Privacy policy

This is a translation for information. Only the German version is legally binding: German version

Preamble

With the following privacy policy we would like to inform you about which types of your personal data (hereinafter also referred to as "data") we process, for which purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online services").

The terms used are not gender-specific.

Last updated: 27 October 2026

Table of contents

Controller

Weinlabels Patrick Schöller
Salzgasse 11
74206 Bad Wimpfen
Germany

Email: impressum@weinlabels.de

Legal notice: /en/legal-notice

Overview of processing

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

  • Master data.
  • Payment data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta, communication and process data.

Categories of data subjects

  • Customers.
  • Prospective customers.
  • Communication partners.
  • Users.
  • Business and contractual partners.

Purposes of processing

  • Provision of contractual services and customer service.
  • Contact requests and communication.
  • Security measures.
  • Direct marketing.
  • Office and organisational procedures.
  • Management and answering of enquiries.
  • Feedback.
  • Provision of our online services and usability.
  • Information technology infrastructure.

Relevant legal bases

Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or establishment. If more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6(1)(1)(a) GDPR) - The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1)(1)(c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(1)(f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains in particular special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transfer, as well as automated individual decision-making including profiling. It also regulates data processing for employment purposes (§ 26 BDSG), in particular with regard to the establishment, performance or termination of employment relationships and the consent of employees. Furthermore, the data protection laws of the individual German federal states may apply.

Security measures

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the differing likelihood and severity of the threat to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, disclosure, securing of availability and separation of the data. We have also established procedures to ensure that data subjects' rights are exercised, data is erased and responses are made to threats to the data. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

TLS encryption (https): To protect the data transmitted via our online services, we use TLS encryption. You can recognise such encrypted connections by the prefix https:// in the address bar of your browser.

Transfer of personal data

In the course of our processing of personal data, the data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and in particular conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

Data transfer within the organisation: We may transfer personal data to other units within our organisation or grant them access to this data. Where this transfer takes place for administrative purposes, it is based on our legitimate business and commercial interests, or takes place if it is necessary to fulfil our contractual obligations or if the data subjects have given their consent or there is a legal permission.

Erasure of data

The data processed by us will be erased in accordance with the legal requirements as soon as the consents permitting its processing are withdrawn or other permissions cease to apply (e.g. if the purpose of processing this data no longer applies or it is not required for the purpose). If the data is not erased because it is required for other and legally permissible purposes, its processing will be restricted to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Our data protection notices may also contain further information on the retention and erasure of data that takes precedence for the respective processing operations.

Use of cookies

Public pages of Weinlabels.de: The public information pages (home page, guide, FAQ, contact and legal texts) do not set cookies and do not store any data in the browser. Fonts and all other content are loaded from our own server; no third-party services are embedded. Cookies are only used in the customer area after login, insofar as this is technically necessary for logging in.

Cookies are small text files or other storage notes that store information on end devices and read information from end devices. For example, to store the login status in a user account, the contents of a shopping basket in an online shop, the content accessed or the functions used in an online service. Cookies can also be used for various purposes, e.g. for the functionality, security and convenience of online services and for analysing visitor flows.

Notes on consent: We use cookies in accordance with the statutory provisions. We therefore obtain prior consent from users, unless this is not required by law. Consent is not required in particular if the storage and reading of information, including cookies, is strictly necessary in order to provide users with a telemedia service (i.e. our online services) that they have expressly requested. Strictly necessary cookies usually include cookies with functions that serve the display and operability of the online services, load balancing, security, the storage of users' preferences and choices, or similar purposes related to the provision of the main and secondary functions of the online services requested by users. Revocable consent is clearly communicated to users and contains information on the respective use of cookies.

Notes on legal bases under data protection law: The legal basis under data protection law on which we process users' personal data with the help of cookies depends on whether we ask users for consent. If users consent, the legal basis for processing your data is the consent given. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. in the commercial operation of our online services and improving their usability) or, if this is done in the context of fulfilling our contractual obligations, if the use of cookies is necessary to fulfil our contractual obligations. We explain the purposes for which we process cookies in the course of this privacy policy or as part of our consent and processing procedures.

Storage period: With regard to the storage period, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their end device (e.g. browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved or preferred content displayed directly when the user visits a website again. Likewise, user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information on the type and storage period of cookies (e.g. when obtaining consent), users should assume that cookies are permanent and that the storage period can be up to two years.

