Privacy Policy

Serious about your privacy? We are too!!! Check out our privacy policy to feel safe about this policy.

1. Who is responsible

Madame Sum AG, Holunderweg 4, 8704 Herrliberg, Switzerland, registered in the Commercial Register of the Canton of Zurich under number CHE-145.907.138, is the controller of the personal data described in this Privacy Policy.

For any question about this Privacy Policy or about how we process your personal data, please contact us at support@madamesum.ch or at the postal address above.

2. Scope

This Privacy Policy explains how we process personal data when you visit our websites www.madamesum.com and www.madamesum.ch, place an order in our online shop, contact us, subscribe to our communications, join the Dumpling Addict Club, engage us as a business client, book a catering or event service, or apply for a position with us.

It does not cover the processing of personal data by third parties whose services you use in connection with ours, such as payment providers acting as their own controllers, or the operators of physical points of sale at which our products are sold. Those parties process your data under their own privacy notices.

We process personal data in accordance with the Swiss Federal Act on Data Protection of 25 September 2020 (FADP) and its implementing ordinance. Where the EU General Data Protection Regulation applies to a particular processing activity, we comply with it in addition.

3. What personal data we process

3.1 Data you provide

Identification and contact data: title, first and last name, email address, postal address, telephone number and, for business customers, company name, function, VAT or UID number.
Order and delivery data: products ordered, order value, delivery address and access details, chosen delivery date and time slot, delivery instructions, order history.
Payment data: the payment method chosen, invoicing details, and the payment status. We do not receive or store your full card details; card data is processed directly by our payment provider.
Communications: the content of your enquiries, complaints, and correspondence with our customer service, and any documentation you provide in support of a complaint.
Preferences: dietary requirements and allergy information you communicate to us, marketing preferences, survey responses and product feedback.
Account and Club data: account credentials in encrypted form, membership tier, points balance and transactions.
Application data: where you apply for a position, your CV and the information contained in it, including education and professional history.

3.2 Data collected automatically

Technical data: IP address, device type, operating system, browser type and language, screen settings, referring website, pages visited, time and duration of visits.
Approximate location derived from your IP address, at the level of city or region. We do not collect precise location data.
Cookies and comparable technologies, as described in clause 8.

3.3 Data from third parties

From payment and credit providers: confirmation of payment, payment status, and the outcome of a creditworthiness check where you select payment by invoice or instalment.
From logistics providers: delivery status and proof of delivery.
From partner platforms: where you purchase a voucher or deal from a third-party platform, the data required to identify and redeem it.
From publicly accessible sources such as the Commercial Register, for the verification of business customers.

4. Why we process personal data

We process personal data for the following purposes:

To conclude and perform contracts with you: processing and delivering your order, providing catering and event services, handling payment, and dealing with complaints and warranty matters.
To manage your customer account and the Dumpling Addict Club, including the calculation and redemption of points.
To communicate with you about your order and to respond to your enquiries.
To send you marketing communications, as described in clause 7.
To operate, secure, analyse and improve our websites and our product range.
To prevent and detect misuse, fraud and abuse of accounts, vouchers and promotional codes, and to assess creditworthiness where you choose to pay by invoice.
To comply with our legal obligations, in particular under accounting, tax and food law, including traceability and product recall obligations.
To establish, exercise or defend legal claims.
To assess applications for employment.

5. On what basis we process personal data

Under Swiss data protection law, we may process personal data where the processing does not unlawfully infringe your personality rights. In practice we process your data because it is necessary to perform a contract with you, because we have a legitimate interest in doing so, because a legal obligation requires it, or because you have consented.

Where the EU General Data Protection Regulation applies, our legal bases are Art. 6(1)(b) GDPR for processing necessary to perform a contract, Art. 6(1)(c) GDPR for compliance with a legal obligation, Art. 6(1)(f) GDPR for our legitimate interests in operating and securing our business, preventing misuse and marketing our own products, and Art. 6(1)(a) GDPR where you have given consent.

Where processing is based on your consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Information about allergies and dietary requirements may reveal information about your health. We process such information only where you provide it to us and only in order to prepare and deliver your order or to serve you at an event safely, and we do not use it for any other purpose.

