1 The security of user data is our top priority

Sooray respects the privacy of all users of the website and online store (hereinafter referred to as "the customer" or "the customers"). This privacy policy forms the basis for the processing of personal data and explains what type of user data Sooray collects from customers, how Sooray uses this data, and what rights customers are entitled to. Sooray complies with applicable data protection laws and processes personal data solely for the purposes for which the data was transmitted.

This privacy policy may be amended, supplemented, or modified from time to time. The most current, available version applies each time you access or visit the website.

Should there be any conflict between this Privacy Policy and Sooray's otherwise applicable contractual or business terms and conditions, the provisions of this Privacy Policy shall prevail.

2 Type and purpose of the data collected

The term “personal data” or “personal information” as used in this privacy policy includes information that can be used to personally identify customers.

The processing of personal data means any handling of personal data, such as collecting, using, storing, disclosing, transmitting or deleting the data.

On the one hand, Sooray automatically collects personal data when the customer interacts with the website or uses the online shop. On the other hand, personal data that a customer provides (e.g., by contacting us, creating a user profile or customer account) is automatically or manually collected.

2.1 Data that is collected automatically

When visiting the Sooray website, statistical visitor data is automatically collected about which parts of the website are visited by the customer. Each time a website is accessed, the web server automatically saves a so-called server log file, which contains, for example, the name of the requested file, the customer's IP address, the date and time of access, the browser used, the operating system, the amount of data transferred, and the requesting provider (access data), and documents the access. In this context, it is sometimes necessary to use so-called cookies (see section 4 below).

This access data is evaluated solely for the purpose of ensuring trouble-free operation of the site and improving our offering.

2.2 Data when interacting with Sooray, for contract processing, contact and when opening a customer account

Sooray does not automatically collect personal information from customers, such as name, address, telephone number or email address.

However, personal data is collected from customers when a customer voluntarily provides it as part of an order or when contacting Sooray (e.g., via contact form or email). Mandatory fields are marked as such, as in these cases Sooray absolutely needs the data to process the contract or contact, and without this information, the order or contact cannot be sent. The data collected is evident from the respective input forms.

If a customer decides to open a customer account, Sooray will use the personal data for the purpose of opening the customer account. The mandatory information requested during registration must be provided in full; otherwise, Sooray may reject the registration. Sooray will use the collected personal data only for the purpose of using the online shop or the respective offer or service for which the customer has registered. Sooray may also use the customer's email address to inform them about important changes, such as changes to the scope of the offer, or about technically necessary changes.

After the contract has been fully processed or the customer account has been deleted, the customer's data will be restricted for further processing and deleted after the expiration of the retention periods under tax and commercial law, unless the customer has expressly consented to further use of the data or Sooray reserves the right to use the data in any other way that is permitted by law. The customer account can be deleted at any time and can be done either by sending a message to the contact details provided below (see Section 9 below) or via a dedicated function in the customer account.

3 Legal basis for collecting and processing personal data

The legal basis for the collection and processing of the customer's personal data depends on the specific purpose of the data processing. This includes, in particular:

• the protection of Sooray's legitimate interests, provided that the interests of the customer or fundamental rights or freedoms are not unreasonably affected;
• the conclusion or performance of a contract; or
• The customer's consent is given at the time the personal data is collected. The customer may revoke their consent at any time. To do so, the customer can send a corresponding notification to the contact details described below. The legality of the data processing already carried out remains unaffected by the revocation.

4 Use of cookies and use of data

4.1 Cookies

To continuously improve its website for customers, Sooray may use cookies. Cookies are small pieces of software information stored on the customer's computer hard drive by web browsers (e.g., Google Chrome, Internet Explorer, or Mozilla Firefox) to facilitate website use (e.g., language selection, shopping cart, etc.).

Some of the cookies used by Sooray are deleted after the end of the browser session, i.e., after the web browser is closed (so-called session cookies). Other cookies remain on the device and allow Sooray to recognize the customer's web browser on the next visit (so-called persistent cookies). The storage duration can be found in the overview in the web browser's cookie settings.

Most web browsers automatically accept such cookies, but web browsers can be configured to refuse or block cookies. Disabling cookies may, however, limit the functionality of the website. For details, please refer to your browser's manual or help function.

4.2 Use of data

The anonymized data collected via cookies when you visit the Sooray website may be used for web analysis purposes, to optimize the website, and to measure performance. Sooray may use third-party providers for this purpose, some of which have their own data protection policies over which Sooray has no control.

Sooray uses functions of the following web analysis services:

Google Analytics
The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google evaluates website usage to compile reports on website activity and to provide Sooray with other services related to website activity and internet usage. The IP address transmitted by the customer's web browser as part of Google Analytics will not be merged with other Google data.

The information generated by cookies about your use of the website is usually transferred to a Google server in the USA and stored there. Google adheres to the data protection provisions of the Swiss-US Privacy Shield Agreement and has registered with the US Department of Commerce for the Swiss-US Privacy Shield (information on the Swiss-US Privacy Shield can be found at https://www.privacyshield.gov/Swiss-US-Privacy-Shield-FAQs ).

For more information, see Google’s privacy policy at https://support.google.com/analytics/answer/6004245?hl=de .

