legal
Privacy policy.
What we collect, why, who sees it and what you can ask of us, in plain words.
1. Who we are
Swiss Impact Store is operated by My Source Sàrl, Rue des Fontenailles 13, 1007 Lausanne, Switzerland (UID CHE-438.548.082), referred to as “we” or “us”. We are responsible for the personal data processed through swissimpactstore.com, unless this policy says otherwise.
For any question about your data or to exercise your rights, write to [email protected].
2. What we collect and why
We only collect what we need to run the shop, the Collective and our communication with you.
- Orders: name, delivery and billing address, email, phone number, the items you buy and your order history, including gift cards and digital guides. To process your order, pass it to the brand that ships it, handle returns and claims, and keep our accounts.
- Customs store credit: the customs receipt you send us. To issue your store credit.
- Your account: login details and the information you save in your account. To let you track orders and check out faster.
- Payments: handled entirely by Stripe. We never see or store your full card details.
- Messages: what you send us by email or through the contact form. To answer you and resolve any issue with an order.
- Newsletter: your email address, if you subscribe. To send our newsletter and offers. You can unsubscribe at any time with the link in every email.
- The Collective: your membership details (start date, plan, status, payments) and access logs. To create your personal password, give you access to the members’ area, send you membership emails and detect password sharing.
- Brands: if you represent a brand, your contact details, business details and the information needed to connect your Stripe account. To onboard your brand, run our partnership and pay out your revenue.
- Website use: technical data such as your IP address, browser, device and the pages you visit. To keep the site secure and working and, with your consent, to measure visits and show relevant ads (see section 5).
3. Legal bases
Under Swiss law, and under the EU General Data Protection Regulation (GDPR) where it applies to you, we process your data:
- to fulfil a contract with you: orders, deliveries, returns, your account and your membership;
- to meet our legal obligations, for example accounting and tax records;
- on the basis of our legitimate interest in running a secure, working shop and answering your questions;
- with your consent, for the newsletter, analytics and advertising cookies. You can withdraw it at any time.
5. Data outside Switzerland
Some of the recipients above are in the EU, which Switzerland recognises as offering adequate protection. Others are in the United States. For those, we rely on the Swiss–US and EU–US Data Privacy Frameworks where the provider is certified, or on the standard contractual clauses approved by the Swiss and EU authorities.
6. Cookies and tracking
We use cookies that are necessary for the shop to work, such as your cart, your login and your cookie choices. These don’t need your consent.
With your consent, we also use:
- Analytics (Google Analytics, through Google Tag Manager), to understand how the site is used;
- Advertising (Google and Meta), to measure our campaigns and show you relevant ads on other sites.
You choose which cookies to accept in our cookie banner, and you can change your choice at any time through the cookie settings link on the site. Refusing them doesn’t affect your shopping.
7. How long we keep it
- Orders and invoices: 10 years, as required by Swiss accounting law.
- Your account: until you ask us to delete it, except data we must keep for accounting.
- Messages: as long as needed to resolve your request, then up to 2 years.
- Newsletter: until you unsubscribe.
- The Collective: for the duration of your membership and up to 24 months after it ends, for accounting and to handle any dispute.
- Brand partners: 30 days after the end of the partnership, except records we must keep by law, such as accounting records.
- Analytics and advertising data: for the period set in each tool, after which it is deleted or anonymised.
8. How we protect it
Your data is hosted in Germany in data centres certified to ISO 27001. The site runs on an encrypted connection (HTTPS), access to customer data is limited to the people who need it, and our providers are bound by confidentiality and data protection obligations.
9. Your rights
You can ask us at any time to:
- see the data we hold about you, and receive a copy;
- correct it or have it deleted;
- stop or limit certain uses, or object to them;
- withdraw any consent you’ve given.
Write to [email protected]. We’ll answer within 30 days and may ask you to confirm your identity first. For data held by a brand about an order it shipped, we’ll help you reach them.
You can also file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU, with your local data protection authority.
10. Other things to know
- Automated decisions: we don’t make decisions about you based solely on automated processing.
- Age: our shop is intended for adults. We don’t knowingly collect data from children under 16.
- Links: links to other sites, such as YouTube or a brand’s own website, are governed by their own privacy policies.
- Changes: we may update this policy. The date below shows the latest version.
11. Contact
My Source Sàrl
Swiss Impact Store
Rue des Fontenailles 13
1007 Lausanne
Switzerland
Privacy questions and requests: [email protected]
Brands: [email protected]
Last updated: 27 October 2026