In the following, we inform you about the processing of personal data when you use our website www.ploom.ch. This Privacy Policy provides you with information about the processing of your personal data if you are registered on our website and have a user account accordingly. If you use the website without being logged in, your personal data will only be processed under the Cookie Policy. If you register for a newsletter without being logged in to the website or contact us via the contact form, your personal data will be processed in accordance with the privacy policy provided there.

In principle, we only process your personal data to the extent necessary to provide our content and services and if you are a registered user of our website. Your personal data will only be processed with your consent. An exception applies in cases where prior consent is not possible for factual reasons and/or the processing of your personal data is permitted by law (e.g. for the purpose of concluding or performing a contract with you).
 

1. Controller

1.1 The controller within the meaning of the Federal Act on Data Protection is JT International AG Dagmersellen (hereinafter “JTI,” “we,” “us”), Baselstrasse 65, 6252 Dagmersellen, Switzerland. As the controller, JTI determines the purposes and means of processing your personal data and is responsible for your personal data being processed in accordance with this Privacy Policy.

1.2 If you have any questions about data protection and the processing of your personal data, you can contact the controller at the following email address: [email protected].
 

2. Personal data processed

2.1 We primarily process personal data that you provide to us when registering and using this website (e.g. participating in contests, announcing your preferences) or that you provide to us by email, post or other means.

2.2 We also process personal data that we receive about you from third parties. This includes personal data that we receive from our platform providers (e.g. hosting providers) and their affiliated third parties. It also includes personal data that you provide to us on other platforms (e.g. winston.ch or camel.ch) that we operate. In addition it includes personal data that we receive from third parties commissioned by us who provide services to us, e.g. payment service providers, courier services, sales outlets, age verification service providers, technical service providers and market research providers.

2.3 The following categories of personal data may be processed by us:
 

• Contact information (e.g. email address, phone number home address)
• User account data (e.g. account opening date, account number)
• Commercial information (e.g. purchasing trends)
• Personal identification (e.g. date of birth, first name)
• Browsing information (e.g. website history, browsing time)
• Official data (e.g. scan of ID card, passport or driver’s license)
• Education and skills (e.g. language)
• Employment data (e.g. complaints)
• Sensory and electronic information (e.g. visual information such as profile pictures)
• Biometric data (e.g. facial recognition), see section 2.4

2.4 If you would like to perform an age verification using an official ID, please note that you will need to take photos of one of your official IDs (ID, passport, driving licence) and scan your face to capture your biometric data. Age verification is carried out on behalf of JTI by an external IT service provider, Veriff OÜ, a limited liability company entered in the Estonian Commercial Register (registration number: 12932944). The data we collect is primarily used for age verification. In addition, Veriff OÜ becomes the controller of your data provided during the age verification process to the extent necessary to demonstrate compliance with the regulations applicable to Veriff OÜ and to further develop, test, improve and modify the functionality of the age verification process, machine learning (data annotation for testing and training), fraud prevention and detection, and to create anonymised or anonymised and aggregated statistical reports and research. For the avoidance of doubt, we expressly draw your attention to the fact that Veriff OÜ does not use your personal data for marketing purposes. You expressly agree to this data processing. Veriff OÜ’s Privacy Notice is available at https://www.veriff.com/privacy-notice.
 

3. Processing purposes

3.1 We use and process your personal data primarily to contact you, present our offers to you and to promote customer loyalty and engagement for and on Ploom.ch. In detail, your personal data is used for the following purposes:
 

• To comply with legal obligations, such as verifying your age, and to ensure that our offers and products are available only to persons of legal age;
• To fulfil our contractual obligations to you as a buyer of our products (i.e. order processing, etc.);
• To provide sales and service-related services, such as dealing with your enquiries or complaints, general customer services, etc.;
• To market our products (Ploom and others) and other offers via email, push messages, social media, direct mailing shots (e.g. letters), etc.;
• To analyse your interests, preferences, etc. (profiling) in order to offer you a personalised experience (e.g. on the website, in the newsletters);
• To be able to offer and manage our customer loyalty programme;
• To carry out market research and organise and conduct opinion polls and invite you to take part in them;
• To develop and implement marketing strategies and campaigns;
• To analyse our business strategies, improve our products and develop and launch new products;
• To identify you over the different platforms we operate (e.g. winston.ch or camel.ch) and merge the personal data in order to better fulfil the above purposes.
   

4. Recipients of personal data and transfer abroad

4.1 JTI ensures that only those employees of JTI who need to process your personal data in order to fulfil the purposes for which it was collected have access to it.

4.2 In some cases, we may appoint third parties to provide us with the technical and/or organisational services we need to carry out our business activities. In this context, these third parties may process your personal data. Third parties appointed are, in particular, the following categories of data recipients:
 

• Companies within the JTI Group;
• Service providers who assist us in providing you with our products and offers, conducting our business activities and/or complying with our legal obligations (e.g. hosting providers, age verification services, email delivery providers, market research service providers);
• Business partners and suppliers who support us in fulfilling our contractual obligations (e.g. sellers of our products, advertising agencies, courier services).

