Privacy policy

This Privacy Policy explains how TheKeyStore Switzerland processes personal data when you visit thekeystore.ch, make purchases and use our contact and support services. Personal data means information relating to an identified or identifiable person.

1. Controller and contact details

The controller for the processing described here is Everix GmbH, operator of TheKeyStore Switzerland, Cheerstrasse 13i, 6014 Luzern, Switzerland. Please send privacy enquiries to info@thekeystore.ch. Telephone: +41 75 577 99 99.

2. Scope and applicable law

We observe the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance. Where the General Data Protection Regulation (GDPR) also applies to a particular processing activity, especially in connection with Liechtenstein, we also observe those requirements.

Processing serves, in particular, the operation and security of the shop, the preparation and performance of contracts, responding to enquiries and the analysis and marketing purposes described below. Where the GDPR applies, necessary processing for contracts is based on Article 6(1)(b), legal obligations on point (c), necessary security and administrative processing following a balancing of interests on point (f), and processing requiring consent on point (a). Acceptance of Terms and Conditions is not general consent to advertising or tracking.

3. Categories and sources of data

Depending on how you use our services, we process contact details, billing and delivery information, ordered products and variants, order and payment status, account information, correspondence, review content, technical usage data and privacy preferences. We receive information from you, from your use of the shop and, where necessary for the relevant transaction, from Shopify and the payment, delivery or other service providers described below.

The information required depends on the particular form and transaction. Company details are not required from all private customers as a general rule. Please do not submit unnecessary sensitive data, passwords or full payment details in contact forms, chats or reviews.

4. Website visits and technical data

When you access the website, technical operation involves the transmission of information such as your IP address, time of access, requested content, browser and device details and, where applicable, the previously visited page. Shopify and infrastructure service providers process this information to deliver the website, analyse errors, prevent abuse and maintain system security. The shop infrastructure may perform security and fraud checks. Further analysis is described in sections 12 and 13.

5. Orders, delivery and contract performance

For orders, we process in particular your name, contact details, billing and, where applicable, delivery address, products, variants, payment information or payment status, and order history. We need this data for confirmation, provision, delivery, invoicing and handling enquiries, complaints or refunds.

The Code Selling App – DPL by Digital Product Labs is integrated for digital key delivery. It processes the order and contact data needed to allocate and deliver keys. Order Printer Pro supports the creation and provision of order documents and invoices; the corresponding order, address and billing data are processed for this purpose.

For physical deliveries, Swiss Post receives the recipient and shipping information necessary for delivery. In support cases, we may process details about the software version, error messages and screenshots you provide.

6. Customer accounts and sign-in

Our customer accounts are provided through Shopify. You sign in using the email-code option offered or through Shop if you use that option. Sign-in, contact and session information is processed for this purpose. Your customer account lets you manage orders, profile and address information and other account functions offered there.

Shop and Shop Pay are additionally subject to Shopify's Consumer Privacy Policy. Payment and address information is collected where necessary for the relevant transaction; it is not generally required simply to open the sign-in page for the first time.

7. Contact forms, email and telephone contact

When you contact us, we process the contact details you provide and the content of your enquiry in order to respond and address your request. The contact form includes, in particular, name, email address, telephone number and message. Depending on the form, you may add an order number. If your enquiry concerns an order, we may associate it with that order.

8. Newsletters and email marketing

We use Shopify Messaging for email communications and marketing. In particular, email addresses, subscription status, available customer information and interactions with messages are processed. This may include delivery, opens measured by embedded tracking elements, and link clicks. Email workflows for abandoned carts and checkouts are also configured in the shop.

Promotional messages may only be sent on the basis of valid consent or an applicable statutory exception. Simply creating a customer account or having a publicly available email address does not amount to blanket marketing consent. You can unsubscribe using the link in a promotional message or by contacting us. Necessary order, payment and support messages are distinct from this.

