I am a Consumer

Sunstar Data Privacy Notice

Last updated on October 2026

Introduction

Sunstar Group ("Sunstar" or "we/us" or the “Company”) takes the protection of personal data very seriously.

This privacy notice (the “Notice”) explains what personal data we collect when providing services in our fields of work, namely in consumer health and industrial engineering, focusing primarily on oral care and mobility components ("Services"), and how we process that data. We ensure compliance with applicable data protection laws through appropriate technical and organizational measures. This notice applies to all customers (“Customers”) and users of our different websites (“Users”).

All parent companies, subsidiaries and Sunstar entities can be found here.

Sunstar operates different websites, all available under this link and here (“Sites”).

Sunstar’s role and contact details

Sunstar’s main establishments in Europe are Sunstar Suisse SA and Sunstar Europe SA, Swiss-based companies established in Etoy, Vaud, that may be contacted with the following information should you have any notes, comments, or questions regarding this Notice or the processing of your personal data:

Sunstar Suisse SA

Route de Pallatex 15

1163 Etoy

Switzerland

privacy@ch.sunstar.com

 

Sunstar Europe SA

Route de Pallatex 15

1163 Etoy

Switzerland

privacy@ch.sunstar.com

As a group based in Switzerland, Sunstar processes personal data in accordance with the Swiss Federal Data Protection Act (“FADP”) and abides by the principles and rules of the European General Data Protection Regulation (“GDPR”). Depending on where the Sunstar entity that processes personal data is based, other data protection laws may apply. Together, these laws are herein referred to as “applicable data protection laws”.

Sunstar operates branches in Japan, the USA, the United Kingdom, Germany, Spain and Singapore. Each of them are primarily responsible for processing the data necessary to provide the Services and operate as data controllers. Specific privacy notices exist for Japan, the USA and Singapore.

In the context of this Notice, Sunstar is the controller of your personal data, subject to the FADP and, where applicable, GDPR.

Sunstar’s representative in the Union is the following:

EU Representative in accordance with Art. 27 GDPR

Sunstar Deutschland GmbH

Aiterfeld 1

79677 Schönau im Schwarzwald

Germany

Categories of Personal Data

In order to be able to provide and develop our Services, as well as to provide online content and services on our Sites, we collect, use and communicate a certain number of data concerning Customers and Users. Data is all identified or identifiable information pertaining to a data subject.

The categories of personal data processed include:

Personal details and contact data (name, address, phone, age, further contact details);

  • Order data (e.g. payment, shipment, special requirements);
  • Data stemming from the fulfilment of our contractual obligations;
  • Financial data;
  • Advertising and sales data, including, where applicable, behavioral and preference data (including cookies, preferences, sales history);
  • Record-keeping data and other technical data (e.g. minutes of consultation, call logs, complaints, IP address);
  • Other data related or comparable to the above categories (e.g. Email, communication data).

Most of the data we process is provided by you (through forms, when you communicate with us, in relation to contracts, when you use the website, etc.). Whereas you are not, as a rule, obliged or required to disclose data to us, certain cases may require such disclosure, for example within the framework of binding health protection concepts (legal obligations). If you wish to enter contracts with us or use our services, you must also provide us with certain data as part of your contractual obligation under the relevant contract.

In compliance with applicable data protection laws, we also collect data from public sources and may receive data from other companies within our group, from public authorities and from third parties (such as credit agencies, address brokers, associations, contractual partners, internet analytics services, etc.). Such data remains within the categories mentioned above.

Purposes of Processing and Legal Basis

We process your personal data in particular for the following purposes:

For the fulfilment of contractual obligations

Your data will be processed to provide you with products (including via online sales platforms such as Amazon) and related ancillary services as part of entering and executing our contracts with you. The exact nature and purpose of data processing are based primarily on the specific product or service requested and on whether you make a direct purchase with us or order through another vendor (e.g. Amazon).

