This privacy statement applies to Pamboo. Should there be any inconsistency between this data protection statement and any other applicable contract or the general terms and conditions of Pamboo, the provisions of this data protection statement will prevail.
Data protection is of high importance for us at Pamboo, which operates pamboo.ch, pamboo.de, pamboo.eu. This privacy statement has been prepared to explain the nature, extent and purpose of processing of personal data within our online services and associated web pages, functions and is inline with EU’s General Data Protection Regulations (GDPR). It also shows how personal data is handled in Pamboo. As the controller, Pamboo has implemented organisational and technical measures to ensure compliance with GDPR regulations and the most complete protection of personal data (see a) Personal data) processed through this website. However, there is always a remaining risk to transmit data on the Internet.
Pamboo is a registered Swiss brand for sustainable kids’ and baby fashion. Pamboo was founded in 2015 by the textile designer Anna Warth. Anna was inspired by her own motherhood and her positive experience with natural cotton. Based on her knowledge after graduating from the Swiss Textile College STF and her focus on sustainability and comfort, Anna launched the unique collections of Pamboo.
The term ‘personal data’ is the entryway to the application of the General Data Protection Regulation (GDPR). Personal data is any information which is related to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
A data subject is any identified or identifiable natural person whose personal data are processed by the person responsible for the processing.
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
The controller or person responsible for the processing means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. If the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
The processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
A third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data concerning him or her
The responsible body for the processing of personal data within the meaning of the EU General Data Protection Regulation and other data protection provisions is:
8853 Lachen, Schweiz
The privacy statement covers both historical and future personal data. If you agree to your data being processed, we will process not only personal data collected by you in the future in accordance with this privacy statement, but also your personal data that we already have on file. This also applies in particular to personal data which we have collected and processed until the relaunch of this web shop.
Pamboo processes personal data on the following legal bases:
Many processing activities for personal data are carried out in Pamboo on the basis of voluntary declarations of consent by the respective data subjects, e.g. the dispatch of newsletters or the requested notification about news patterns. The legal basis for processing activities for which we obtain consent for a particular processing purpose is Article 6 (1) a) GDPR.
If the processing of personal data is necessary to perform a contract, the processing is on the basis of Article 6 (1) b) GDPR. The same applies to such processing activities that are necessary to perform pre-contractual measures, such as in cases of enquiries about our products or services.
If Pamboo is subject to a legal obligation requiring processing of personal data, the processing is on the basis of Article 6 (1c) of the GDPR.
In rare cases, the processing of personal data may be necessary in order to protect the vital interests of the data subject or of another natural person, e.g. if you need help as a customer or visitor to Pamboo. The processing is then based on Article 6 (1d) of the GDPR.
If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Pamboo, then the processing is on the basis of Article 6 (1) e) GDPR.
Processing activities may be carried out on the basis of Article 6 (1) f) GDPR. This is the legal basis for processing activities not covered by the previous legal bases, where processing is necessary for the purposes of the legitimate interests pursued by Pamboo or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Before any processing, the existence of a legitimate interest will be particularly carefully considered in individual cases.
We process your personal data for a variety of purposes. These purposes can be summarised in different groups. In particular, we may process all or some of your personal data for one or more of the following purposes:
As a data controller, we collect a variety of data in order to deliver our services. We have provided further detail below about the specific types of data we collect and our reasons for doing so. We collect your personal data whenever we are in contact with you. There are many kinds of situations in which we are in contact with you. For example, we collect your personal data under the following circumstances:
Visiting our website
Examples of information we collect and analyze include:
Examples of information we collect and analyze include:
Information about our customers is an important part of our business and we are not in the business of selling our customers’ personal information to others.
As we continue to develop our business, we might sell or buy other businesses. In such transactions, customer information generally is one of the transferred business assets but remains subject to the promises made in any pre-existing Privacy Notice (unless, of course, the customer consents otherwise). Also, in the unlikely event that Pamboo is acquired, customer information will of course be one of the transferred assets.
We release accounts and other personal information when we believe release is appropriate to comply with the law; enforce or apply our Terms and Conditions and other agreements; or protect the rights, property, or safety of Pamboo, our users, or others. This includes exchanging information with other companies and organisations for fraud protection and credit risk reduction.
We may also pass your personal data on to third parties in order to make use of technical or organisational services which we need to meet the purposes specified or for our other business activities. Our service providers are contractually bound to process personal data exclusively on our behalf and in accordance with our instructions. We also oblige our service providers to comply with technical and organisational measures which guarantee the protection of personal data. If the service providers are located in countries where the applicable laws do not provide any protection of personal data that is comparable with that provided by Swiss law, we will ensure by contract that the service providers concerned maintain the GDPR (and Swiss) level of data protection.
The Pamboo shop relies on third-party service providers, which perform a variety of services on our behalf. Such services are the processing of payment transactions, the shipping of our products (e.g. Swiss Post) or the hosting of our data. Personal information is shared with the following third-parties:
It might be necessary to transfer and process data to providers / countries outside of the European Union.
