Privacy Policy
Data controller
Responsible for the processing of personal data on this website:
Alin Ghiorghiu — MyHerbal.ch
Independent Herbalife Member
Schürbungertweg 10, 8302 Kloten, Switzerland
Phone: 044 554 91 91
Email: kontakt@myherbal.ch
UID: CHE-250.946.601
For questions about data protection you can reach us at privacy@myherbal.ch.
This policy follows the revised Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). Where the European General Data Protection Regulation (GDPR) applies in an individual case, its provisions apply in addition.
Which data we process
Order data: first and last name, billing and delivery address, email address, phone number, products ordered, order and invoice number, payment method, payment status.
Customer account: in addition, your encrypted password (bcrypt — we never see your password in plain text), saved addresses, preferred language, the time of your last sign-in, and the time at which you accepted our Terms and Conditions.
Contact enquiries: name, email address, phone number and the content of your message.
Newsletter: email address, first name, the time you signed up, and open and click statistics for the campaigns sent.
Server log data: when you visit the website, your IP address, the date and time, the page requested, browser type and operating system are logged automatically. This data serves the operation and security of the website.
We do not process personal data requiring particular protection and we carry out no high-risk profiling. Payment data such as credit card numbers is handled exclusively by
Purposes of processing
- Performance of the contract: carrying out orders, delivering goods, issuing invoices, handling returns and guarantee cases, customer service.
- Legal obligations: accounting and the retention of business records (Art. 958f CO), tax obligations, information to the authorities.
- Legitimate interests: the security and availability of the website, preventing misuse and fraud, improving what we offer.
- With your consent: newsletters and advertising by email, audience measurement and advertising cookies (see below). You can withdraw your consent at any time.
Cookies and audience measurement
Necessary cookies are set without consent, because the website does not work without them: your shopping cart, your sign-in to the customer account, the language choice and the spam protection on the contact form (Cloudflare Turnstile). These cookies contain no advertising identifiers.
Analytical and advertising cookies are set only if you expressly agree in the cookie banner. This concerns — where active — Google Analytics and Google Ads (Google Ireland Limited, Ireland) as well as Meta/Facebook advertising (Meta Platforms Ireland Limited, Ireland). These services collect pseudonymous usage data in order to measure reach and serve advertising.
You can change your choice at any time: through the link “Cookie settings” in the footer of every page. You can also block or delete cookies in your browser generally; the website will still be usable in principle.
You'll find details of the individual cookies in our Cookie Policy.
Disclosure to third parties
We do not sell your data. We pass it on only where this is necessary to handle your order, to operate the website, or because the law requires it. All processors are contractually bound to confidentiality and to appropriate security measures.
| Recipient | Purpose | Location |
|---|---|---|
| Herbalife | Product delivery, shipping, handling of guarantee cases | Switzerland / EU |
| Payrexx AG | Payments by TWINT, credit card, Klarna, invoice | Thun, Switzerland |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payments via PayPal | Luxembourg |
| Brevo (Sendinblue SAS) | Sending the newsletter | France |
| Cloudflare, Inc. | Security, bot protection (Turnstile), delivery of the website | USA / worldwide |
| Hosting infrastructure | Operation of the website, shop database and email server | Romania (EU) |
| Google Ireland Limited | Audience measurement and advertising — only with your consent | Ireland / USA |
| Meta Platforms Ireland Limited | Advertising — only with your consent | Ireland / USA |
Disclosure abroad
Our servers are in Romania (EU). The service providers named above are located in Switzerland, in the EU or in the USA. The Federal Council recognises the states of the EU and the EEA as countries with adequate data protection (Annex 1 DPO); for the USA we rely on the Swiss–U.S. Data Privacy Framework or on standard contractual clauses.
Retention periods
- Orders, invoices and accounting records: 10 years (Art. 958f CO).
- Customer account: for as long as the account exists. After the account is deleted, only the records required for accounting remain.
- Contact enquiries: as a rule 24 months after the last correspondence.
- Newsletter: until you unsubscribe; after that we keep your address only on a suppression list, so that you receive no further emails.
- Server logs: as a rule 90 days.
Data security
The website is transmitted exclusively in encrypted form (TLS/HTTPS). Passwords are stored hashed with bcrypt. Access to the database and the administration interface is restricted to authorised people and additionally limited to specific IP addresses. Despite careful technical and organisational measures, absolute security cannot be guaranteed for transmission over the internet.
Your rights
Under Swiss data protection law you have in particular the following rights:
- Information about whether and which data we process about you;
- Correction of inaccurate data;
- Deletion or restriction of processing, where no statutory retention obligation stands in the way;
- Objection to the processing, in particular to direct marketing;
- Release or transfer of the data you have provided, in a common electronic format;
- Withdrawal of a consent given, with effect for the future.
You can view and change your addresses and personal details yourself at any time in your customer account. For anything else, write to privacy@myherbal.ch. To process a request for information we have to verify your identity.
If you are not satisfied with our answer, you can turn to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. People in the EU additionally have the right to turn to the supervisory authority responsible at their place of residence.
Minors
What we offer is aimed at people aged 16 and over. We do not knowingly collect data from children. If we learn that we are processing the data of a minor without the required consent, we delete it.
Changes
We may adapt this Privacy Policy at any time, for example when we start using new services or the legal situation changes. The version published on this page at the time is the one that applies.
Last updated: August 2026