Privacy Policy of X-SOR AG (CIGSOR)

Version 2.0 · Last updated: 30 July 2026

This Privacy Policy explains how X-SOR AG processes personal data in connection with the CIGSOR website, online shop, mobile applications, connected sensors, support services and related functions.

1. Scope

This Privacy Policy applies in particular to:

• the websites and language versions operated under cigsor.com;

• the CIGSOR online shop and checkout;

• the CIGSOR mobile applications for iOS and Android;

• CIGSOR sensors, the associated cloud platform and connected services;

• the Cigar Scanner, cigar inventory, humidor sharing and lounge locator functions;

• contact, support, warranty and other service enquiries;

• marketing communications, where offered and requested.

Different sections may apply depending on whether you visit our website, place an order, use the CIGSOR app or sensor, contact support, or use another CIGSOR service. Additional notices, terms or product-specific information may apply to individual functions.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP), the Swiss Data Protection Ordinance and, where applicable, the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Controller and contact details

The controller responsible for the processing described in this Privacy Policy is:

X-SOR AG

Müligässli 18598

BottighofenSwitzerland

Email: support@cigsor.com

You may use this contact address for privacy enquiries and to exercise your data protection rights.

3. Processing principles and legal bases

We process personal data lawfully, fairly, transparently, proportionately and only for specified purposes. We retain personal data only for as long as necessary for the relevant purpose or as required by law, contract, security or evidence requirements.

Where a justification is required under Swiss law, processing may be based on consent, a contractual relationship, a legal obligation, an overriding private or public interest, or the establishment, exercise or defence of legal claims.

Where the GDPR applies, processing is based in particular on:

• Article 6(1)(a) GDPR – consent;

• Article 6(1)(b) GDPR – performance of a contract or steps taken before entering into a contract;

• Article 6(1)(c) GDPR – compliance with a legal obligation;

• Article 6(1)(f) GDPR – legitimate interests.

Our legitimate interests include the secure and efficient operation of our website, shop, apps and connected services; processing orders and support enquiries; improving products and user experience; preventing misuse and fraud; and measuring the effectiveness of our website and marketing activities.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future. Processing carried out before withdrawal remains unaffected.

4. Categories and sources of personal data

Depending on how you interact with CIGSOR, we may process the following categories of personal data:

• identity and contact data, such as name, postal address, email address and telephone number;

• account and authentication data, such as user ID, account settings and login information;

• order and transaction data, such as products ordered, delivery address, invoice details, payment status and transaction references;

• support and communication data, such as messages, screenshots, uploaded documents and correspondence;

• technical and usage data, such as IP address, browser, device, operating system, app version, timestamps, pages and functions used, referrer information, logs and diagnostic data;

• sensor and humidor data, such as sensor ID, humidity, temperature, battery status, WiFi signal, connection status, thresholds, alerts and historical measurements;

• inventory and content data, such as humidor details, cigar quantities, cigar names, notes and photographs;

• location data, where you use a location-based function or grant location permission;

• cookie, consent and advertising identifiers.

We receive personal data directly from you, automatically through your device, browser, app or sensor, from payment and logistics providers, from app stores, and from service providers acting on our behalf.

Part A: Website and online shop

5. Website hosting and technical operation

Our website and online shop are operated using services provided by Wix.com Ltd. and affiliated companies. Wix provides website hosting, content delivery, security, shop, forms, multilingual functions and related infrastructure.

When you access the website, technical data may be processed automatically, including your IP address, date and time of access, requested page or file, browser and device information, operating system, referrer URL, error messages and security events.

This processing is necessary to deliver the website, display content correctly, maintain stability and security, prevent misuse and attacks, troubleshoot errors and improve technical performance.

Wix is based in Israel and uses data centres and service providers in various countries, including the United States and Ireland. International transfers are addressed in section 26.

6. Cookies and consent management

We use cookies and similar technologies, including local storage, session storage, pixels, tags, device identifiers and embedded scripts. These technologies are grouped into categories such as necessary, functional, analytics and marketing technologies.

6.1 Necessary technologies

Necessary technologies support essential functions such as security, fraud prevention, network and session management, checkout, login, form processing and storage of your privacy choices. They cannot be fully disabled without affecting the operation of the website.

6.2 Functional technologies

Functional technologies enable optional features such as language preferences, maps, embedded media, external widgets and enhanced user settings.

6.3 Analytics technologies

Analytics technologies help us understand website usage, measure visits and interactions, identify technical problems and improve content, navigation and performance.