6. Who receives personal data

We do not sell personal data. We disclose personal data to the following recipients, and only to the extent necessary:

Metanet AG, Switzerland, which hosts our websites and our online shop and therefore stores the data processed through them on our behalf.
Swiss Post and other logistics providers, in order to deliver your order and to notify you of its dispatch and delivery.
Datatrans AG, Switzerland, which processes card payments made in our online shop.
Cembrapay AG, Switzerland, and Klarna Bank AB, Sweden, where you select payment by invoice or instalment. These providers process your data as their own controllers under their own privacy notices, and may carry out a creditworthiness assessment as described in clause 9.
Intuit Mailchimp, United States, which sends our email communications and processes the associated delivery and interaction data.
Providers of website analytics and advertising services, as described in clause 8.
Our IT service providers, where they require access to our systems in order to maintain and support them.
Our professional advisers, in particular auditors, lawyers, tax advisers and insurers, where necessary.
Debt collection agencies and the competent authorities, where an invoice remains unpaid.
Public authorities, where we are required to disclose data by law, in particular the food safety authorities in the event of a product withdrawal or recall.

Our online shop runs on the Sylius e-commerce software and our website on the Contao content management system. These are software applications operated on infrastructure hosted for us in Switzerland; their publishers do not receive personal data from us.

Service providers acting on our behalf process personal data as processors, on our instructions and under a written agreement that obliges them to protect the data and to process it only for the purposes we have specified.

If our business, or a part of it, is transferred to another owner, personal data relating to that part may be transferred with it. The recipient may use that data only for the purposes for which it was originally collected.

7. Marketing communications

Where you have not objected, we may send you information about our products, offers, recipes and events by email and, where you have provided the relevant contact details, by SMS, by messaging services such as WhatsApp and by post. At checkout, a separate field is displayed in which you can decline these communications; declining has no effect on your order.

Where a messaging service or channel requires separate express consent before marketing messages may be sent, we obtain that consent separately.

You may object at any time and free of charge, either in full or for individual channels, by using the unsubscribe link contained in every electronic marketing message, by replying STOP to a message received by SMS or a messaging service, or by writing to support@madamesum.ch. An objection does not affect service messages relating to an order, such as order and shipping confirmations.

Our email communications are sent through Mailchimp. They contain tracking pixels that allow us to see whether a message has been opened and which links have been clicked, so that we can measure and improve our communications. If you do not wish this, you may unsubscribe or configure your email programme not to load external images.

We may analyse your purchase history, your membership tier and your interaction with our communications in order to tailor the content we send you. This does not produce any legal effect for you and does not significantly affect you.

8. Cookies, analytics and advertising

8.1 Cookies and your choices

Our websites use cookies and comparable technologies. Cookies are small text files stored by your browser. Some are strictly necessary for the website to function, for example to maintain your session, keep your basket and enable secure log-in. Others are used for analytics or advertising purposes.

When you first visit our websites, a cookie banner allows you to accept or decline cookies that are not strictly necessary. Cookies used for analytics and advertising are set only where you have accepted them. You can change your choice at any time through the cookie settings on our website. You can also configure your browser to refuse cookies, although this may limit the functionality available to you.

8.2 Analytics

We use Google Analytics, a service of Google Ireland Limited, to understand how our websites are used, which pages are visited and how our online shop performs. Google processes this data on our behalf and may transfer it to Google LLC in the United States.

8.3 Advertising

We advertise our products on third-party platforms and measure the performance of that advertising. For this purpose we use the following services, each of which may set cookies or comparable identifiers on your device and receive data about your visits to our websites, the pages you view and the purchases you make:

Google Ads and Google Tag Manager, services of Google Ireland Limited.
Meta Pixel and the associated conversion services, provided by Meta Platforms Ireland Limited, for advertising on Facebook and Instagram.
Pinterest Tag, provided by Pinterest Europe Limited.
TikTok Pixel, provided by TikTok Information Technologies UK Limited and TikTok Technology Limited.

These services are activated only where you have accepted advertising cookies. Depending on the platform, we and the provider may act as joint controllers in respect of the collection and transmission of this data, and the provider then processes it further for its own purposes and as its own controller, under its own privacy notice. We have no control over that further processing, and we recommend that you consult the privacy notice and advertising settings of the platform concerned. Where a platform makes a joint controller arrangement available, the essence of that arrangement can be obtained from us on request.

We do not provide these platforms with customer lists or contact details for advertising purposes.

You can restrict interest-based advertising through the settings of the platform concerned, and through your browser and device settings.

