Privacy policy

Last updated: 14 October 2026

1. Controller

The controller for the processing of personal data within the meaning of the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR) is:

Luptek GmbH
Rorschacher Strasse 170
9000 St. Gallen, Switzerland
E-mail: info@luptek.ch
Authorised representative: Alexandru Lup, Managing Director

Data protection enquiries: info@luptek.ch

2. Principles

We process personal data in accordance with the principles of lawfulness, proportionality, purpose limitation, accuracy, data security and transparency (Art. 6 revFADP, Art. 5 GDPR). We process personal data only to the extent necessary for the respective purpose and delete it as soon as the purpose has been fulfilled and no statutory retention obligation stands in the way.

3. What data we process and for what purpose

a) When you visit our website (server log files)
When www.luptek.ch is accessed, the following data is processed as a technical necessity: IP address, date and time of the request, URL accessed, HTTP status code, volume of data transferred, referrer URL, browser type and version, operating system.
Purpose: technical operation, security, prevention of misuse.
Legal basis: legitimate interest (Art. 31 para. 2 revFADP / Art. 6 para. 1 lit. f GDPR).
Retention period: as a rule no more than 90 days, except in the case of security-relevant incidents.

b) Contacting us (contact form, e-mail)
We process: name, company, e-mail address, telephone number, content of the message.
Purpose: answering your enquiry and pre-contractual communication.
Legal basis: pre-contractual measures and legitimate interest (Art. 6 para. 1 lit. b and f GDPR).
Retention period: until the enquiry has been conclusively dealt with; business-relevant correspondence is retained for up to 10 years in accordance with the Swiss Code of Obligations and the VAT Act.

c) Dealer account and B2B shop
We process: company name, business identification number, contact person, business e-mail address and telephone number, delivery and invoicing addresses, order data, login data (stored encrypted), session identifiers, access logs.
Purpose: verification of dealer status, account administration, order processing, accounting, communication, prevention of misuse.
Legal basis: performance of the contract and pre-contractual measures (Art. 6 para. 1 lit. b GDPR), statutory obligations under the Code of Obligations and the VAT Act (lit. c), legitimate interest in security (lit. f).
Retention period: active accounts for the duration of the business relationship; business-relevant accounting and order data 10 years.

d) Fulfilment of medical device obligations
As importer and Swiss authorised representative (CH-REP) we are legally required to record sources of supply and recipients as well as quantities, lot and serial numbers (Art. 47c TPA, Art. 64 MedDO). This data is stored for the statutory retention period of at least 10 years (15 years for implants) and used solely for the purposes of market surveillance, vigilance and traceability.

4. Cookies

Our website uses exclusively technically necessary cookies that are essential for its operation (e.g. session security, language selection, basket, dealer login). These are set without consent.

No tracking cookies, third-party cookies, analytics or marketing tools are used.

5. Recipients / processors

To provide our services we use external service providers who process personal data on our behalf and according to our instructions. We have concluded data processing agreements with them in accordance with Art. 9 revFADP / Art. 28 GDPR.

Service providers currently engaged:
- Web hosting: Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany (servers in the EU). Hetzner processes server log files and the content of our website.
- E-mail service: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland (Proton Mail). Processes incoming and outgoing e-mail correspondence.
- Shipping service providers: as required, e.g. Swiss Post or DPD.

Data is passed on to authorities only where there is a statutory obligation to do so (e.g. Swissmedic in the context of market surveillance).

6. Disclosure abroad

We transfer personal data to one recipient within the EU/EEA: Hetzner Online GmbH (web hosting in Germany, backups in Finland). From a Swiss perspective, Germany provides an adequate level of data protection (recognised by the Federal Council). The same applies to Finland.

No transfer to third countries outside the EU/EEA takes place.

7. Data security

We protect our systems with technical and organisational measures that reflect the current state of the art: TLS/SSL encryption of data transmission, access controls, password hashing, regular updates, backups, authorisation concepts and an obligation on staff to maintain data confidentiality.

8. Retention periods

We retain personal data only for as long as is necessary for the purpose or required by statutory retention obligations:
- Server log files: maximum 90 days
- Contact enquiries not followed by a contract: up to 12 months
- Business and accounting records (Code of Obligations, VAT Act): 10 years
- Data under medical device law (sources of supply, recipients, UDI): at least 10 years, 15 years for implants
- Inactive dealer accounts: deletion after 24 months without activity, provided no statutory retention obligation applies

9. Your rights

You have the following rights against us in respect of your personal data:
- Access to the data processed (Art. 25 revFADP / Art. 15 GDPR)
- Rectification of inaccurate data (Art. 32 revFADP / Art. 16 GDPR)
- Erasure or destruction (Art. 32 revFADP / Art. 17 GDPR)
- Restriction of processing (Art. 32 revFADP / Art. 18 GDPR)
- Release and portability of data (Art. 28 revFADP / Art. 20 GDPR)
- Objection to processing based on legitimate interest (Art. 30 revFADP / Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future

Please send your requests in writing to info@luptek.ch or to the postal address given above. For security reasons we may ask you to prove your identity.

10. Right to lodge a complaint

You have the right to lodge a complaint with a competent supervisory authority:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch
- EU/EEA: with the competent data protection authority of your country of residence

11. Automated decisions

No automated individual decision-making within the meaning of Art. 21 revFADP / Art. 22 GDPR takes place.

12. Changes to this privacy policy

We reserve the right to amend this privacy policy in order to reflect changes in the legal framework or changes to our services. The version published at www.luptek.ch/datenschutz at any given time applies.

Last updated: 14 October 2026 — Luptek GmbH