6.4 Marketing technologies

Marketing technologies may be used to measure campaigns, attribute conversions, build audiences and display or evaluate relevant advertising.

6.5 Usercentrics for Wix

We use Usercentrics for Wix to inform visitors about cookies and similar technologies and to manage their choices. The service is provided by Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany.

Usercentrics may process consent or refusal status, selected categories and services, date and time of the decision, consent ID, device and browser information, IP address, referrer URL, banner language and configuration version. This processing is required to implement and document your privacy choices.

You can accept or reject non-essential technologies, select individual categories and change or withdraw your choice at any time through the cookie settings widget on the website. A current list of technologies, providers, purposes and storage periods is available in the cookie settings.

7. Website analytics

7.1 Wix analytics and operational measurement

Wix may provide aggregated and technical analytics relating to website visits, performance and operation. Where non-essential analytics technologies are used, they are activated in accordance with your choice in the consent manager.

7.2 Google Analytics 4

We use Google Analytics 4 to analyse how visitors use our website and to improve our content and services. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and other Google group companies.

Google Analytics may process information such as browser and device data, pages visited, date and duration of visits, source of access, interactions and events, approximate location and pseudonymous user or session identifiers.

Google Analytics is activated only where you have made the corresponding analytics choice in the consent manager. Google may process data in the United States and other countries.

8. Contact, support and warranty enquiries

When you contact us by email, through a website form or by another communication channel, we may process your name, email address, telephone number, subject, message and any information or files you choose to provide.

For technical support, we may also process screenshots, documents, sensor model and identifier, smartphone model, operating system version, app version, WiFi or connection information, error descriptions and diagnostic details.

We use this information to respond to your enquiry, provide setup and troubleshooting assistance, handle warranty or service requests, document the communication, improve support quality and defend or enforce legal claims where necessary.

Please do not send passwords, payment card details or other unnecessary sensitive information through general contact or support forms.

9. Online shop, orders and customer administration

When you place an order, we process the information required to complete the purchase, including your name, billing and delivery address, email address, telephone number, products ordered, order value, currency, tax and delivery information, order history and related communication.

We process this information to operate the shopping cart and checkout, confirm and fulfil the order, issue invoices, provide customer service, handle returns and warranty claims, prevent fraud and comply with accounting, tax and commercial record-keeping obligations.

The online shop is provided using Wix Stores and related Wix commerce services. Order and customer data may therefore also be processed by Wix and its service providers.

10. Payments through Stripe

We accept credit and debit card payments through Stripe. Depending on your location and the payment flow, Stripe Payments Europe, Limited, Ireland, Stripe, Inc., United States, and other Stripe group companies may process payment data.

Stripe may process your name, billing details, email address, IP address, device information, card or payment method details, authentication information, transaction amount, currency, payment status and fraud-prevention data.

Payment card details are generally entered directly into Stripe-controlled payment fields or systems. X-SOR AG receives the payment confirmation, transaction reference and limited payment information needed to process the order, but does not require access to your complete card number for normal order processing.

Stripe processes certain data as our service provider and may also process data under its own legal obligations, including payment regulation, fraud prevention, sanctions screening and record keeping.

11. Shipping and logistics

To deliver an order, we disclose the information required for shipment to the transport, postal, courier, fulfilment or logistics provider engaged for the relevant destination. This generally includes your name, delivery address, contact details, order reference and information required for customs or delivery handling.

The specific provider may vary depending on the destination, product, availability and delivery method. Logistics providers process data in accordance with their own legal obligations and privacy information.

12. Store locator, maps and location functions

We use a store or lounge locator and map functions to display specialist retailers, cigar lounges or other locations. The website currently uses Located Store Locator and map services provided by MapTiler AG, Switzerland, and related technical providers.

When a map or locator is loaded, the provider may process your IP address, browser and device information, the page viewed, map interactions and approximate location. If you choose a function that uses your precise device location, access occurs only after you grant the relevant browser or device permission.

Non-essential map and locator functions are loaded according to the relevant consent category.

13. Embedded videos and YouTube

Some pages contain videos embedded from YouTube. YouTube is a service of Google Ireland Limited and other Google group companies.

When an embedded video is loaded or played, Google may process your IP address, device and browser information, the page viewed, video interactions, identifiers and, if you are signed in to Google, information associated with your Google account.

YouTube content and related non-essential technologies are loaded only in accordance with your consent choice or after you actively request the content, depending on the implementation.

