NÜKT Privacy and Cookie Statement

1 Controller and contact details

Nuekt AG is the controller responsible for the processing described in this Statement.

You may contact us about privacy or exercise your rights by email at office@nuekt.com or by writing to the postal address above, marked Data Protection.

2 Scope and applicable law

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and its implementing ordinance. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to a particular processing activity, we also apply the relevant requirements of that law.

This Statement applies to the Site and the online forms and communications described here. It does not govern third-party websites or services that have their own privacy notices.

3 Personal data we collect

Personal data means information relating to an identified or identifiable individual. Depending on how you use the Site, we may collect the following categories.

• Identity and contact data, such as your name, email address, telephone number, country, city or region, company, job title and preferred language.
• Consumer request data, such as the supermarket or retailer you would like to stock NÜKT, your location, product interests and personal data contained in any message you submit.
• Waitlist and marketing data, such as your email address, location, product interests, subscription status, consent record and communication preferences.
• Business and licensing enquiry data, such as company details, market or territory, business model, distribution or production capabilities, areas of interest, website, expected volumes and information included in your enquiry, to the extent that such information relates to an identified or identifiable individual.
• Communications data, including correspondence, requests, feedback and records of our response.
• Technical and usage data, such as IP address, device and browser information, operating system, language, time zone, pages viewed, referring page and diagnostic logs.
• Preference data, including your language preference and related settings saved on your device.

Please do not submit sensitive personal data or confidential third-party information through general website forms unless we expressly request it.

4 How we obtain personal data

We obtain personal data directly from you when you submit a form, subscribe, communicate with us or change your settings. We also collect technical and usage data automatically from your device through server logs, cookies and similar technologies. Where permitted, we may receive business contact data from your employer, colleagues, event organisers, distributors, public sources or service providers. If you provide personal data about another person, you must be authorised to do so and inform that person of this Statement where required.

5 Purposes and legal grounds

We process personal data only for the specified purposes and, where the GDPR applies, on an appropriate legal basis.

6 Direct marketing

We send electronic marketing only where permitted by applicable law. When consent is required, a request, waitlist registration or business enquiry does not by itself constitute consent to unrelated marketing. Consent requests are separate, specific and optional. You may withdraw consent or opt out at any time by using the unsubscribe link in a message, changing available communication settings or contacting us. Withdrawal does not affect processing that took place before withdrawal. We may retain a minimal suppression record to ensure that we respect your opt-out.

7 Cookies and similar technologies

Cookies are small files stored on your device. Similar technologies include pixels, tags, local storage, software development kits and server-side identifiers. The Site does not currently use cookies or analytics or advertising trackers. We use browser session storage to keep your selected language during your visit; it is deleted when you close the browser tab. Only if you choose “Remember my language” do we store this preference in your browser’s local storage for future visits, until you untick the option or clear the Site’s stored data. This entry contains only your language preference, does not include a unique user identifier and is not transmitted to our servers. You can delete it by unticking “Remember my language”, by clearing the Site’s stored data in your browser and, depending on your browser, restrict local storage through its settings.

8 Social media and third-party content

The Site may contain links to social media pages or third-party websites. A simple link does not normally transmit data to that third party until you select it. If the Site embeds third-party content or social media functions that can transmit personal data, we activate non-essential elements only after the required consent. Once you interact with a third-party service, that provider may process data under its own privacy notice, including when you are logged into its service.

9 Recipients and service providers

We may disclose personal data only as necessary to:

• hosting, website, security, email, customer relationship management, cloud, professional and other service providers acting for us;
• NÜKT distributors, retailers, commercial or licensing partners where this is necessary to handle your request and lawful in the circumstances;
• banks, insurers, auditors, legal and other professional advisers;
• competent authorities, courts or other parties where required by law or necessary to protect legal rights; and
• a buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data. Where a provider processes personal data on our instructions, we require appropriate contractual, confidentiality and security commitments. Some third parties may act as independent controllers for their own processing; their privacy notices then apply.

10 International disclosures

Our service providers process your personal data primarily in Switzerland and the European Union. In limited cases, recipients may be located outside Switzerland or the European Economic Area, such as in the US. We transfer personal data internationally only where permitted by applicable law. Depending on the destination and the applicable regime, safeguards may include an adequacy decision, the European Commission Standard Contractual Clauses, the Swiss data-protection addendum or clauses, supplementary technical and organisational measures, or a lawful exception. You may contact us for information about or a copy of the safeguards relevant to your data, subject to legal and confidentiality restrictions.

11 Retention

We keep personal data only for as long as necessary for the relevant purpose, including legal, accounting, evidentiary and security requirements. We use the following criteria and indicative periods, unless a longer period is required or justified.

• General enquiries: normally up to 24 months after the last substantive contact.
• Waitlist and marketing records: until you withdraw or unsubscribe, plus a limited suppression record to respect your choice and evidence compliance.
• B2B and licensing leads: normally for the active evaluation or relationship and up to 5 years after the last substantive contact; contract and accounting records may be retained for 10 years where required.
• Consumer demand requests: normally up to 24 months in identifiable form; aggregated or anonymised insights may be retained longer because they no longer identify you.
• Security and technical logs: normally for a short period appropriate to security and diagnostics, unless an incident requires longer retention.
• Consent records: for as long as reasonably necessary to demonstrate and honour your choice.

12 Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures are selected according to risk and may include access controls, encryption in transit, secure configuration, backups, logging, confidentiality obligations and review of service providers. No internet transmission or storage method is completely secure.

13 Your rights

Subject to the conditions and limits of applicable law, you may request information about and access to your personal data, correction of inaccurate data, deletion, restriction of processing, data portability, or delivery of data in a common electronic format. Where the GDPR applies, you may object to processing based on legitimate interests and object at any time to direct marketing. You may withdraw consent at any time for future processing.

To exercise a right, use the contact details in section 1 and describe your request. We may ask for information needed to verify your identity and protect your data. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner. Where the GDPR applies, you may lodge a complaint with the competent supervisory authority in the EU or EEA country of your habitual residence, place of work or the alleged infringement.

14 Automated decisions

We do not use personal data collected through the Site to make solely automated decisions that produce legal effects or similarly significant effects for you. If this changes, we will provide the information and safeguards required by applicable law.

15 Children

The Site is intended for a general audience and is not designed to collect personal data from children. A child should not submit personal data without the involvement of a parent or legal guardian. If we learn that personal data was submitted by a child in circumstances requiring parental authorisation, we will take appropriate steps, including deletion where required.

16 Changes to this Statement

We may update this Statement when our practices, website tools or legal requirements change. We will publish the revised version on the Site and update the effective date. If a change materially affects processing based on consent, we will request new consent where required.