Privacy policy

Last updated: October 2026. This is a translation; in case of discrepancies, the German version prevails.

This privacy policy explains which personal data we process when you visit mahwear.ch and place orders, for what purpose and for how long. It is based on the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance.

1. Controller

Mahwear, owner Fatemeh Tajik
Aarmattweg 53, 3052 Zollikofen, Switzerland
Email: Fatemehtjk99@gmail.com, phone: +41 76 830 09 36

2. Data we process

Order data: name, delivery and billing address, email address, phone number (if provided), items ordered, prices, order and payment status.
Customer account: email address, name, addresses, order history and your password, which we store only in hashed form. When you sign in we store the session's IP address and browser identifier for security.
Payment data: you enter card and account details directly with our payment provider Stripe. We only receive confirmation of the payment and details such as the payment method and the last digits of the card, never full card numbers.
Contact requests: name, email address, subject, message, order number if given, and the IP address (to prevent abuse).
Newsletter: email address and time of sign-up.
Reviews: name or display name, rating and text when you review a product. These are publicly visible.
Technical data: when you access the website, our server automatically processes your IP address, date and time, page requested, browser and operating system (server log files).

3. Purposes

We process personal data

to handle, deliver and charge orders, process returns and warranty claims and manage your customer account,
to answer enquiries,
to send you the newsletter if you have consented,
to operate the website securely and reliably and to prevent abuse and fraud,
to meet legal obligations, in particular retention of business records.

We do not sell personal data or use it for third-party advertising. We do not carry out automated individual decision-making or profiling.

4. Cookies

We only use technically necessary cookies:

Cookie	Purpose	Duration
ms_cart	stores your shopping cart	30 days
ms_session	keeps you signed in to your account	30 days or until you sign out
NEXT_LOCALE	remembers your language	session or up to 1 year

We do not use analytics, tracking or advertising cookies. You can delete or block cookies in your browser, but the cart and sign-in will then not work.

5. Service providers

We share personal data only where necessary for the purposes above. Our service providers process data on our behalf and are contractually bound to data protection and confidentiality:

Hosting: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany – servers for the website and database.
Payments: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, and Stripe, Inc., USA. Stripe also processes payment data as an independent controller, for example for fraud prevention. More at stripe.com/ch/privacy.
Shipping: Swiss Post Ltd receives your name, delivery address and, where applicable, email or phone number for delivery and tracking.
Email: our email provider processes your email address and the content of order confirmations, shipping notifications and, if subscribed, the newsletter.
Authorities: where we are legally required to do so.

6. Transfers abroad

Our hosting provider operates its servers in Europe. Data may be transferred to EU/EEA countries which, according to the Swiss Federal Council, provide adequate data protection. With Stripe, a transfer to the USA is possible. Stripe, Inc. is certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework; the European Commission's standard contractual clauses, recognised by the FDPIC, also apply.

7. Retention

Order and invoice data are kept for ten years as required by law (Art. 958f Swiss Code of Obligations).
Customer accounts remain until you delete them or ask us to; we then delete the account data unless a retention obligation applies.
Contact requests are deleted no later than two years after they are closed.
Newsletter data is kept until you unsubscribe.
Server log files are deleted after a short time, no later than 30 days.

8. Security

We protect your data with appropriate technical and organisational measures, including encrypted transmission (HTTPS), hashed passwords, access restrictions and regular backups.

9. Your rights

Within the limits of applicable law, you have the right to

access information on whether and which data we process about you (Art. 25 FADP),
have incorrect data rectified,
request erasure or restriction of processing,
object to processing, in particular processing based on legitimate interests,
receive or have transferred your data in a common electronic format (Art. 28 FADP),
withdraw consent at any time with effect for the future – for example via the unsubscribe link in the newsletter.

Write to Fatemehtjk99@gmail.com. We may ask for proof of identity. Statutory retention obligations may prevent erasure.

You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).

10. Changes

We may update this privacy policy. The version published on this page applies.