Privacy policy

The controller for the processing of personal data described in this privacy policy is:

xtraqt GmbH
General-Wille-Strasse 15
8002 Zürich
Switzerland
Email: info@xtraqt.com

For questions about data protection and to exercise your rights (section 20), write to us at info@xtraqt.com or at the postal address above.

This privacy policy describes how we process personal data when you

• visit our website www.monqzi.com (German and English version),
• order in our online shop,
• contact us through a form or by email,
• sign up for the MONQZI Club or for a notification,
• buy at a MONQZI fridge, or
• work with us as a business customer (B2B).

We act in accordance with the Swiss Federal Act on Data Protection (FADP; in German: DSG). We process only the data we need for the purposes described. We do not sell personal data and we do not use order data for advertising. We do not make automated individual decisions (Art. 21 FADP).

3.1 Hosting and server logs (Cloudflare)

Our website runs on the infrastructure of Cloudflare, Inc. (USA). Cloudflare delivers the pages through its worldwide network and runs the server functions for our forms and for voting. When a page is requested, Cloudflare processes the data technically required for this, in particular your IP address, the address requested, date and time, and information about your browser and device.

For troubleshooting, Cloudflare records the requests to our server functions. These logs contain technical information about each request and response and may also contain your IP address. Cloudflare keeps them for no more than 7 days.

Cloudflare acts as our processor. For disclosure abroad, see section 17.

3.2 Visitor statistics without cookies (Cloudflare Web Analytics)

We use Cloudflare Web Analytics on all public pages. It shows us which pages are visited how often, which page visitors come from and how quickly our pages load. According to Cloudflare, this service uses neither cookies nor any other storage in your browser, does not use your IP address for "fingerprinting", and discards it at the nearest data centre without storing it. We see only aggregated statistics.

This service runs regardless of your choice in the cookie banner. You can prevent it by blocking scripts from static.cloudflareinsights.com in your browser, for example with a content blocker.

3.3 Fonts

The fonts on our website load from our own server. There is no connection to Google Fonts.

4.1 Our own entries

We store the following entries in your browser's storage (local storage or session storage). We do not use cookies for them. The entries leave your device only where stated.

You can delete these entries at any time in your browser settings. Some functions, for example the shopping cart, will then no longer work as intended.

4.2 Cookie banner and withdrawal

On your first visit, a banner asks whether we may use Google Analytics (section 5). Until you have agreed, our website loads nothing from Google. We store your choice in the entry mq-consent.

You can change your choice at any time using the "Cookie settings" link at the bottom of every page. If you withdraw your consent, we delete the Google cookies (_ga, _ga_*, _gid, _gat) in your browser and reload the page.

If you agree in the banner, we use Google Analytics 4 from Google (Google Ireland Limited, Ireland, and/or Google LLC, USA). It helps us understand how our website is used, so that we can improve it and our shop. For this, Google sets cookies in your browser (_ga and _ga_<ID>, lifetime up to 2 years) and records, among other things, the pages visited, information about your device and browser, your approximate location, and events such as "add to cart" and "begin checkout".

We have set up Google Analytics so that

• the consents for advertising purposes (ad_storage, ad_user_data, ad_personalization) are always denied. Your data is therefore not used for online advertising or personalised advertising;
• Google signals are switched off. Your visits are not linked to a Google account.

According to Google, Google Analytics does not store IP addresses of users in Switzerland; the IP address is used only to determine the approximate location and is then discarded. Google keeps data at the level of individual users and individual events for no more than 14 months, in line with the setting in our account; aggregated reports without reference to individuals may remain for longer. The data may be transferred to the USA (section 17).

You can withdraw your consent at any time (section 4.2).

Our online shop runs on Shopify (Shopify International Limited, Ireland). Shopify processes the shop data as our processor.

• Cart and prices: your browser retrieves prices and the cart directly from Shopify. Shopify thereby receives your IP address, the contents of your cart and its identifier (mq-cart).
• Order: "Checkout" takes you to Shopify's checkout. There you enter your name, email address, delivery and billing address and, where applicable, your phone number, and choose a payment method. We use this data to process your order, to send you order and shipping confirmations, to deal with queries and complaints, and to meet our statutory retention obligations.
• Customer account: a customer account is optional. You can also order as a guest.
• Cookies in the checkout: in the checkout, Shopify may set cookies that are needed for the ordering process. Details are in Shopify's cookie policy: shopify.com/legal/cookies.
• No tracking: no tracking pixels, no customer events and no marketing apps are set up in our shop. We do not ask for consent to email or SMS marketing in the checkout.