Other than as set out above, you will receive notice when personal information about you might be shared with third parties and you will have an opportunity to choose not to share the information.
When a data subject or automated system calls up any website owned by Pamboo, the data is stored in the server logs for 3 month and offline for 12 month. Collected may be (1) name, (2) email address, (3) locations, (4) the browser types and versions used, (5) the operating system used by the accessing system, (6) the website from which an accessing system reaches our website (so-called referrers), (7) the sub-websites, (8) the date and time of access to the Internet site, (9) an Internet protocol address (IP address), (10) the Internet service provider of the accessing system, and (11) any other similar data, meta/communication data (i.e. http status code) and information that may be used in the event of attacks on our information technology systems.
You have the right to information about your personal data that we process. If you do not make requests for information in writing, please bear in mind that we might ask you to provide proof that you are who you claim to be. You have:
Furthermore, in accordance with legal requirements, you have the right to object to us processing your data. You also have the right of data portability.
Also, you can access your information, including your name, address, profile information, newsletter signup, and purchase history in the “My Account” section of the website. In the “My Account > GDPR Tools” section you can export the data we stored and use for a better experience in our store.
You have the right to lodge a complaint about the processing of your personal data by us to a supervisory authority for data protection.
Cookies are used to make our online store overall more user-friendly and effective, e.g. by making the navigation and use of our website more user-friendly and by storing user preferences. Cookies are also used to analyze and evaluate the use of our offer in aggregated form, which allows us to optimize the design of our website.
Cookies are also used to display advertising based on your interests, e.g. also on other websites, and to measure the success of our advertising.
The individual cookies and tools used by us and the possibility of withdrawing your consent at any time by changing your cookie settings in our cookie banner, you can also deactivate the option for storing cookies in the system settings of your browser and delete existing cookies at any time.
In addition, you can manage your preferences in connection with usage- or interest-based advertising for many third-party providers who manage usage data on behalf of website operators for the display and analysis of interest-based advertising under the following platform and either disable or enable all or individual providers: https://www.youronlinechoices.com/de/praferenzmanagement/.
Pamboo gives the opportunity to subscribe and receive our Pamboo newsletter. If the user agrees we store the IP address of the source computer and the date and time of the registration and we may contact the user:
with relevant news pattern for his selection
with offers and information about Pamboo’s products, services and news
to attend a customer research to improve our services
A user can unsubscribe on the “My Account” settings page. In addition, newsletters can be canceled by submitting the corresponding unsubscribe link in every newsletter.
Newsletters contain tracking pixels to enable log file recording and analysis. This allows a statistical analysis of communication campaigns.
It is possible to contact Pamboo by email using the email address on https://Pamboo.com/, the data provided (such as name, first name, address) and at least email address will be stored, as well as the information contained in the email including any personal data provided by the user for the purpose of making contact and processing his query.
In addition, the following data is collected by the system:
If the contact form is used for communication, the user is required to provide his first and last name and his email address. Without this information, the issue raised by a user using the contact form cannot be processed. Providing the postal address is optional and makes it possible to process an issue by post, if requested.
In addition, the following data is collected by the system:
The processing of the data sent with the contact form and the content, which may also contain personal data provided by the user, is carried out on the basis of Article 6 (1) e) or (1) f) GDPR, for the purpose of processing the user’s query.
In order to constantly improve and optimise our Internet offering, we use what are known as tracking technologies. Web analysis tools provide us with statistics and graphics which provide us with information about the use of our websites. This involves data about the use of a website being transferred to the server used. Depending on the provider of a web analysis tool, these servers may be located abroad. For the most frequently used web analysis tool, Google Analytics, these data are transferred including shortened IP addresses, which prevents the identification of individual devices. Google complies with the data protection rules of the "Swiss-U.S. Privacy ShieldFramework" and is registered with the “Swiss-U.S. Privacy Shield” program of the US Department of Commerce (Information about the “Swiss-U.S. Privacy Shield” can be found under https://www.privacyshield.gov/Swiss-US-Privacy-Shield-FAQs). The IP address transmitted by your browser within the framework of Google Analytics will not be merged with other Google data. Transfer of these data by Google to third parties can only take place on the basis of legal regulations or as part of the order data processing.
You may prevent the recording of the data generated by cookies and relating to your use of the website (incl. your IP address) at Google, as well as the processing of these data by Google, by downloading and installing the browser plugin available under the following link (http://tools.google.com/dlpage/gaoptout?hl=de) You will find more detailed information about Google Analytics and data protection at http://tools.google.com/dlpage/gaoptout?hl=de or http://www.google.com/intl/de/analytics/privacyoverview.html.
Our primary goal is to ensure that our website is as protected and secure as possible for you and for us. To ensure this, we use Google reCAPTCHA V3 from Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA). With reCAPTCHA, we can determine whether you really are a flesh-and-blood human being and not a robot or other spam software. By spam we mean any unsolicited information sent to us electronically.
What is reCAPTCHA?
The following list examples of collected browser and user data that are processed by Google.
Why do we use reCAPTCHA on our website?
