Data protection information according to Art. 13 GDPR
Since 25 May 2018, the requirements of the EU General Data Protection Regulation (hereinafter: GDPR) apply throughout Europe. In the following, we would like to inform you about the processing of personal data by Whisky.de GmbH & Co. KG ('Whisky.de') in accordance with this new regulation (see Article 13 GDPR). In particular, this data protection information also applies to the use of the online shops operated by Whisky.de on the domains whisky.de and whisky.com. Please read our data protection information carefully. If you have any questions or comments about this data protection information, please send them at any time to the e-mail address listed in section 2.
Details & settings for cookies and third-party toolsContent
3.1 Visits to our website/application
3.2 Conclusion, execution or termination of a contract
3.3 Data processing for advertising purposes
3.4 Online presence and website optimization
4 Data transfer to recipients outside the EU
7 Changes to the data protection notice
1 Overview
The following data protection information explains the nature and extent of the processing of so-called personal data by Whisky.de GmbH & Co. KG ("Whisky.de"). Personal data is information that is or can be directly or indirectly attributed to you.
Data processing by Whisky.de can basically be divided into two categories:
- For the purpose of contract processing when shopping in the shop, all data necessary for the execution of a contract with Whisky.de are processed. If the processing of the contract also involves external service providers, for example logistics companies or payment services, your data will be transferred to them to the extent necessary.
- When you access the Whisky.de/.com website and use the Whisky.de/.com community, various information is exchanged between the device you are using and our server. This may include personal data. The information thus collected is used, among other things, to optimise our website or to display advertising in the browser of your (mobile) device.
In accordance with the provisions of the GDPR, you have various rights that you can assert against us. This includes the right to object to selected data processing, in particular data processing for advertising purposes.
If you have any questions about our data protection information, you are welcome to contact our corporate data protection officer at any time. You can find the contact details below.
2 Name and contact details of the controller of personal information as well as the company data protection officer
This data protection information applies to data processing by Whisky.de GmbH & Co. KG, Am Grundwassersee 4, D-82402 Seeshaupt, VAT DE306436528, registration number HRA 105355, Registergericht Amtsgericht München ("Responsible Party") and for the following websites or applications: www.Whisky.de or www.Whisky.com as well as all associated domains and subdomains (<>Whisky.de/<> bzw. <>Whisky.com/<>).
Ms Martina Demmel, Speer EDV GmbH has been appointed data protection officer of Whisky.de. The data protection officer can be contacted at the above address, attn Mrs Martina Demmel or at datenschutz@whisky.de.
3 Purpose of data processing, legal bases and legitimate interests of Whisky.de and categories of recipients
This section explains the purposes of data processing, the legal bases and legitimate interests of Whisky.de and the categories of recipients of your personal data.
3.1 Visits to our website/application
When you access our website/application, the browser on the device you are using automatically sends information to the server of our website/application and stores it temporarily in a so-called log file. This occurs via (and after) the placement of cookies (see below).The following information is collected, if necessary after your express approval (see below for the various categories of cookies) and stored until it is automatically deleted:
- the IP address of the requesting Internet-connected device,
- the date and time of access
- the name and URL of the requested file,
- the website/application from which the access took place (referrer URL),
- the browser you are using and, if applicable, the operating system of your Internet-connected computer as well as the name of your access provider.
The legal basis for processing the aforementioned data is Article 6(1f) of the GDPR, namely our legitimate interest arising from and coinciding with the purposes of data collection mentioned below. At this point, we would like to point out that we cannot and will not draw any direct conclusions about your identity from the data collected.
The IP address of the device used by you and the other data mentioned above are used by us for the following purposes:
- Ensuring a trouble-free connection,
- Ensuring comfortable use of our website/application,
- Evaluating system security and stability.
- Provision to law enforcement agencies for criminal prosecution in case of cyber attacks or fraud.
The data is stored for a period of two months and then automatically deleted, insofar as it is not subject to a legal retention obligation. Furthermore, for our website/application we use so-called cookies, analysis tools, targeting methods and social media plug-ins for purposes other than those mentioned above. The exact procedures and how your data is used for these purposes are explained in more detail below in section 3.4.
If you have consented to so-called geolocation in your browser or in the operating system or other settings of your device, we use this function to offer you individual services related to your current location. We use your location data thus processed exclusively for this function. If you stop using it, the data will be deleted.
3.2 Conclusion, execution or termination of an agreement
3.2.1 Data processing when concluding the agreement
The purpose of Whisky.de's activities is the distance selling of goods and services, retailing within the framework of the licences granted by the authorities and the serial production of the goods to be offered. In this context, we process the data necessary for the conclusion, performance or termination of a contract with you. This includes:
- first name, surname
- billing and delivery address
- e-mail address
- billing and payment details
- date of birth for age verification
- telephone number for questions
Legal basis for this is Article 6(1b) of the GDPR, i.e. you make the data available to us on the basis of the relevant contractual agreement between you and us. We are also obliged to process your e-mail address due to legal requirements for sending an electronic order confirmation (Article 6(1c) of the GDPR). Insofar as we do not use your contact data for advertising purposes (see 3.3 below), we retain the data collected for the settlement of the contract until the expiry of statutory deadlines or any contractual guarantee and warranty rights. After expiry of this period, we retain the information required by commercial and tax law from the contractual agreement for the statutory period. During this period (as a rule, ten years after the conclusion of the contract), the data will be reprocessed only in the event of a possible audit by the tax authorities.