Google Ads and Google Conversion Tracking
The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

As part of Google Ads, Sooray uses conversion tracking. When a customer clicks on an ad placed by Google, a conversion tracking cookie is set. These cookies expire after 30 days at the latest and are not used to identify the customer. If the customer visits Sooray's website and the cookie has not yet expired, Google and Sooray can recognize that the customer clicked on the ad and was redirected to this page.

Sooray receives from Google the total number of users who clicked on the ad and were redirected to a website with a conversion tracking tag. However, Sooray does not receive any information that could personally identify the customer.

For more information, see Google’s privacy policy at https://www.google.de/policies/privacy/ .

Google Maps
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Sooray uses Google Maps to visually display geographical information. When using Google Maps, Google transmits or processes data about the use of the Maps functions by website visitors, which may include, in particular, the IP address and location data. Sooray has no influence on this data processing.

To the extent that information is transferred to and stored on Google servers in the USA, the American company Google LLC is certified under the “Swiss-US Privacy Shield”.

To deactivate the Google Maps service and thus prevent data transmission to Google, a customer must deactivate the JavaScript function in their web browser. In this case, Google Maps cannot be used or can only be used to a limited extent.

For more information, see Google’s privacy policy at
https://www.google.com/intl/de_de/help/terms_maps/ .

4.3 Social Media Content

Sooray may use social media plugins from social networks such as Facebook, Instagram or Twitter on the website.

When the customer visits a website that contains such a plug-in, the web browser establishes a direct connection to the servers of the respective social network. The content of the plug-in is transmitted directly to the web browser by the respective provider and integrated into the page. By integrating the plug-in, the providers receive the information that the customer's web browser has accessed the corresponding Sooray website, even if the customer does not have a profile on the respective social network or is not currently logged in. This information (including the IP address) is transmitted directly from the customer's web browser to a server of the respective provider (possibly in the USA) and stored there. If the customer is logged in to one of the services, the providers of the social network can directly assign the visit to the Sooray website to the profile in the respective social network. If the customer interacts with the plug-ins, for example by clicking the "Like" or "Share" button, the corresponding information is also transmitted directly to a server of the provider and stored there. The information is also published on the social network and displayed to the customer’s contacts there.

These social network platforms have their own data protection regulations over which Sooray has no influence.

The purpose and scope of data collection and the further processing and use of the data by the providers on their websites, as well as contact options and the related rights of customers and setting options for protecting privacy, can be found in the providers' data protection notices:

https://www.facebook.com/policy.php

https://twitter.com/de/privacy

https://help.instagram.com/155833707900388

If the customer does not wish to load any of these plugins, they are recommended to log out of the relevant social network. Furthermore, various web browsers can be configured or supplemented with add-ons (e.g., Facebook blockers) to prevent the social media plugins from loading.

5 Newsletter

If the customer wishes to receive a newsletter offered by Sooray, Sooray requires the customer's email address and other information that allows verification that the customer is the owner of the specified email address and consents to receive the newsletter (so-called "double opt-in" process). If the customer wishes to subscribe to a newsletter as a registered customer, they can give their consent at the time of registration or later using the registration function in their customer account.

Through the newsletter, customers regularly receive recommendations and offers that might be of interest to them. To this end, Sooray collects and processes personal data regarding the customer's usage behavior on the website, orders placed with Sooray, and how the customer uses the newsletter (e.g., whether the newsletter is opened or which web URL links are clicked). Sooray may evaluate this data for statistical purposes in order to better tailor the content of the newsletter to the customer's interests.

The personal data entered into the newsletter registration form is processed based on the customer's consent, which the customer can revoke at any time. The revocation occurs either via the "unsubscribe" link in the newsletter, a written notification from the customer to Sooray at the address listed below, or by unsubscribing from the customer account. Sooray uses the collected personal data for the content design and distribution of the newsletter. It will not be passed on to third parties for their own (advertising) purposes.

Sooray stores the personal data provided by the customer for the purpose of receiving the newsletter until the customer unsubscribes from the newsletter.

6 Sharing your data

Sooray will not disclose customers' personal data to third parties. This exception applies if the customer has consented to the transfer of data to companies not affiliated with Sooray, or if Sooray is required to do so by law, government, or a court order. It also applies if service providers who support Sooray in data processing, website administration, or in other ways, as well as in providing the products and services requested by the customer, are engaged (e.g., parcel or newsletter delivery service providers). These third parties are obligated to maintain the same level of security and data protection as Sooray.

7 Data security

Unfortunately, the transmission of data over the internet is not completely secure. Sooray works with service providers and internet providers who take appropriate technical and organizational security measures to protect customers' personal data. However, Sooray cannot guarantee the security of data transmitted by customers. Any data transmission is therefore at your own risk.

8 Your information and cancellation rights

Of course, every customer is free to inform Sooray at any time – for example, by email – that they do not want their personal data used to contact them in the future. Participation in special services on the Beautything website, such as the newsletter service, can also be revoked at any time.

In addition, you have the option of obtaining information about the processing of your data or requesting a copy of the personal data collected via the Sooray website.

9 Contact

If you have any questions about this Privacy Policy or Sooray’s data protection practices, you can contact Sooray using the following contact details:

Sooray
Marrengasse 9, 8965 Berikon CH

info@sooray.com

10 Final provisions

Should individual provisions or parts of this data protection provision prove to be invalid or ineffective, this shall not affect the validity of the remaining provisions.

The place of jurisdiction and applicable law are governed by the General Terms and Conditions.