We want to welcome only flesh and blood people on our site. Bots or spam software of any kind may safely stay at home. That's why we pull out all the stops to protect ourselves and offer the best possible user experience for you. For this reason we use Google reCAPTCHA from Google. This way we can be pretty sure that we remain a "bot-free" website. By using reCAPTCHA, data is transmitted to Google, which Google uses to determine whether you are actually a human being. reCAPTCHA therefore serves the security of our website and, by extension, your security. For example, without reCAPTCHA it could happen that a bot registers as many e-mail addresses as possible during registration in order to "spam" forums or blogs with unwanted advertising content. Spam bots could try to guess the e-mail addresses of our customers, e.g. with the password forgotten page. With reCAPTCHA we can avoid such bot attacks.
On this website, the controller has integrated components of YouTube. YouTube is an Internet video portal that enables video publishers to set video clips and other users free of charge, which also provides free viewing, review and commenting on them. YouTube allows you to publish all kinds of videos, so you can access both full movies and TV broadcasts, as well as music videos, trailers, and videos made by users via the Internet portal.
The operating company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, UNITED STATES. The YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, UNITED STATES.
With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a YouTube component (YouTube video) was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding YouTube component. Further information about YouTube may be obtained under https://www.youtube.com/about/. During the course of this technical procedure, YouTube and Google gain knowledge of what specific sub-page of our website was visited by the data subject.
If the data subject is logged in on YouTube, YouTube recognizes with each call-up to a sub-page that contains a YouTube video, which specific sub-page of our Internet site was visited by the data subject. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.
YouTube and Google will receive information through the YouTube component that the data subject has visited our website, if the data subject at the time of the call to our website is logged in on YouTube; this occurs regardless of whether the person clicks on a YouTube video or not. If such a transmission of this information to YouTube and Google is not desirable for the data subject, the delivery may be prevented if the data subject logs off from their own YouTube account before a call-up to our website is made.
YouTube’s data protection provisions, available at https://www.youtube.com/t/terms and https://policies.google.com/privacy?hl=en, provide information about the collection, processing and use of personal data by YouTube and Google.
Pamboo takes precautions to protect the data and collects only data that is required to offer our service. Pamboo does not store credit card information on its website. We transmit sensitive information to us in a secure way by using Secure Socket Layer (SSL), which encrypts information you input. A user can verify this by looking for a lock icon in the address bar and looking for “https” at the beginning of the address of our website. Passwords to authenticate the user to use our service are stored in an encrypted (+ salted) form.
It is important for you to protect against unauthorised access to your password and to your computers, devices, and applications. Be sure to sign off when you finish using a shared computer.
Our pages use functions from CloudFlare. The provider is CloudFlare, Inc. 665 3rd St. #200, San Francisco, CA 94107, USA. CloudFlare offers a worldwide distributed content delivery network with DNS. Technically, the transfer of information between your browser and our website is routed through CloudFlare's network. CloudFlare is thus able to analyze the data traffic between users and our websites, for example, to detect and prevent attacks on our services. In addition, CloudFlare may store cookies on your computer for optimization and analysis. This serves to protect our legitimate interests in an optimal marketing of our offer, which prevail in the context of a balancing of interests, in accordance with Art. 6 (1) p. 1 lit. b DSGVO.
We have concluded a corresponding order processing agreement with Cloudflare based on the DSGVO. Cloudflare is a certified participant of the EU-US Privacy Shield Framework. Cloudflare has committed to handle all personal data contained by European Union (EU) member states under the Privacy Shield Framework in accordance with its applicable principles. For more information about the Privacy Shield Framework, please visit the U.S. Department of Commerce's Privacy Shield List at https://www.privacyshield.gov. Cloudflare collects statistical data about visits to this website. Access data includes: Name of the accessed website, file, date and time of access, amount of data transferred, notification of successful access, browser type along with version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider. Cloudflare uses the log data for statistical evaluations for the purpose of operation, security and optimization of the offer.
Here you can find information about the data collected there and about security & privacy at CloudFlare
Pamboo doesn't sell products for purchase by children. We sell children's products for purchase by adults. If you're under 18, you may use Pamboo only with the involvement of a parent or guardian.
We maintain an online presence on social networks and platforms in order to communicate with our customers, interested parties, and users and to inform them about our products. We use Facebook, Youtube, Pinterest, and Instagram, among others. When visiting each of these platforms, you as a user agree to the terms and conditions and the data processing guidelines of the corresponding operator.
Unless stated otherwise in our data privacy notice, we process user data if users communicate with us on these social networks and platforms, e.g. publish posts on our pages or send us messages.
We at Pamboo process users' data only when it is in the customer's legitimate interest for us to do so in accordance with Art. 6, (1) lit. b GDPR. As a company, we have a legal right to obtain general customer information to use in customer accounts. We also use customers' data for communication purposes. If any of the providers below request users for consent for processing their data, the legal basis for data processing is Art. 6 para. 1 lit. a. GDPR.
Pamboo is present on the following networks: