Skip to main content

Privacy Policy

Last Updated: November 2, 2026

This Privacy Policy describes how Kupiku AG ("we," "us," or "our") handles personal data collected through our website.

As a Swiss company, our data processing activities are primarily governed by the Swiss Federal Act on Data Protection (FADP / revFADP). For visitors accessing our website from the European Economic Area (EEA), this policy also reflects relevant transparency standards under the EU General Data Protection Regulation (GDPR).

1. Data Controller and Contact Information

The data controller responsible for the processing of your personal data is:

  • Company Name: Kupiku AG
  • Registration / UID: CHE-218.847.356
  • Registered Address: Bahnhofstrasse 9, 6460 Altdorf, Switzerland
  • Contact Email: support@kupiku.com

2. Personal Data We Collect

We adhere to strict data minimization. The only personal data we collect and maintain is information you directly provide to us:

  • Fulfillment & Contact Data: Name, shipping address, billing address, email address, and phone number (solely where required by international couriers or customs declarations).
  • Order & Transactional Records: Records of purchases (physical media formats, titles, order totals, and fulfillment status). Payment card details are handled directly by PCI-compliant payment gateways; we do not process, store, or have access to raw card numbers or security codes.
  • Direct Communications: Any correspondence initiated by you via customer support channels or email.
  • Marketing Communications (Opt-In Only): If you specifically choose to subscribe to our newsletter or promotional notifications, we store your email address for that purpose until you unsubscribe.

3. Purposes and Legal Grounds for Processing

Your personal data is processed strictly for the following purposes:

  • Order Processing & Delivery: Executing checkout, generating invoices, and arranging the physical dispatch of goods from Japan (Contract performance under Art. 31 para. 2 let. a FADP / Art. 6(1)(b) GDPR).
  • Statutory Compliance: Fulfilling Swiss commercial accounting and tax retention duties under the Swiss Code of Obligations (CO) (Art. 31 para. 1 FADP / Art. 6(1)(c) GDPR).
  • Direct Marketing: Sending newsletters, discounts, or promotional alerts only where you have explicitly opted in (Consent under Art. 31 para. 1 FADP / Art. 6(1)(a) GDPR).
  • IT Security & Diagnostics: Routine server stability and security monitoring (Legitimate interest under Art. 31 para. 1 FADP / Art. 6(1)(f) GDPR).

4. International Logistics and Infrastructure

To fulfill orders and maintain operational systems, personal data is shared only with the following parties:

  • Logistics & Warehousing (Japan): Because goods are stocked and dispatched directly from Japan, the consignee details (name, shipping address, phone number, and package contents/value) are transmitted to fulfillment personnel and postal/courier operators in Japan (e.g., Japan Post, international couriers) for packaging, air transport, and customs export/import clearance. Japan is recognized by the Swiss Federal Council as offering an adequate level of data protection.
  • Payment Service Providers: External payment processors handling tokenized transactions over secure connections.
  • Hosting & Server Infrastructure: Production hosting, primary databases, and customer-data backups are maintained within secured European and Swiss data center regions.

5. Cross-Border Access by Distributed Contractors

Our operations utilize internal staff and technical contractors located across different jurisdictions (including Europe, Africa, and Asia) to provide site maintenance, logistics coordination, and customer support:

  • Access Restrictions: Contractors access only the specific operational dashboards or interfaces strictly required to execute their job functions (e.g., fulfilling an order, server diagnostics, or resolving a ticket). Core databases containing customer information remain isolated on European server infrastructure.
  • Transfer Safeguards: Where contractors access systems from countries lacking an adequacy decision by the Swiss Federal Council (or European Commission), access is governed by Standard Contractual Clauses (SCCs) including required Swiss amendments, alongside role-based access limits, strict authentication protocols, and encrypted connections.

6. Retention of Personal Data and Server Logs

  • Transaction & Accounting Records: Commercial invoices and transactional data are retained for 10 years in accordance with mandatory Swiss statutory retention requirements (Art. 958f Swiss Code of Obligations).
  • Server Logs: Automated server access logs are retained for up to 7 days strictly for operational diagnostics, incident investigation, and error reconstruction, after which they are permanently overwritten or deleted. Server logs do not store personal customer profile data.
  • Newsletter Data: Maintained only for the duration of your active subscription. You can opt out at any time via the unsubscribe link in any message.

7. Cookies and Tracking Technologies

  • No Analytics Cookies: We do not currently deploy cookies or third-party tracking scripts for behavioral analytics, audience measurement, or cross-site profiling.
  • Essential Session Cookies Only: Our website uses only strictly technical, functional cookies necessary to ensure basic site operations (such as maintaining an active shopping cart session or navigating checkout securely).

If we implement marketing, analytics, or referral conversion tracking in the future, this policy will be updated accordingly, and consent will be gathered where legally required.

8. Technical Security Measures

We maintain technical and organizational safeguards to protect personal data against loss, unauthorized access, or misuse:

  • Transport Layer Security (TLS/HTTPS) encryption across all public web traffic.
  • Network firewalls and strict access control for internal administrative tools.
  • Separation of customer databases and operational dashboards from unencrypted backups.

9. Your Rights

Under the Swiss Data Protection Act (and applicable provisions of the GDPR for EEA visitors), you have the right to request:

  • Access: Confirmation of whether we process your data and access to that data.
  • Rectification: Correction of inaccurate or incomplete records.
  • Erasure: Deletion of your personal data, subject to mandatory statutory retention rules (such as Swiss commercial accounting laws).
  • Revocation of Consent: Withdrawal of your consent at any time for optional communications, such as newsletters.

Contact and Resolution

If you have questions, wish to exercise any statutory rights, or wish to resolve any issue regarding how your data is handled, please contact our team directly at:

Email: support@kupiku.com

We will review and address your request promptly. Where applicable under European law, individuals residing in the European Economic Area may also lodge a complaint regarding data processing with their competent data protection supervisory authority.

10. Updates to this Policy

We may periodically amend this Privacy Policy to reflect technical, operational, or legal developments. Any revisions become effective immediately upon posting to this page.

!