General information on withdrawal and objection (opt-out): Users can withdraw the consent they have given at any time and also object to the processing in accordance with the legal requirements of Art. 21 GDPR. Users can also declare their objection via the settings of their browser, e.g. by deactivating the use of cookies (which may also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

  • Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Business services

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as "contractual partners"), in the context of contractual and comparable legal relationships and related measures and in the context of communication with the contractual partners (or pre-contractually), e.g. to answer enquiries.

We process this data in order to fulfil our contractual obligations. These include in particular the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. In addition, we process the data to safeguard our rights and for the purpose of the administrative tasks associated with these obligations and the organisation of our business. Furthermore, we process the data on the basis of our legitimate interests in proper and economic business management and in security measures to protect our contractual partners and our business operations from misuse, endangerment of their data, secrets, information and rights (e.g. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only pass on the data of contractual partners to third parties insofar as this is necessary for the aforementioned purposes or to fulfil legal obligations. Contractual partners are informed about other forms of processing, e.g. for marketing purposes, within the scope of this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g. in online forms, by special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We erase the data after the expiry of statutory warranty and comparable obligations, i.e. in principle after 4 years, unless the data is stored in a customer account, e.g. for as long as it must be retained for legal archiving reasons. The statutory retention period is ten years for documents relevant under tax law as well as for commercial books, inventories, opening balance sheets, annual financial statements, the work instructions and other organisational documents required to understand these documents and accounting vouchers, and six years for commercial and business letters received and copies of commercial and business letters sent. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance sheet, the annual financial statements or the management report was prepared, the commercial or business letter was received or sent, or the accounting voucher was created, or the record was made or the other documents were created.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

  • Types of data processed: Master data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. email, telephone numbers); contract data (e.g. subject matter of the contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time stamps, identification numbers, consent status).
  • Data subjects: Customers; prospective customers; business and contractual partners.
  • Purposes of processing: Provision of contractual services and customer service; security measures; contact requests and communication; office and organisational procedures; management and answering of enquiries.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legal obligation (Art. 6(1)(1)(c) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Customer account: Contractual partners can create an account within our online services (e.g. customer or user account, "customer account" for short). If the registration of a customer account is required, contractual partners will be informed of this as well as of the information required for registration. Customer accounts are not public and cannot be indexed by search engines. In the course of registration and subsequent logins and use of the customer account, we store the IP addresses of the customers together with the access times in order to be able to prove the registration and prevent any misuse of the customer account. If customers have terminated their customer account, the data relating to the customer account will be erased, unless its retention is required for legal reasons. It is the responsibility of customers to back up their data when the customer account is terminated; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).
  • Provision of software and platform services: We process the data of our users, registered users and any test users (hereinafter uniformly referred to as "users") in order to provide them with our contractual services and on the basis of legitimate interests in order to ensure the security of our offer and to develop it further. The required information is marked as such in the context of the order, purchase or comparable conclusion of contract and includes the information required for the provision of services and invoicing as well as contact information in order to be able to hold any consultations; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).

Provision of the online services and web hosting

We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or end device.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time stamps, identification numbers, consent status); content data (e.g. entries in online forms).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of our online services and usability; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures.
  • Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Provision of online services on rented storage space: To provide our online services, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also called a "web host"); Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).
  • Collection of access data and log files: Access to our online services is logged in the form of so-called "server log files". Server log files may include the address and name of the websites and files accessed, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files can be used for security purposes, e.g. to avoid overloading the servers (especially in the event of abusive attacks, so-called DDoS attacks), and to ensure the utilisation and stability of the servers; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); Erasure of data: Log file information is stored for a maximum of 30 days and then erased or anonymised. Data whose further retention is required for evidentiary purposes is exempt from erasure until the respective incident has been finally clarified.
  • Email sending and hosting: The web hosting services we use also include the sending, receipt and storage of emails. For these purposes, the addresses of the recipients and senders as well as other information relating to the sending of emails (e.g. the providers involved) and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting SPAM. Please note that emails on the internet are generally not sent in encrypted form. As a rule, emails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. We can therefore accept no responsibility for the transmission path of emails between the sender and receipt on our server; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).
  • STRATO: Services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: STRATO AG, Pascalstraße 10, 10587 Berlin, Germany; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://www.strato.de; Privacy policy: https://www.strato.de/datenschutz; Data processing agreement: Provided by the service provider.

Registration, login and user account

Users can create a user account. During registration, users are informed of the mandatory information required, which is processed for the purpose of providing the user account on the basis of the fulfilment of contractual obligations. The data processed includes in particular the login information (password and an email address).