For the fulfilment of Sunstar and of third-party interests

In order to safeguard our legitimate interests and those of third parties, we also process your personal data for the following purposes:

  • to manage risks within Sunstar;
  • to assert legal claims and enable defense in legal disputes;
  • to prevent violations of the law;
  • to ensure IT security and IT operations;
  • to take measures to ensure the security of buildings and systems (e.g. entry controls);
  • to take measures for business management purposes and for the development and marketing of services and products;
  • to provide tailored customer service

Our legitimate interests in these circumstances are the reduction and management of risk, enforcement of our rights, implementation of efficient business processes and the improvement, marketing and sale of our products and services.

On the basis of your consent

We’ll process your personal data for the purposes which you consented to. You can withdraw this consent at any time. Please note that the withdrawal of consent has no retroactive effect on the previous use of your personal data.

Applicable law generally requires consent for sending you newsletters or for marketing emails. This consent can be withdrawn at any time by clicking the unsubscribe link at the bottom of every newsletter or by contacting us under the above-mentioned contact details. Your e-mail address will then be automatically removed from the mailing list for such mailings, being underlined that other messages may be sent based on other legitimate grounds.

On the basis of statutory requirements, public or vital interest

We are subject to various national and international regulatory obligations under which we are required by law to carry out certain processing operations. Additionally, we may process your personal data in exceptional circumstances when processing is necessary in order to protect your vital interests or those of another person. Additionally, we may process your personal data if this is necessary for the performance of a task carried out in the public interest.

Technical Implementation and Security

Although total security does not exist, security measures (technical and organisational) in accordance with good professional practice have been put in place, taking into account the risks incurred to protect Consumer’s and User’s data against any accidental or intentional manipulation, loss, destruction, disclosure or against any unauthorized access.

Recipients and Third-Country Transfers

Data transfer within the Sunstar Group

Within the Sunstar Group, the data communicated to one of the companies of the Sunstar Group may be transmitted to all the other companies of the group, to the extent required to ensure business requirements and imperatives. These companies may process data in accordance with this Notice for the purposes mentioned above as well as in accordance with their own privacy notices, where applicable.

Within the Sunstar group, your personal data is only accessed by persons who need this access to adequately and appropriately fulfil Sunstar’s legal and contractual obligations and provide the requested product or services and to enable our business processes.

Categories of Processors

Your data will be processed for the same purpose by service providers and subcontractors instructed by us, while fulfilling the relevant data protection prerequisites and our instructions (Art. 28 GDPR and 9 FADP). Such companies provide services including IT, communication, and advisory, as well as distribution and marketing services. Each of these processors has been carefully chosen and data processing agreements have been entered between Sunstar and the data processors which meet the applicable data protection requirements.

These processors include (without limitation and subject to change):

  • CRM and CMS Providers
  • Newsletter Service Providers
  • Design and Marketing Agencies
  • Server, Storage and other IT/Telecommunication Providers
  • Event Management Service Providers
  • Shipment and Fulfilment Service Providers
  • Accounting and Finance Service Providers

In cases where the destination country does not provide adequate protection, appropriate safeguards such as EU Standard Contractual Clauses (Art. 46(2)(c) GDPR and Art. 16(2)(d) FADP) are used, or transfer is based on Art. 49(1)(e) GDPR and Art. 17(1)(c) FADP when applicable.

Transfers of Personal Data

To third parties

We may transmit the data of Customers and Users to third parties outside Sunstar where this is required for the processing operation, especially (i) if this is necessary for the pursuit of the purposes for which the data has been collected or is processed, (ii) if the Customers and Users have given their prior consent, (iii) if this is required for prevailing interests or (iv) if the law allows or requires us to do so (e.g. at the request of a judicial authority, to assert our rights in court or to collect a debt using a collection service).

Transfer abroad

The transfer of personal data to a country that would not be deemed adequate is only allowed under certain conditions Before transferring your personal data Sunstar will ensure that the required prerequisites are fulfilled to provide an adequate level of protection.

