherwise on safeguards such as standard contractual clauses. The details are in Stripe's privacy policy.
• Card networks such as Visa and Mastercard, as well as Apple and Google, can process payment data in other countries, including the USA. This is necessary to carry out the payment you chose (Art. 17(1)(b) FADP; Art. 49(1)(b) GDPR).

Apart from this, we do not transfer personal data to countries outside Switzerland and the EU/EEA.

10. How long we keep data

• Orders, invoices and payment records: 10 years from the end of the financial year. Swiss accounting law requires this (Art. 958f of the Swiss Code of Obligations).
• Orders that were never paid, for example after a cancelled card payment: as long as we need them to clear up the payment, then we delete them.
• Other order data, such as correspondence and return or withdrawal statements: as long as we need it for the contract, returns and warranty, usually until the warranty period has ended. Where this data is part of our business records, we keep it for 10 years, like the records.
• Dealer and creator applications: 12 months after we receive them. Then we delete them, unless a cooperation follows. In that case, we keep the data while we work together, and afterwards as long as the law requires.
• Contact messages: until your enquiry is settled, then at most 12 months, unless they are part of our business records.
• Reports about safety problems and accidents: as long as we need them to investigate and document them, at most 5 years.
• Server and shop log files: at most 6 months. Spam protection data: 24 hours (see section 3).

11. Your rights

You have the right to:

• know whether we process data about you, and receive a copy of it (access);
• have incorrect data corrected;
• have your data deleted, unless we must keep it by law;
• restrict the processing in certain cases;
• receive the data you gave us in a common electronic format, or have it transferred to someone else (data portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time with effect for the future, where we process data based on your consent.

These rights come from the FADP (in particular Art. 25, 28, 30, 32) and, where it applies, from the GDPR (Art. 15 to 21). They have legal limits. For example, we must keep accounting records even if you ask us to delete them.

To exercise your rights, write to info@dunkel-engineering.ch. We may ask you to prove your identity.

Right to complain

You can complain to a data protection authority:

• In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.
• In Liechtenstein: the Data Protection Authority (Datenschutzstelle), Kirchstrasse 8, 9490 Vaduz, www.datenschutzstelle.li.

12. No automated decisions

We do not take decisions based solely on automated processing, and we do not use profiling. Our payment service provider checks payments automatically for fraud. This can lead to a payment being declined. If that happens, you can choose another payment method or contact us.

13. Security

Our website uses encrypted connections (HTTPS). We protect your data with appropriate technical and organisational measures.

14. Our sensors

This privacy policy covers our website and our shop. Our sensors work locally and do not send any data to us.

15. Changes

We update this privacy policy when our data processing or the law changes. The current version is always on this page.