In certain cases, Shopify also processes data under its own responsibility. Shopify explains this in its privacy policy for buyers: shopify.com/legal/privacy/consumers.

In the online shop you can pay with TWINT, Visa, Mastercard, Apple Pay and Google Pay (through Shopify Payments) and with PayPal. You enter your full card details directly in the checkout; we do not receive or store them.

• Shopify Payments: Shopify uses one or more payment processors. For Switzerland, Shopify names Stripe Payments Europe, Limited (Ireland), PayPal Pte. Ltd. (Singapore) and Adyen N.V. (Netherlands). They may also process data under their own responsibility, for example to meet legal anti-money-laundering obligations.
• TWINT: if you pay with TWINT, TWINT AG (Zürich) or the bank that issues your TWINT app also processes your data under its own responsibility.
• Apple Pay and Google Pay: the terms and privacy provisions of Apple or Google also apply to your wallet.
• PayPal: if you choose PayPal, you are redirected to PayPal. The controller is the PayPal company of your country of residence; for persons resident in Switzerland, this is PayPal Pte. Ltd. in Singapore. PayPal processes your data under its own responsibility and according to its own terms: paypal.com/ch/legalhub/paypal/privacy-full.

For delivery, we give Swiss Post your name, your delivery address and, where needed for delivery, your phone number or email address. Swiss Post processes this data under its own responsibility. If we use another carrier for larger quantities, we will add it to this privacy policy.

In the Aargau and Zürich region, we sometimes deliver in person. In that case, we do not pass any data to third parties.

At some locations, we place a MONQZI fridge at partner businesses.

• If we sell ourselves, the payment method is shown on the fridge; normally you pay with TWINT using a QR code of xtraqt GmbH. We receive the payment details we need for accounting, for example amount, time and transaction number. TWINT AG or the bank that issues your TWINT app processes your data under its own responsibility.
• If the partner business sells the products itself, it is responsible for the data processing at the time of purchase. We then receive no data about you.

If you write to us using the contact form (name, email address, message) or the B2B form (company, first and last name, email address, phone, quantity requested, type of business, message), we use your details to answer your enquiry and, where applicable, to make you an offer. This is how it works:

1. 1. Your details are stored in our database at Cloudflare (Cloudflare D1, storage location European Union).
2. 2. Our email delivery service Resend (Plus Five Five, Inc., USA) forwards them as an email to our mailbox info@monqzi.com. Your email address is set as the reply-to address so that we can answer you directly. Resend stores the emails it sends in the USA.
3. 3. Our mailbox is run on Google Workspace (section 11).

In addition, our website sends an internal summary to info@monqzi.com every Monday, which may contain details from enquiries.

We keep enquiries in the database and in our mailbox for no more than 2 years. If an enquiry leads to a contract, we keep the documents required for it in the same way as orders and invoices (section 18).

We run our mailboxes info@monqzi.com and info@xtraqt.com and our document storage on Google Workspace (Google Cloud EMEA Limited, Ireland). Google processes the emails and documents as our processor and may also process them outside Switzerland and the European Economic Area (EEA), in particular in the USA.

With business customers, we process the contact details of the contact persons (for example name, business email address and phone number) and the details of offers, orders, deliveries and invoices. We also accept orders by email or phone. We create some invoices with the bexio software (bexio AG, Rapperswil, Switzerland). According to bexio, the data is processed in Switzerland or in the EEA.

You can sign up with your email address

• for the MONQZI Club (on the home page and on the /qr page): you will then receive emails from MONQZI;
• for a Lab notification: we let you know by email as soon as the product you chose is available.

Process: we first store your sign-up (email address, list, source, time, delivery status and, where applicable, an error message) in our database at Cloudflare (storage location European Union) and pass it on to MailerLite. MailerLite sends you an email in which you confirm your sign-up (double opt-in). You receive emails from us only after you have confirmed. MailerLite may store the time and IP address of the sign-up and of the confirmation as evidence. We delete the sign-up from our own database 30 days after it has been passed to MailerLite successfully; if it cannot be passed on, we delete it 30 days after the sign-up.

