Privacy policy

Last updated: 16 June 2026.

This Privacy Policy explains how 3SQM collects, uses, shares and protects your personal data when you visit 3sqm.eu, place an order, or otherwise interact with us. It is written to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the revised Swiss Federal Act on Data Protection (revFADP / nLPD).

Who we are (data controller)

The data controller is 3SQM, the sole proprietorship (raison individuelle) of Mattia Cook under Swiss law, based in Villars-sur-Glâne, Fribourg, Switzerland. For any privacy question or to exercise your rights, contact us at contact@3sqm.eu. For the purposes of the GDPR and the Swiss FADP, we are the controller of your personal data.

What personal data we collect

Contact and order details — name, billing and shipping address, email address and, where provided, phone number.
Payment information — handled by our payment processor; we receive transaction confirmation and the form of payment, not your full card number.
Order and account information — items viewed, added to cart, purchased or cancelled, and order history.
Communications — the content of messages you send us (e.g. support enquiries).
Device and usage data — IP address, device and browser information, and how you interact with the site, collected through cookies and similar technologies.

Why we use your data and our legal bases

To process and fulfil your order (create your order, take payment, arrange production and delivery, send order and tracking notifications, handle defect claims). Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)); under the Swiss FADP, processing necessary to perform the contract.
To handle customer service and our legal obligations (respond to you, keep accounting and tax records). Legal basis: legitimate interest and compliance with a legal obligation (GDPR Art. 6(1)(c) and (f)).
Security and fraud prevention (authenticate orders, detect and prevent fraud and abuse). Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
Marketing, analytics and advertising (email marketing where you have signed up, and measurement / targeted advertising via cookies and advertising pixels). Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time. In the EU, EEA, UK and Switzerland, non-essential cookies and advertising pixels are only set after you consent via our cookie banner.

Cookies, pixels and advertising technologies

We use cookies and similar technologies, including advertising pixels. Where required by law (EU/EEA, UK, Switzerland), these are loaded only after you give consent through our cookie-consent banner; you can change or withdraw your choice at any time. The advertising and analytics technologies we use include:

Meta Pixel and Meta Conversions API (Meta Platforms Ireland Ltd.) — records events such as page views, add-to-cart and purchases, and may send hashed contact details (e.g. email) server-side, to measure and optimise our advertising on Facebook and Instagram and to show you relevant ads. See Meta’s privacy policy at facebook.com/privacy/policy.
TikTok Pixel, TikTok Events API and Advanced Matching (TikTok Inc. for US users; TikTok Technology Limited / TikTok Information Technologies UK Limited for the EU/UK) — used to measure and optimise our advertising and our TikTok Shop. Depending on our data-sharing configuration and your consent/opt-out choices, we may share e-commerce events (content and page views, search, add-to-cart, checkout steps, purchases, sign-ups, payment info) together with hashed identifiers (email, phone number, first and last name, and address details — country/region, state, city, postal code) and related order and customer data via Shopify’s order and customer APIs. See TikTok’s privacy policy at tiktok.com/legal/page/row/privacy-policy/en.
Shopify analytics — our store runs on Shopify, which collects usage and device data to provide, secure and improve the store.

When these pixels fire, the relevant platform receives the associated data and acts as an independent or joint controller for measurement and advertising under its own privacy policy. You can also opt out of interest-based advertising through your device or browser settings and through the platforms’ own ad-preference tools.

Who we share your data with

We share personal data only with parties that help us run the store, and only as needed:

MuzeFab (Riga, Latvia) — our maker and fulfilment partner, which receives your name and shipping address to produce and dispatch your made-to-order towel.
Shopify (Shopify International Limited, Dublin, Ireland / Shopify Inc., Canada) — hosts the store and processes data on our behalf to provide the Services.
Our payment processor — to take and confirm payment securely.
Carriers — to deliver your order and provide tracking.
Advertising and analytics platforms — Meta Platforms Ireland Ltd. and TikTok, as described above, where you have consented.
Authorities — where required by law or to protect our rights.

We do not sell your personal data for money. However, our sharing of personal data with advertising partners (such as Meta and TikTok) for targeted advertising may be considered a “sale”, “sharing” or “targeted advertising” under certain US state privacy laws — see US state privacy rights below to opt out.

International transfers

Some of these recipients are located outside Switzerland, the EEA or the UK. Where we transfer personal data to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK and Swiss equivalents) to protect your data.

How long we keep your data

Order, invoice and accounting records — kept for the statutory retention period (generally up to 10 years under Swiss accounting law).
Customer-service correspondence — kept as long as needed to handle your request and a reasonable period afterwards.
Marketing and advertising / pixel data — kept until you withdraw consent or unsubscribe, and otherwise in line with the advertising platforms’ own retention windows.
Account data — kept until you ask us to delete it, subject to legal retention obligations.

Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you;
Rectify inaccurate data;
Erase your data;
Restrict or object to our processing, including objecting to direct marketing and profiling;
Data portability — receive your data in a portable format;
Withdraw consent at any time (this does not affect processing carried out before withdrawal).

To exercise any right, email contact@3sqm.eu. We will respond within the time required by law and may need to verify your identity first.

Complaints and supervisory authorities

If you are in Switzerland, you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), www.edoeb.admin.ch. If you are in the EEA, you may complain to your local data protection authority (a list is available via the EDPB at edpb.europa.eu). If you are in the UK, you may complain to the Information Commissioner’s Office (ICO), ico.org.uk.

US state privacy rights

If you are a resident of the United States, depending on your state you may have the right to opt out of the “sale” or “sharing” of your personal information and of “targeted advertising”. Our sharing of personal data with advertising partners (Meta, TikTok) as described above may fall within these categories. To opt out, use our “Your Privacy Choices” page (linked in our site footer), or browse with a Global Privacy Control (GPC) signal, which we honor. Subject to your state’s law, you may also request access to, correction or deletion of your personal information by emailing contact@3sqm.eu; we will not discriminate against you for exercising these rights.

Children

Our store is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.