14. External FAQ and website widgets

We may use external FAQ, store locator or other website widgets. These components may establish a connection to the provider when loaded and may process technical data such as IP address, browser information, page viewed, session identifiers and interactions with the component.

External components are categorised according to their purpose and are loaded in accordance with your consent choice where they are not technically necessary.

15. Social media links

Our website may contain links to social media platforms such as Instagram, Facebook or other external services. When these are simple links, personal data are generally transmitted to the platform only after you click the link. The platform operator is responsible for the subsequent processing on its service.

Part B: CIGSOR app, sensors and connected services

16. User accounts and app access

To use the CIGSOR app and connected services, you may need to create a user account. We may process your name, email address, user ID, authentication data, language, preferences, account status, device information, login events and security logs.

We use these data to create and manage the account, authenticate users, provide app functions, synchronise data, protect the service from unauthorised access, communicate service-related information and support account recovery.

17. Sensor, humidor and cloud data

When you connect a CIGSOR sensor, we process data required to operate and monitor the device. This may include sensor ID, device assignment, humidor name, humidity and temperature measurements, battery status, WiFi signal, connection status, timestamps, threshold settings, alerts, calibration information, airing events, synchronisation data and historical statistics.

These data are used to display current and historical values, generate alerts, provide multi-humidor views, troubleshoot connection issues, maintain the service and improve reliability.

The CIGSOR app, sensor backend and connected functions are operated by X-SOR AG. X-SOR AG uses specialised cloud, hosting, security and communications providers. The cloud infrastructure is supported by Google Cloud Platform and may involve processing by Google group companies and their service providers.

18. WiFi setup and connectivity data

The CIGSOR sensor requires network configuration to connect to a compatible WiFi network. During setup, the app and sensor may process network configuration data required to establish the connection, such as the selected network name and connection credentials.

These data are used only to configure and maintain the sensor connection and are not used for unrelated marketing purposes. Technical connection information, signal strength, connection status and error data may be processed for diagnostics and support.

19. App permissions and push notifications

Depending on the function used, the app may request access to the camera, photo library, notifications, network information, device storage or location. Access is granted only after you approve the relevant permission in your device settings, and you can change permissions at any time.

If you enable push notifications, a device or push token and notification preferences are processed to deliver alerts concerning humidity, temperature, battery, connectivity or other selected events.

Depending on your device, push notifications and app distribution may involve Apple Inc., Apple Distribution International Ltd., Google LLC, Google Ireland Limited or related service providers. The operating system provider may process a device token and technical delivery information.

20. Humidor sharing and alert forwarding

The app may allow you to share humidor information with another person or forward alerts to an email address. If you use these functions, we process the recipient information and the selected humidor, sensor, measurement or alert data required to provide access or deliver the notification.

You are responsible for ensuring that you are authorised to provide the recipient details and share the selected data. You can change or revoke sharing permissions through the available app settings.

21. Cigar inventory and Cigar Scanner

The app may allow you to maintain a cigar inventory, including cigar names, quantities, notes, humidor assignment and photographs.

The Cigar Scanner allows you to capture or upload an image of a cigar and search for similar cigars, comparable selections or related information. X-SOR AG processes the image and associated technical data to provide the requested recognition and search function.

For technical image processing, search, hosting and security, X-SOR AG may use specialised service providers acting on its behalf. Images and results are not used for advertising or published publicly without a separate permission or another valid legal basis.

Please avoid including people, personal documents or other unnecessary personal information in scanner images.

22. Lounge locator and location data in the app

The app may provide a lounge locator or other location-based functions. Depending on your settings, the function may use an entered location, approximate location derived from technical data or precise device location after you grant permission.

Location data are used to display relevant places and results. You can disable precise location access through your device settings and, where available, search by entering a location manually.

23. App stores

When you download or update the CIGSOR app, the relevant app store operator processes data independently, including account, device, download, diagnostic and payment information where applicable.

For iOS, the relevant provider is an Apple group company. For Android, the relevant provider is a Google group company. Their own privacy policies apply to app store processing.

Part C: General provisions

24. Service messages and marketing communications

We may send service-related messages that are necessary for your account, sensor operation, security, orders, support enquiries, warranty handling or changes to our services. These messages are not marketing communications.

If you subscribe to a newsletter or otherwise consent to marketing communications, we may use your name, email address, language, product interests and information about the registration to send product news, offers, guides or other CIGSOR information.

You can unsubscribe at any time using the link in the message or by contacting us. We may retain a minimal suppression record to ensure that your opt-out continues to be respected.