Analysis: with MailerLite, we analyse whether our emails are opened and which links in them are clicked. MailerLite records your IP address and derives your approximate location from it. This shows us which content is of interest.

Unsubscribing: you can unsubscribe at any time using the link in every email or by emailing info@xtraqt.com. After that, we keep your address only as unsubscribed, so that we can respect your unsubscription and prove your earlier consent. A sign-up only for a Lab notification is deleted once we have told you that the product is available.

Provider: MailerLite (MailerLite Limited, Ireland, and MailerLite, Inc., USA). According to MailerLite, the data is stored in data centres in Germany and the Netherlands. For disclosure abroad, see section 17.

In the Lab, you can vote for products that do not exist yet. For this, we store in our database at Cloudflare (storage location European Union) the product chosen, the time, the random identifier from your browser (mq-voter) and a salted hash of your IP address. A salted hash is a checksum that cannot be read directly; we do not store your IP address itself. The identifier and the hash serve only to prevent multiple votes. We delete them no later than 24 months after you voted; after that, we count the vote only anonymously.

On the /qr page you can answer four short questions with predefined answers. We store only your answers and the time, without an email address and without an IP address, and we do not link them to you. If you also choose to join the MONQZI Club, section 12 applies; your email address is not stored together with your answers.

Our forms for contact, B2B enquiries, sign-ups and feedback are protected by Cloudflare Turnstile. Turnstile loads only when you use a form. According to Cloudflare, Cloudflare receives, among other things, your IP address, technical characteristics of your connection (TLS fingerprint), your browser type (user agent) and the website on which the form is embedded. Cloudflare uses this data on our behalf to detect automated requests, and under its own responsibility to improve its own bot detection. Details: cloudflare.com/turnstile-privacy-policy.

We also limit the number of form submissions per hour. For this, we store a hash of your IP address, the form used and the time. We delete these entries automatically after 24 hours.

The /intern area is accessible only to our team. Login is by a one-time code sent to info@monqzi.com. The area shows analyses and allows the contact and B2B enquiries, including personal data, to be exported as a CSV file. We use exported files internally only and delete them as soon as we no longer need them. For the login we use a technically necessary cookie (__Host-mq_intern, 30 days) and an entry in local storage (mq-intern-days). No analytics run in the team area.

We pass personal data only to the following recipients, and only where needed for the purposes described:

Notes: the Swiss Federal Council has found that the states of the European Economic Area and Canada (private sector) provide adequate data protection (Annex 1 to the Data Protection Ordinance). For the USA, this applies only to companies certified under the Swiss-U.S. Data Privacy Framework. Where no such certification exists, the disclosure is based on standard data protection clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) (Art. 16(2)(d) FADP) or on binding corporate rules (Art. 16(2)(e) FADP). Singapore does not provide adequate data protection; disclosure there takes place in direct connection with the performance of your purchase contract (Art. 17(1)(b) FADP) or on the basis of contractual safeguards. You can ask us for a copy of the safeguards (section 1).

We keep personal data only for as long as we need it for the relevant purpose or are required by law to keep it. After that, we delete or anonymise it.

We protect personal data with appropriate technical and organisational measures. Our website transmits data in encrypted form (HTTPS). In our database, we store IP addresses only as hashes. The team area is protected by one-time codes; we store codes and sessions only as hashes. Full card details never reach us.

Under the FADP you have, in particular, the right to

• ask whether and which personal data about you we process (Art. 25 FADP). This information is free of charge and is normally provided within 30 days;
• receive or have transferred the personal data you have given us, in a common electronic format (Art. 28 FADP);
• have incorrect personal data corrected;
• have your personal data deleted, or have a specific processing or disclosure prohibited (Art. 32 FADP), unless a statutory retention obligation applies;
• object to processing;
• withdraw any consent you have given at any time with effect for the future, for example via the "Cookie settings" or the unsubscribe link in our emails.

To do so, write to us at info@xtraqt.com or at the address in section 1. We may ask you to prove your identity. You can also contact the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch.

We publish selected feedback from customers on our website. We transfer it by hand and publish it only with the consent of the person concerned and only with the details they have agreed to, for example their first name. You can withdraw your consent at any time; we will then remove the feedback.

We update this privacy policy when our data processing changes. The version published on our website applies. This privacy policy is available in German and in English. If the two versions differ, the German version prevails.