4.3 The third parties that process your personal data are contractually obliged to process it solely on our behalf and in accordance with our instructions. We also oblige the third parties to comply with technical and organisational measures that ensure your personal data is protected in accordance with the applicable data protection regulations.

4.4 By consenting to this Privacy Policy you expressly agree that your personal data may be disclosed to the countries listed herein. Irrespective of your consent, in the event of disclosure to these countries we will always ensure that appropriate data protection is guaranteed for disclosure and processing, or that disclosure is absolutely necessary. In particular, this is ensured in the following ways:
 

• The FDPIC or the Federal Council has certified that the state can provide adequate protection; and/or
• Standard data protection clauses approved, issued or recognised by the FDPIC in advance are agreed; and/or
• Disclosure is directly related to the conclusion or processing of a contract between us and you or between us and one of our service providers in your interest.

4.5 Your personal data is currently processed in the following countries:
 

• Switzerland;
• EU and EEA countries;
• The USA.

4.6 If your personal data is disclosed to other countries, we will notify you in advance in the Privacy Policy. Disclosure of your personal data to other countries within the European Economic Area is an exception to such prior notification. This is provided that the FDPIC or the Federal Council has certified the countries in question provide an adequate level of data protection.
 

5. Marketing communication and Market Research

5.1 For marketing purposes, we will only contact you electronically or by post. You can change your marketing communication preferences at any time in your user profile. Please note that not all marketing communication channels may be visible in your user profile. If a method is not visible in your user profile, please let us know by emailing [email protected] if you wish to unsubscribe. Please note that it may take up to 30 days to register or unsubscribe from individual marketing communications. The reason for this is that your personal data may already be included in an upcoming distribution and cannot be removed from it individually.

5.2   For market research purposes, we will only contact you through the means made available to us in your user profile. You can change your market research preferences at any time in your user profile. Please note that not all market research communication channels may be visible in your user profile. If a method is not visible in your user profile, please let us know by emailing [email protected] if you wish to unsubscribe. Please note that it may take up to 30 days to register or unsubscribe from individual market research communications. The reason for this is that your personal data may already be included in an upcoming distribution and cannot be removed from it individually.

6. Links and online services from third parties

6.1 Our website and other online services (e.g. via apps) may contain links to websites and other online services (e.g. apps) of third parties over whose content we have no or only partial influence. The providers or operators of such websites and online services are solely responsible for their content. The use of such websites and online services is at your sole risk and in accordance with the terms of use or privacy policies of the provider or operator in question. We do not assume any liability for the content of such websites and online services or for the processing of your personal data, over which we have no control.
 

7. Retention period of personal data

7.1 Your personal data is generally kept for as long as you are a registered and active user of ploom.ch.

7.2 You can delete your user account at any time. Once you have asked for your user account to be deleted, your personal data will be completely anonymised within 28 days. This means we are unable to draw any conclusions about you as a person. Data we are required to retain due to legal obligations is not deleted. In particular, this includes data in connection with an order. This data is anonymised once the statutory retention period has expired.

7.3 If you do not log into your user account for two years, we will delete it and anonymise your personal data. This does not apply to data that we are obliged to retain due to legal obligations (see previous paragraph). Before deletion takes place, we will notify you by email.
 

8. Data security

8.1 We take technical and organisational measures to ensure that your personal data is protected against unauthorised and/or unlawful loss, alteration, disclosure or access – and contractually obligate all of our recipients of your personal data to do so too. Please note that it is unfortunately not possible to guarantee complete security when transferring personal data and information in general over the Internet or by other electronic means.
 

9. Rights

9.1 You may exercise any rights you may have under the Swiss Data Protection Act at any time. In particular, you have the right to obtain information about your stored personal data, to correct or supplement it, object to it being processed or request it be deleted at any time.

9.2 You can request the deletion of your personal data, object to the use of your personal data for marketing communication purposes and make certain corrections to your personal data yourself at any time in your user profile. For all further inquiries or exercise of rights, you can contact us at any time at the following email address: [email protected]

9.3 Where Veriff OÜ processes data as a controller (see section 2.4), the contact information for further enquiries or to exercise your rights may be found in that company’s privacy notice (available at https://www.veriff.com/privacy-notice).

9.4 Please note that the rights mentioned in section 9.1 may be restricted or excluded in individual cases, e.g. if there are doubts about your identity or this is necessary to protect other people, protect legitimate interests or comply with legal obligations. Please also note that we reserve the right to request a copy of your passport or other identification document in cases of doubt.
 

10. Amendments to the Privacy Policy

10.1 We reserve the right to change, supplement, amend or otherwise update this Privacy Policy at any time. Amendments are published on the website. Amendments apply from the time they are published on the website. This does not apply to amendments for which we ask for your consent. These only apply from the time you give your consent.

Dagmersellen, February 2024