APEX DNA

Privacy Policy

Last updated: 15 June 2026

This Privacy Policy explains how your personal data is collected and processed when you use apex-dna.com. We are committed to protecting your privacy in accordance with the Swiss Federal Act on Data Protection (FADP / nLPD) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data controller

2. What data we collect

We only collect the data you provide voluntarily through our forms:

• Contact form: name, email address, country, your message, and optionally a social media handle.
• Drop registration form: name, email address, country, social media handle, and your consent.

We do not collect special categories of data, and we do not buy or sell personal data.

3. Why we use your data (purpose & legal basis)

• To respond to your enquiries (contact form) — legal basis: your request / our legitimate interest in replying.
• To process drop applications and contact selected applicants — legal basis: your consent and the steps taken at your request.
• To send you a confirmation email after a drop registration — legal basis: your consent.

4. Service providers (data processors)

To operate the website and process form submissions, we rely on the following providers, who may process your data on our behalf:

• Cloudflare, Inc. (USA) — website hosting (Cloudflare Pages), serverless form processing, and anti-spam protection (Cloudflare Turnstile).
• Resend (email API) — delivery of notification and confirmation emails.
• Infomaniak (Switzerland) — email mailbox hosting for [email protected].
• Supabase (EU — Frankfurt) — secure hosting of the database and authentication for member accounts, orders and loyalty data.
• Anthropic (USA) — AI assistant used only inside our private admin console; any order data sent to it is pseudonymised first (names shortened, emails masked).

Some providers may be located outside Switzerland/EU; in such cases, appropriate safeguards apply to the transfer of your data.

5. Analytics (no cookies)

We use Cloudflare Web Analytics, a privacy-first analytics tool that does not use cookies and does not collect personal data or build visitor profiles. We also keep our own anonymous counter of shop page views (product and country-level only, with no cookie, account link or identifier). Both provide aggregated, anonymous statistics only, so no cookie consent banner is required.

To protect our forms from spam and automated abuse, we use Cloudflare Turnstile, a privacy-preserving alternative to traditional CAPTCHAs. It runs invisibly and does not track you across websites. Use of Turnstile is governed by the Cloudflare Turnstile Privacy Addendum.

6. Cookies & local storage

This website does not use advertising or tracking cookies. We only use your browser's local storage for essential functionality:

• Age verification — a signed cookie confirming you are 18+, stored for up to 1 year.
• Language preference — to remember your selected language.
• Shopping cart & preferences — your basket, dismissed banners and a per-session view counter are kept in your browser's local storage for the shop to work.

These do not track you and are not shared with third parties.

7. Data retention

We keep your data only for as long as necessary for the purpose collected — responding to an enquiry, managing a drop, or operating your member account and processing your orders — and to comply with legal obligations (e.g. accounting retention of invoices). You may request deletion at any time (see your rights below).

8. Your rights

Under the FADP and the GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data;
• object to or restrict certain processing;
• withdraw your consent at any time;
• request a copy of your data (data portability).

To exercise these rights, contact us at [email protected]. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or your local supervisory authority.

9. Data security

The website is served exclusively over HTTPS with modern security headers. We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse.

10. Changes to this policy

We may update this Privacy Policy from time to time. The “last updated” date at the top of this page reflects the latest revision.

11. Contact

For any question regarding this policy or your personal data, contact us at [email protected].