Privacy Policy
Last updated: October 2026
Controller
The controller responsible for processing personal data is PDQ Company IT-Consulting GmbH, Dammstrasse 16, 6300 Zug, Switzerland.
Data protection contact: Monika Passagne du Quercy, hello@niyu.ch.
We process personal data in accordance with the revised Swiss Data Protection Act (revFADP) and, where applicable, the GDPR.
What personal data we process
Enquiry/application: name, email address, phone number, interests and your message.
Membership (member and partner): name or studio name, email address, phone number, invitation/referral details and, where needed, address.
Cashback and payouts: account holder, IBAN, address, uploaded receipts, amounts and, for partners, company and VAT number.
Technical data: when you visit the site, server- and security-related data is processed (e.g. IP address, time of access, browser). To protect our forms (enquiry, joining, contact) from misuse, we store a one-way hashed value of your IP address and your email address with each submission, not the values themselves, and delete it automatically after two days at the latest.
Purposes and legal bases
We process this data to answer enquiries, to establish and run the membership, to arrange conditions and appointments with design houses, to pay out cashback and shares, to secure and operate the platform and to comply with legal obligations.
The legal bases are performance of a contract, your consent (which you may withdraw at any time), our legitimate interest in secure operation and statutory retention obligations.
Processors and service providers
We use carefully selected service providers for hosting and database (including providers located in the EU), authentication/login and email delivery.
Some of these providers may process data outside Switzerland and the EU (in particular in the USA). In such cases we ensure an adequate level of protection through appropriate safeguards (including standard contractual clauses).
Disclosure to design houses
When you redeem a condition or request an appointment, we pass the data required for this (name, phone number, email address) to the relevant design house. This happens at your initiative and with your consent during the redemption step.
Niyu Matcha: orders, subscription, free 4th pouch and invitations
Orders and customer account: for orders on niyu.ch we process name, email address, delivery and billing address, phone number (optional), orders, payment status and shipping information. Payments are handled by Shopify and the payment providers you choose; we do not receive card data. Subscriptions are managed by the Seal Subscriptions app in Shopify.
Every 4th pouch free: we store your personal invitation code, the amounts credited towards your 4th pouch and their redemption, and which subscription deliveries were paid. The purpose is to calculate this credit and to prevent misuse (e.g. self-referrals or multiple accounts).
Invitations: when you open an invitation link, we keep the code for 60 days in a strictly necessary cookie (niyu-ref) and pass it on with your order. We then link your customer account to the account of the person who invited you. That person sees in their account how many people have ordered through their link and their credit towards the 4th pouch, which grows with each of your paid subscription deliveries; from this, they can tell whether people are still ordering through their link. We do not pass on names, addresses or order details. On the invitation page we show the inviting person's first name from their customer account.
Waitlist: when an offer is sold out, you can leave your email address. We store the address, the offer, the language and when you signed up, confirmed and were notified. After you confirm via the link, we will write to you once when the offer is available again, and for no other purpose. We delete your entry on request to hello@niyu.ch.
Contact form: if you write to us through the form on niyu.ch/en/contact, we process your name, email address, the topic you choose and your message in order to reply. The message is sent by email to hello@niyu.ch (Google Workspace) and you receive a short confirmation; messages are sent via Resend (Resend, Inc., USA), for which appropriate safeguards such as standard contractual clauses apply. We do not store the message on the website. To protect against spam we store, for each message, a one-way hashed value of your IP address and your email address, not the values themselves, and delete it automatically after two days at the latest. The legal basis is our legitimate interest in answering your enquiry and protecting the form from misuse. We keep the email with your message as long as needed to deal with it.
The legal bases are performance of the purchase and subscription contract and of the terms for the free 4th pouch (terms and conditions), and our legitimate interest in a fair referral programme. The link is kept as long as either account can still earn credit towards the 4th pouch; afterwards we delete or anonymise it unless we are required to retain it.
Emails about your order and subscription: besides the confirmations from Shopify and Seal, we write to you ourselves: after your first order with preparation tips, after the first paid subscription delivery to welcome you to the subscription, two days before every subscription delivery as a reminder with the status of your 4th pouch, and once when it is waiting for you. For this we store your email address, first name, language, when you ordered and which of these emails you have received. They are sent through Resend (Resend, Inc., USA); appropriate safeguards such as standard contractual clauses apply.
Niyu Design Gold: with your first order from Niyu Matcha you receive the Gold membership in the Niyu Design circle. For this we create a member profile with your name and email address; you sign in with that email address. If you do not want the membership, delete it in the Member Area under “Delete account” or write to hello@niyu.ch.
Service providers for Niyu Matcha: Shopify (shop, checkout, customer account, order emails), Seal Subscriptions (subscription management), Vercel (hosting of niyu.ch) and Supabase (database for the 4th pouch and invitations). Shopify and Vercel may also process data in Canada or the USA; appropriate safeguards such as standard contractual clauses apply. For certain purposes of its own, such as the Shop app, Shopify is itself the controller; details are in Shopify's privacy policy (shopify.com/legal/privacy/app-users).
Objection: if you do not want an order to be credited to the person who invited you, a message to hello@niyu.ch is enough. We will then remove the link.
Retention and deletion
We retain personal data only as long as necessary for the stated purposes or required by law (e.g. retention of business records), after which we delete or anonymise it.
Your rights
Subject to applicable law, you have the right to access, rectification, deletion and restriction of processing, as well as data portability and objection. You may withdraw any consent at any time.
To exercise your rights, a message to hello@niyu.ch suffices. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).
Deleting your account
You can delete your account and the associated personal data yourself at any time: in the Member Area or Partner area under "Delete account". Alternatively, an email to hello@niyu.ch is sufficient. Deletion revokes your access and anonymises your profile; records relevant to accounting (in particular payouts) are retained for the statutory period, but are no longer linked to your profile.
Changes
We may amend this privacy policy. The version published on this page applies.