If you have any questions related to such transfers, please contact us at the details provided above for more information.

Retention of Personal Data

Your personal data is retained as long as it is required in order for us to fulfil any relevant legal or contractual obligations, or answer to legitimate business purposes. When the data is no longer necessary for these obligations and purposes, it is erased or permanently anonymized. Do note that back-up and security safeguards, with limited access, may remain for a longer period of time where required for security purposes.

We maintain retention schedules for our main categories of personal data, which are documented in the Register of Processing Activities (ROPA) and reviewed on a regular basis. Please inform us should you wish more detailed information.

Data Subject Rights

As a person in Switzerland or the EEA, with regard to the processing of your personal data by us, you can contact us in writing at the above address or via email at the email address above to exercise your following rights:

  • Information rights (especially under Art. 12 ff GDPR and Art. 19 ff FADP)
  • An access right (Art. 15 GDPR and Art. 25 FADP);
  • Right to request the rectification of inaccurate or the completion of incomplete personal data relating to you (Art. 16 GDPR and Art. 32 FADP), as well as the right to request the deletion of personal data relating to you, provided that this data is no longer required to fulfil the purpose for which it was collected or there is another reason for deletion and the deletion is not prevented by any obstacles to deletion, such as statutory retention periods (Art. 17 GDPR and Art. 32 FADP).
  • Right to request the restriction of the processing of your personal data in accordance with the respective legal provisions (Art. 18 GDPR and Art. 32 FADP).
  • Where applicable under the relevant legal provisions, you may have the right to data portability (Art. 20 GDPR and Art. 28 FADP).
  • Insofar as your personal data is processed on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, or in the situation where we would need a justification under Art. 31 FADP, you have the right to object to this processing of your personal data at any time on grounds arising from your particular situation (Art. 21(1) GDPR and Art. 31 FADP). The objection can be made without any formalities. If you object, we will no longer process personal data relating to you unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.
  • Right to complain to any supervisory authority of your choice, including in the EU Member State of your residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you by us is in breach of the law.

Please note that exercising some of these rights may mean that we are unable to provide our Services to you because it is information that is essential to us being able to do so. In other cases, it may mean that we are providing services based on incomplete information, which may mean that those services will not meet your needs.

Sunstar group does not carry out any automated decision as set out in Art. 22 GDPR and 21 FADP.

Special provisions

Processing of User’s data on the website

Introduction

When Users browse and interact with our Sites, automated data collection technologies are used to collect certain data about them to understand their actions (e.g. which links were clicked on, which pages were viewed), as well as other similar data and statistics (e.g. content response times, download errors, length of visit to certain pages, type of browser used or place of connection). This information is collected using automated technologies such as cookies.

Cookies

In general

Cookies are text files that can identify Users and store their personal preference (e.g. their choice of language) as well as technical information (e.g. click-type and browsing-type data).

We use cookies to facilitate access to the Sites and to analyze traffic and Users and identify malfunctions of the Sites. It also allows us to improve the User experience and the design and content of the Sites.

In addition, we may also use web beacon or “Clear GIFs” or similar technologies that are used to verify how Users navigate our Sites and to see which pages of our Sites they visit. Web beacons are short sets of codes that deliver graphical images to a web page for the purpose of transferring data such as the Internet Protocol (IP) address of the computer that downloaded the page to display web beacons, the URL of the page the beacons appear on, the time the page containing the beacons was viewed, the types of web browsers that fetched the beacon, and the ID number of any cookie previously registered in the computer by the said server.

For the operation of the Sites, we may collaborate with other companies that place cookies or web beacons on the Sites (including Google Analytics). These companies help us manage the Sites and provide additional products and services. The use of these technologies by these third parties is then subject to their own personal data processing terms and conditions and is not covered by the Notice.

The use of cookies can be disabled by selecting the appropriate settings within the browser used. However, such deactivation may prevent the use of certain features of the Sites.