When using our registration and login functions and the user account, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests and those of the users in protection against misuse and other unauthorised use. As a matter of principle, this data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users may be informed by email about processes relevant to their user account, such as technical changes.

  • Types of data processed: Master data (e.g. names, addresses); contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); meta, communication and process data (e.g. IP addresses, time stamps, identification numbers, consent status).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; security measures; management and answering of enquiries; provision of our online services and usability.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Registration with real names: Due to the nature of our community, we ask users to use our services only under their real names. This means that the use of pseudonyms is not permitted; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).

Contact and enquiry management

When contacting us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the information provided by the enquiring persons is processed insofar as this is necessary to answer the contact requests and any requested measures.

  • Types of data processed: Contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time stamps, identification numbers, consent status).
  • Data subjects: Communication partners.
  • Purposes of processing: Contact requests and communication; management and answering of enquiries; feedback (e.g. collecting feedback via online form); provision of our online services and usability.
  • Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Contact form: If you write to us using the contact form, your name, your email address, your message and the language of the page are sent to us by email so that we can answer your enquiry. This information is not stored on the web server. No automatic confirmation is sent to the email address entered; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).
  • Protection against misuse of the contact form: To prevent automated mass enquiries, we use our own arithmetic question without third-party services and without cookies, as well as a limit on the number of enquiries. For this limit, a check value (hash) is generated from your IP address using a secret key that changes every hour. The IP address itself is not stored and cannot be recovered from the check value. The check value and the time of the enquiry are stored for no more than 60 minutes and are then erased automatically; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR) in the security and availability of the contact form.

Newsletters and electronic notifications

We send newsletters, emails and other electronic notifications (hereinafter "newsletters") only with the consent of the recipients or on the basis of a legal permission. If the contents of the newsletter are specifically described when registering for it, they are decisive for the consent of the users. Otherwise, our newsletters contain information about our services and about us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for the purpose of addressing you personally in the newsletter, or further information if this is necessary for the purposes of the newsletter.

Double opt-in procedure: Registration for our newsletter generally takes place in a so-called double opt-in procedure. This means that after registering you will receive an email asking you to confirm your registration. This confirmation is necessary so that nobody can register with someone else's email address. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Changes to your data stored with the mailing service provider are also logged.

Erasure and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before erasing them in order to be able to prove previously given consent. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for erasure is possible at any time, provided that the former existence of consent is confirmed at the same time. In the event of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a block list.

The registration procedure is logged on the basis of our legitimate interests for the purpose of proving that it was carried out properly. If we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure mailing system.

Contents: Information about us, our services, promotions and offers.

  • Types of data processed: Master data (e.g. names, addresses); contact data (e.g. email, telephone numbers); meta, communication and process data (e.g. IP addresses, time stamps, identification numbers, consent status); usage data (e.g. websites visited, interest in content, access times).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g. by email or post).
  • Legal bases: Consent (Art. 6(1)(1)(a) GDPR).
  • Option to object (opt-out): You can cancel the receipt of our newsletter at any time, i.e. withdraw your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter, or you can use one of the contact options given above, preferably email.

Further information on processing operations, procedures and services:

  • Measurement of opening and click rates: The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from our server when the newsletter is opened or, if we use a mailing service provider, from its server. In the course of this retrieval, technical information such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected. This information is used for the technical improvement of our newsletter on the basis of the technical data or the target groups and their reading behaviour on the basis of their retrieval locations (which can be determined with the help of the IP address) or the access times. This analysis also includes determining whether the newsletters are opened, when they are opened and which links are clicked. This information is assigned to the individual newsletter recipients and stored in their profiles until they are erased. The evaluations help us to recognise the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of opening rates and click rates and the storage of the measurement results in the users' profiles; Legal bases: Consent (Art. 6(1)(1)(a) GDPR).

Amendment and updating of the privacy policy

We ask you to inform yourself regularly about the content of our privacy policy. We will adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organisations in this privacy policy, please note that the addresses may change over time and please check the information before contacting them.

Rights of data subjects

As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:

  • Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consent given at any time.
  • Right of access: You have the right to request confirmation as to whether the data in question is being processed and to obtain access to this data as well as further information and a copy of the data in accordance with the legal requirements.
  • Right to rectification: In accordance with the legal requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be erased without delay or, alternatively, in accordance with the legal requirements, to request a restriction of the processing of the data.
  • Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
  • Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

German original created with the free Datenschutz-Generator.de by Dr. Thomas Schwenke