9. Payment processing

Shopify Payments, TWINT and advance payment are configured in the shop. The methods available for your order are shown at checkout. For electronic payments, the payment service providers and banks involved process the necessary payment, transaction, contact and technical data, including for authorisation, settlement, fraud prevention and compliance with legal obligations.

Shopify Payments provides the card and wallet payments offered, including Shop Pay and, where applicable, Apple Pay or Google Pay. TWINT involves the providers responsible for your selected TWINT app and payment processing. For advance payment, we receive the transfer details needed to allocate the payment. We do not require you to send full card details by email or chat.

Further information: Shopify and TWINT. Payment providers process some data independently to comply with their own legal obligations.

10. Shopify as the platform

We use Shopify for hosting, the shop, checkout, customer accounts and order management. Shopify processes contact, order, payment and usage data, as well as technical information, for these purposes. The hosting location shown in our administration is the European Union. This does not mean data is processed exclusively within the EU: Shopify operates internationally and uses additional service providers.

Shopify acts on our behalf in operating the shop and independently for certain services of its own. Shopify Network Intelligence is enabled in our shop. This allows Shopify to combine data from interactions with our shop with data from other Shopify shops and its own services to improve services, personalisation, security and advertising. Your relevant privacy choices must be taken into account. Information and choices are available in Shopify's Consumer Privacy Policy and the Shopify Privacy Portal.

11. Cookies and privacy settings

The shop uses cookies and similar technologies, for example for the cart, sign-in, language, security and storing your privacy choices. There are also analysis and marketing functions. Through the cookie banner and cookie settings, you can accept or reject the optional categories offered and change your choice later. Technically necessary functions cannot be fully disabled through these controls.

The choice displayed is processed through Shopify's privacy functions. The Pandectes privacy app is also integrated, and its technical component loads in the shop. Managing your choice may involve processing technical identifiers, settings and consent information.

You can access the selection through “Cookie preferences” or this link to the privacy settings. You can also delete or block cookies in your browser. Doing so may restrict shop functions. Withdrawal takes effect for the future and neither reverses previous processing nor automatically removes all cookies already stored in your browser.

12. Shopify Analytics and Google Analytics 4

Shopify provides reports on shop use and orders. Operational reporting related to orders must be distinguished from consent-dependent analysis of visitor behaviour.

Google Analytics 4 (GA4) is configured through the Google & YouTube integration. It may process page views, product interactions, cart and purchase events, device and browser information, approximate location information, and cookie and event identifiers, among other data. The purpose is to understand and improve the use and effectiveness of our shop. Optional analysis functions are activated according to your privacy choices and applicable requirements.

We do not publish a single fixed GA4 retention period because it depends on the data types and settings used. You can ask us for information about a particular processing activity. Provider information: Google Privacy Policy.

13. Google Ads, Facebook and Instagram

Google: The Google & YouTube integration is connected to Google Ads, and conversion analysis is enabled. Advertising clicks and shop events, such as product views or purchases, may be processed together with technical identifiers to measure the impact of advertisements and product listings and optimise advertising. Product data is also synchronised with Google Merchant Center. Enhanced Conversions and Customer Match are not enabled in the channel configuration checked.

Meta: Facebook & Instagram is configured with the Meta Pixel, advanced matching and Conversions API. Data on visits, product interactions, carts and purchases may therefore be transmitted to Meta both from the browser and through a server connection. Advanced matching may use available contact identifiers in hashed form for matching. Hashing does not mean the data is anonymous. Processing serves advertising measurement, attribution and personalisation. Meta may link this information to an existing Meta account.

Advertising processing that requires consent is governed by your privacy choices. Google and Meta provide further information and settings. Their own privacy notices apply to further processing by these providers.

14. Reviews, chat and FAQs

Judge.me: We use Judge.me to display and manage product reviews. When you submit a review, the review content, display name, contact details, product or order reference, and technical information may be processed. Published reviews and any uploaded images are publicly visible. Do not include product keys or confidential order details. Further information: Judge.me.