Users of the Sites can modify or withdraw their consent for non-essential cookies at any time by clicking on the fingerprint symbol at the bottom of the Sites.

Cookie Categories

Technical/Essential Cookies (Always Active)

These cookies are essential for the Platforms to function. They cannot be disabled.

Marketing Cookies (Opt-in)

These technologies are only activated with Users’ consent, which they can withdraw at any time. They allow us to measure the effectiveness of our advertising campaigns and, where applicable, to show Users relevant ads on third-party platforms. Please note that the data transmitted to these platforms is pseudonymized and that we do not use any health data for advertising purposes.

Functionality Cookies (Opt-in)

These cookies remember Users’ preferences (language, interface settings) to personalize Users’ experience.

Newsletter/Marketing Emails

In General

Regardless of the type of contact, we use your e-mail address solely for our own advertising purposes. Processing of personal data in the context of sending marketing emails to potential future customers is based on consent. You can revoke your consent at any time without affecting the legality of the processing carried out until your revocation of the consent. You can unsubscribe from marketing emails at any time using the corresponding link in the email or by notifying us to privacy@ch.sunstar.com. Your e-mail address will then be removed from the mailing list.

If you register for marketing emails, we will electronically record and store the personal data you provide us with. The purpose of this processing is initially the implementation of the so-called double-opt-in procedure, with which you can agree to the regular reception of marketing e-mails. This means that after submitting your data and information, we will send you an e-mail to the e-mail address you have provided and ask you in this e-mail for confirmation that you wish to receive the marketing emails. If there is no confirmation of your registration, your data will be deleted.

After your confirmation we will store your IP address and the time of the confirmation. The purpose of this procedure is to prove your registration for the marketing e-mails and, if necessary, to detect and prevent possible misuse of your personal data. The legal basis for this processing is our legal obligation to document consent.

For existing customers, i.e. after the purchase of goods or services, we may send you marketing emails for similar products and services.

Newsletter Analytics

Sunstar can use so-called newsletter tracking in its marketing emails, if you have given your consent. Recipient reactions (opening a mailing, clicking on text and image links, downloading images with an e-mail program) are recorded and stored.

The purpose of this processing is to improve the quality of the emails and to optimize our offers. The legal basis for processing is consent.

Online Ordering

To fulfil our contractual obligations towards our online customers, we use external e-commerce and shipping partners such as Amazon and other service providers (“Online Partners”). We provide your name as well as your delivery address exclusively for the purpose of the delivery of goods to a shipping partner selected by us.

You have already been informed in the data protection notice provided by our Online Partners about the collection and storage of your personal data and the type and purpose of its use. Any required consent to this processing was obtained by our Online Partners during your registration. We do not collect any further personal data from you beyond the personal data provided by our Online Partners. Our Online Partners will transmit your personal data to us for the purpose of performing the contract. This personal data transmitted to us by our Online Partners is stored and processed by us under this Notice.

Our Online Partners are responsible for all further data processing on their platforms that goes beyond the data processing described in this Notice including the payment methods provided on their websites. For more information about Amazon's data processing, see Amazon's Privacy Notice.

Social Network Pages

We may operate pages and other online presences (“fan pages”, “channels”, “profiles”, etc.) on social networks and other platforms operated by third parties and collect data. We receive this data from you and from the platforms when you interact with us through our online presence (for example when you communicate with us, comment on our content or visit our online presence). At the same time, the platforms analyze your use of our online presences and combine this data with other data they have about you (for example about your behavior and preferences), under their own rules. They more generally process this data for their own purposes, for which Sunstar is not responsible.

We process this data for the purposes set out above, for communication, for marketing purposes (including advertising on these platforms) and for market research. We or the operators of the platforms may also delete or restrict content from or about you in accordance with their terms of use (for example inappropriate comments).

Update of Notice

We reserve the right to make changes to this Notice at any time. The current version of this document applies.

This Notice is effective since October 2026.