9. Creditworthiness assessment and automated processing

Where you choose to pay by invoice or by instalment, the provider of that payment method may assess your creditworthiness before the payment method is offered or approved, and may consult credit information agencies for that purpose. That assessment is carried out by the provider concerned as its own controller. If a payment method is not made available to you as a result, other payment methods remain available in the online shop.

We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.

10. Transfers abroad

Our websites, our online shop and the data processed through them are hosted in Switzerland. Some of our other service providers are established abroad, and personal data may therefore be transferred outside Switzerland.

This concerns in particular the European Economic Area, in the case of Klarna and of the European entities of Google, Meta, Pinterest and TikTok, and the United States, in the case of Mailchimp and of onward transfers by Google and Meta to their parent companies. Depending on the platform and the service used, data processed by TikTok may also be accessible from Singapore and from the People’s Republic of China.

The European Economic Area is recognised by the Swiss Federal Council as offering an adequate level of data protection. Where a country is not so recognised, we ensure appropriate safeguards before personal data is transferred there, in particular by concluding the European Commission’s standard contractual clauses in the version recognised by the Federal Data Protection and Information Commissioner, together with any additional measures required in the individual case. You may request a copy of the safeguards we rely on by writing to support@madamesum.ch.

You should be aware that a level of data protection equivalent to that in Switzerland cannot be guaranteed in every country, and that authorities in some countries may be able to access data held there.

11. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, or for as long as a legal retention obligation applies. The following periods apply as a rule:

Order, invoice and accounting data: ten years from the end of the financial year concerned, in accordance with Art. 958f of the Swiss Code of Obligations and value added tax legislation.
Customer account and Dumpling Addict Club data: for the duration of the account, and thereafter until the expiry of the applicable retention and limitation periods.
Traceability data relating to deliveries: for the shelf life of the products concerned and for the period required by food law thereafter.
Customer service correspondence: as a rule three years from the close of the matter, and longer where a claim is pending or expected.
Marketing data: until you object, and thereafter only the information necessary to give effect to your objection.
Website and analytics data: as a rule fourteen months, or the shorter period set by the service concerned.
Application data: as a rule six months after the conclusion of the recruitment process, unless you have agreed that we may keep it longer in order to consider you for future positions.

Where personal data is no longer required, we delete it or anonymise it so that it can no longer be attributed to you.

12. Your rights

Subject to the conditions and exceptions provided by applicable law, you have the following rights in relation to your personal data:

To obtain information about whether and which personal data concerning you we process, and to receive a copy of it.
To have inaccurate personal data corrected.
To request the deletion of personal data, or the restriction of its processing.
To object to processing carried out on the basis of a legitimate interest, and to object to the use of your data for direct marketing at any time.
To withdraw a consent you have given, with effect for the future.
To receive personal data that you have provided to us and that we process by automated means in a structured, commonly used electronic format, or to have it transferred to another controller where technically feasible.

To exercise these rights, please write to support@madamesum.ch. In order to protect your data, we may ask you to identify yourself before we act on a request. We respond as quickly as possible and, as a rule, within thirty days.

If you consider that we process your personal data unlawfully, you may lodge a complaint with the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern, Switzerland. Where the EU General Data Protection Regulation applies to you, you may also lodge a complaint with the supervisory authority of your habitual residence.

13. Data security

We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, misuse and alteration. These include encrypted transmission of data on our websites, access controls, and the obligation of our employees and service providers to maintain confidentiality.

No transmission of data over the internet can be guaranteed to be entirely secure. Please keep your account credentials confidential and inform us without delay if you suspect that your account has been used without your authorisation.

Where a data security breach results in a high risk to your personality or fundamental rights, we notify the Federal Data Protection and Information Commissioner and, where required, you.

14. Job applications

Where you apply for a position with us, we process the data contained in your application in order to assess it and to conduct the recruitment process. Providing this data is voluntary, but without it we cannot consider your application. We share it internally only with the persons involved in the recruitment decision.

Please do not send us data that is not necessary for the assessment of your application. If you would like us to delete your application data, or if you would prefer that we keep it in order to consider you for future positions, please write to support@madamesum.ch.

15. Links to other websites

Our websites may contain links to websites operated by third parties. We have no control over how those websites process personal data. Please consult their privacy notices before providing data to them.

16. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time in order to reflect changes to our processing activities or to the applicable law. The version published on our website at the time you visit it applies. Please consult it periodically.

17. Contact

Madame Sum AG, Holunderweg 4, 8704 Herrliberg, Switzerland. Email: support@madamesum.ch. Website: www.madamesum.com.