25. Recipients and service providers

We disclose personal data only where this is necessary for the relevant purpose, legally required or otherwise permitted. Recipient categories may include:

• employees and authorised representatives of X-SOR AG;

• website, hosting, cloud, app, IT and security providers;

• Wix and its affiliates and sub-processors;

• Usercentrics;

• Google, including Google Analytics, YouTube and Google Cloud Platform;

• Stripe and its payment, fraud-prevention and financial service providers;

• MapTiler, store locator and other map or location service providers;

• external FAQ and website widget providers;

• email, push notification and communications providers;

• postal, courier, transport, fulfilment and logistics providers;

• accounting, invoicing, legal, audit and professional advisers;

• authorities, courts and other public bodies where required by law;

• parties involved in a merger, acquisition, restructuring or sale of assets, subject to applicable safeguards.

Service providers acting as processors are contractually required to process personal data only for the agreed purposes and in accordance with applicable data protection requirements.

26. International data transfers

Personal data may be processed in Switzerland, the European Economic Area, Israel, the United States and other countries in which our service providers or their sub-processors operate.

Where personal data are transferred to a country that is not recognised as providing an adequate level of data protection, we use appropriate safeguards where required, such as recognised standard contractual clauses, Swiss adaptations to such clauses, recognised data privacy frameworks, contractual and organisational measures, encryption or access restrictions. In legally permitted cases, a transfer may also rely on an applicable exception.

27. Retention and deletion

We retain personal data only for as long as necessary for the relevant purpose or as required by law, contract, security, evidence or legitimate business needs.

27.1 Website, consent and analytics data

Technical logs, cookie data, consent records and analytics data are retained according to the operational need, security requirements, consent configuration and storage periods shown in the cookie settings or the relevant service configuration.

27.2 Orders and business records

Order, invoice, payment confirmation, accounting and business correspondence data are generally retained for the periods required by Swiss tax, accounting and commercial law, typically up to ten years where applicable.

27.3 Support data

Support and warranty data are retained for as long as required to resolve the enquiry, document the service or warranty case, improve support and address possible claims or legal obligations.

27.4 Accounts, app and sensor data

Account, sensor, humidor, inventory and app data are retained while your account or connected service is active and afterwards for a limited period where required for backup, security, contractual obligations, legal claims or statutory retention. Data may be deleted or anonymised when no longer required.

Backup copies are deleted or overwritten within the regular backup cycle unless a legal or security reason requires longer retention.

28. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful processing, accidental loss, alteration, disclosure or destruction. Measures may include access controls, authentication, encryption in transit, security logging, backups, system monitoring, vulnerability management, staff confidentiality obligations and contractual requirements for service providers.

No system can guarantee absolute security. You are responsible for keeping your login credentials confidential and for using secure devices and networks.

29. Your rights

Subject to applicable law, you may have the right to:

• request information about personal data processed about you;

• request correction of inaccurate or incomplete data;

• request deletion or destruction of data;

• object to certain processing;

• request restriction of processing where applicable;

• withdraw consent with effect for the future;

• request the release or portability of certain data in a commonly used electronic format;

• lodge a complaint with a competent data protection authority.

• 
  

To exercise your rights, contact support@cigsor.com. We may request suitable proof of identity to protect your data against unauthorised disclosure.

In Switzerland, the competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. Where the GDPR applies, you may also have the right to lodge a complaint with a competent European supervisory authority.

30. Automated decisions

CIGSOR does not normally make decisions based solely on automated processing that produce legal effects or similarly significant effects for you. Sensor alerts, scanner results, recommendations and automated classifications provide information or assistance and do not replace your own assessment or a human decision where one is required.

31. Data relating to children

CIGSOR products and services are not directed at children. We do not knowingly request personal data from children through the website, shop or app. If you believe that a child has provided personal data without appropriate authorisation, please contact us.

32. External links

Our website and app may contain links to third-party websites, shops or services. The respective third party is responsible for its own processing once you access the external service. We recommend reviewing the relevant privacy information before providing personal data.

33. Changes to this Privacy Policy

We may update this Privacy Policy when our data processing, products, technology, service providers or legal requirements change. The current version is published on our website and may also be made available in the app.

Where a change requires consent, we will request it separately. Continued use of the website, app or services does not by itself constitute consent to processing that legally requires an active choice.

34. Contact

For questions about this Privacy Policy or the processing of personal data, please contact:

X-SOR AGCIGSOR PrivacyMüligässli 18598 BottighofenSwitzerlandEmail: support@cigsor.com