Privacy policy

Last updated: 18 May 2026

PawCalm ("we", "us", "PawCalm") respects your privacy. This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what your rights are. This policy is written to comply with the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP/nFADP), and the California Consumer Privacy Act (CCPA).

1. Who is responsible for your data. PawCalm, 12 ch de la Sitterie, 1950 Sion, Switzerland, team@pawcalm.org. We are the data controller of any personal data you provide through pawcalm.org.

2. What data we collect

Data you give us directly:

  • Order data: first and last name, email address, shipping address, phone number (optional), order contents.
  • Payment data: processed by Shopify Payments and our payment processors (Stripe, PayPal, Apple Pay, Shop Pay). We do not see, receive, or store your full card number. We receive only a transaction confirmation and the last 4 digits of the card.
  • Communications: if you email us at team@pawcalm.org, we keep the conversation for support and quality purposes.
  • Reviews and survey responses: if you choose to submit a review or fill in a survey, we store your response and (if you tell us) your dog's name and breed.

Data we collect automatically:

  • Technical data: IP address, browser type, device type, referring URL, pages visited, time on page. Used for site performance and fraud prevention.
  • Cookies and similar technologies: see our Cookie Policy for the full list.
  • Analytics: Google Analytics 4, Meta Pixel, Shopify Analytics. These tools may set cookies and collect pseudonymous identifiers.

3. Why we collect it (legal basis under GDPR). Fulfilling your order: performance of a contract (Art. 6(1)(b) GDPR). Order confirmations, shipping updates, the 7-Day Calm Protocol: performance of a contract. Customer support and refund handling: performance of a contract / legitimate interest. Accounting and tax record retention: legal obligation (Art. 6(1)(c) GDPR). Fraud prevention and security: legitimate interest (Art. 6(1)(f) GDPR). Marketing emails (Klaviyo), website analytics, advertising pixels, and showing you ads on Meta / Google: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time, see Section 7.

4. Who we share your data with. We share the minimum necessary data with the following processors, each under a Data Processing Agreement: Shopify Inc. (e-commerce platform, hosting; Canada/EU), Stripe / PayPal / Shopify Payments (payment processing; US/EU), Klaviyo Inc. (transactional + marketing email; US, Standard Contractual Clauses), Google LLC (Google Analytics 4, ads; US, SCCs), Meta Platforms Inc. (Meta Pixel, ads; US, SCCs), Cloudflare Inc. (DNS, email routing; US/global), postal carriers (Swiss Post, DHL, USPS, La Poste, etc.; delivery), and our accountants / tax authorities (tax compliance; Switzerland). We do not sell your personal data. We do not share your data with third parties for their own marketing.

5. International data transfers. Some of our processors are located outside Switzerland and the EU/EEA (notably the United States). For these transfers, we rely on the EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework where the recipient is certified. All orders are fulfilled from our location in Switzerland. We do not transfer your shipping data outside the EU/EEA/Switzerland.

6. How long we keep your data. Order records: 10 years (Swiss tax law). Customer support emails: 3 years from last interaction. Marketing email subscriptions: until you unsubscribe, then deleted within 30 days. Analytics data: 14 months (GA4 default). Refund / dispute records: 10 years (Swiss tax law).

7. Your rights. Under GDPR, Swiss FADP, and CCPA, you have the right to: access the personal data we hold about you; rectify inaccurate or incomplete data; erase your data ("right to be forgotten"), subject to legal retention obligations; restrict how we process your data; port your data to another provider; object to processing based on legitimate interest; withdraw consent at any time, with no effect on processing before withdrawal; and not be subject to automated decision-making that has legal effects on you (we do not do this). To exercise any of these rights, email team@pawcalm.org with "Privacy request" in the subject line. We respond within 30 days. EU residents also have the right to lodge a complaint with a supervisory authority. California residents have specific CCPA rights including the right to know, the right to delete, and the right to opt out of "sale" of personal information. We do not sell personal information.

8. Children. PawCalm products are not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have, email team@pawcalm.org and we will delete it.

9. Security. We protect your data with industry-standard security practices: HTTPS/TLS encryption, secure payment processing, access controls on internal systems, and processor agreements with all third parties. No system is 100% secure. If a breach affects your data, we will notify you within 72 hours as required by GDPR Art. 33.

10. Changes to this policy. We may update this policy. The "Last updated" date reflects the latest change. Material changes will be communicated by email to active customers or by a prominent notice on the site.

11. Contact. For any privacy question or to exercise your rights: PawCalm, Rue des Cèdres 10, 1950 Sion, Switzerland, team@pawcalm.org