Trustpilot: Trustpilot review components and integration scripts are embedded in the shop. Loading them may transmit technical connection data to Trustpilot. If you use Trustpilot to submit or view a review, its privacy information also applies. This does not promise a particular automatic invitation after every purchase.

Chatty: Our chat and FAQ service uses Chatty by AVADA GROUP COMPANY LIMITED. Loading and using it involves processing technical session data and, if you contact us, your messages, voluntarily provided contact details and any order information you share. The AI agent is not enabled as of the stated version date. We therefore do not describe active AI responses to your enquiries. Further information: Chatty.

15. Recipients and service providers

Recipients, to the extent necessary, include the platform, payment, delivery, document, review, support and marketing services described above and the subcontractors they use for the relevant service. Internal permissions and access should be limited to the respective task. Other recipients include competent authorities or courts where a legal obligation exists, and recipients necessary to handle or enforce legal claims.

Further provider information: Digital Product Labs, Order Printer Pro / FORSBERG+two and Pandectes. Installing an app does not, by itself, mean that our shop uses every function offered by its provider.

16. Processing and transfers abroad

The international services named may process data outside Switzerland. For Shopify, this includes in particular Ireland or the EU, Canada and the United States. Ireland and the United States are particularly relevant for Google and Meta. Chatty states that data is stored in the United States and remotely accessed by staff in Vietnam. Digital Product Labs lists a registered office in the United States and an operational location in Nepal. Remote access from abroad may also be relevant under data protection law. The individual storage and support locations of other service providers depend on their current information and the service used.

Transfers to countries without an adequate level of data protection require appropriate safeguards or a statutory exception. Shopify refers, among other safeguards, to binding corporate rules and standard contractual clauses. Chatty refers to standard contractual clauses adapted for Switzerland. For US recipients, the Swiss-U.S. Data Privacy Framework may be relevant if the specific recipient is validly certified and the transfer falls within its scope; this does not automatically apply to every US service provider. Google describes its participation and other transfer mechanisms in its information on data transfers.

You can ask us for information about the safeguards used for a particular recipient. We do not give a blanket assurance that all app data remains exclusively in Switzerland or the EU. Despite safeguards, foreign legal systems and authorities' access powers may differ from Swiss protections.

17. Retention

We retain data for as long as necessary for the purposes described, ongoing contractual and support matters, and legal obligations. Business records and accounting documents subject to statutory retention requirements must generally be retained for ten years. This does not mean that all website, chat or analytics data is stored for ten years.

For other data, retention periods depend on purpose, necessity, the relevant service settings and any ongoing legal claims. Data must be deleted or anonymised once its purpose no longer applies and there are no obligations preventing this. Information on the retention of particular data is available on request. Unsubscribing from advertising does not automatically delete necessary order or accounting records.

18. Data security

We and our service providers use appropriate technical and organisational measures to protect personal data, such as protected transmissions and access restrictions. Absolute protection cannot be guaranteed for internet services. Keep sign-in codes and product keys confidential and inform us of any suspected misuse.

19. Your rights

Subject to applicable law, you may request access to your personal data, correction of inaccurate information, deletion and, where applicable, delivery or transfer of certain data. Where the statutory conditions are met, you may object to processing or request its restriction. You may withdraw consent with effect for the future.

Statutory retention obligations or overriding legally protected interests may prevent compliance with some requests; we will explain this in the particular case. Where necessary to establish identity securely, we may request reasonable proof of identity. You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or another competent supervisory authority, particularly the Liechtenstein Data Protection Authority where it has jurisdiction.

20. Privacy enquiries and choices

For privacy enquiries, write to info@thekeystore.ch or the postal address in section 1. Please describe your request and its connection with the shop. The selection described in section 11 is available for cookie choices. Where Shopify or a payment or platform provider processes data independently, you may also use that provider's privacy contact.

21. Changes

We update this policy when our data processing, services used or legal requirements change. The current version is available on this page. Publication does not replace consent where consent is required for a new processing activity.