The following data processing is also required for the settlement of the purchase agreement:
When you enter your address, we help you with suggestions and validate your entry with the help of the service provider Loqate GBG to prevent incorrect data entry which makes fulfilment of the contract more difficult.
If you have chosen a payment method other than prepayment or cash on delivery, we will pass on the necessary payment details to a payment service provider appointed by us.
The addresses entered when completing an order or creating a customer account in the Whisky.de shop are forwarded to an external service provider for address suggestions and address verification. This serves to ensure correct delivery addresses within the scope of contract performance and to make address preparation as easy as possible for the user.
Furthermore, we transfer the necessary details of your order to a logistics company engaged by us for the processing of the purchase agreement. To ensure that the goods are delivered according to your wishes, we pass on your e-mail address and possibly your telephone number to the logistics company appointed by us. The logistics company may contact you prior to delivery to coordinate delivery details with you. The data is transmitted solely for this purpose and deleted again after delivery. In addition, we guarantee that we have concluded the necessary processing contracts with external suppliers.
3.2.2 Creditworthiness and transfer to credit bureaus
When you place an order and request a payment method that involves a credit risk for Whisky.de, we will check your creditworthiness. To this end, we will transfer your data to various credit bureaus, depending on the country.
3.2.2.1 Credit assessment for address in Germany
If you have an address in Germany, we will transfer your data (name, address and date of birth) for credit assessment to infoscore Consumer Data GmbH (ICD), Rheinstr. 99, 76532 Baden-Baden.
The legal basis for this transfer is Article 6 paragraph 1b) and Article 6 paragraph 1f) of the GDPR. Forwarding on the basis of these provisions is permitted only insofar as this is necessary to safeguard the legitimate interests of our company or third parties and does not outweigh the interests of the fundamental rights and freedoms of the data subjects requiring the protection of personal data. Detailed information on the ICD within the meaning of Article 14 of the European Data Protection Regulation, i.e. information on the business purpose, the purposes of data storage, the recipients of the data, the right to access, the right to erasure or correction, etc., can be found via the following link: https://www.experian.de/content/dam/marketing/emea/germany/de/assets/Informationsblatt-Art-14-2021-06-24-.pdf.
3.2.2.2 Credit assessment for address in Austria
If you have an address in Austria, we transfer your data (name, address and possibly date of birth) to Experian Austria GmbH, Gumpendorfer Straße 21, 1060 Vienna in order to check your creditworthiness, obtain information for the assessment of the risk of non-payment based on mathematical-statistical methods using economic data and address data, whereby this data is not used for an automated decision, as well as for the verification of your address (deliverability check).
The legal bases for this transfer are Article 6(1b), and Article 6(1f) of the GDPR. Transfer on the basis of these provisions is only permitted insofar as this is necessary to safeguard the legitimate interests of our company or third parties and does not outweigh the interests of the fundamental rights and freedoms of the data subjects requiring the protection of personal data. Our legitimate interest is to request information on the creditworthiness and address verification of our customers in order to better assess the risk associated with our pre-delivery services for certain types of payments and delivery of goods and documents to addresses. Detailed information on data processing by Experian Austria GmbH within the meaning of Art. 14 GDPR can be found on their website at https://www.experian.at/art-14-dsgvo-info.
3.2.2.3 Consequences of a negative credit assessment
If a credit assessment is negative based on the data provided, we reserve the right to restrict your payment methods before further processing your order. In all automated processes of Whisky.de GmbH & Co. KG, there is no direct disadvantage to you (such as an automatic order rejection), but one of our employees will process your order if one or more checks are negative.
3.2.2.4 Overdue payments and direct debit
In case of an overdue payment, we will transfer the necessary data to a company within the EEA in charge of enforcing the claim if the other legal requirements are met. The legal bases for this are both Article 6(1b) and Article 6(1f) of the GDPR. The enforcement of a contractual claim should be considered a legitimate interest within the meaning of the second provision.
3.3 Data processing for advertising purposes
The following statements relate to the processing of personal data for advertising purposes. The GDPR declares such data processing based on Article 6(1f) as conceivable in principle and as legitimate interest. The duration of data storage for advertising purposes is not based on rigid principles, but is based on our database of active, existing customers, whose last order took place no longer than 3 years ago. At Whisky.de, we also follow the principle of deleting data for promotional use after 3 years without use. You can read how your objection procedure is handled in section 3.3.2.
3.3.1 Promotional purposes of Whisky.de
If you have entered into a contract with us, we will treat you as an existing customer. In this case, we process your naw data without specific consent in order to send you information about new products and services in writing in this way. We process your e-mail address to send you information about our own similar products without specific consent. This is in our legitimate interest.
3.3.2 Right of objection
You can object to data processing for advertising purposes free of charge at any time. To do so, simply send an e-mail or a letter to the contact details listed in point 2.
If you object, the relevant contact address will be blocked from further data processing for advertising purposes. Please note that in exceptional cases, advertising material may still be sent temporarily after receipt of your objection. This is technically due to the necessary, reasonable time we need to process your objection request and does not mean that we will not implement your objection. Thank you very much for your understanding.
3.3.3 Transmission of the newsletter
On our website, we offer you the opportunity to subscribe to our newsletter. To ensure that no mistakes were made when entering the e-mail address, we use the so-called double opt-in procedure: After you enter your e-mail address in the registration field, we will send you a confirmation link. Only if you click on this confirmation link will your e-mail address be added to our list.
You can revoke your consent thus granted at any time with effect for the future. To do so, it suffices to unsubscribe from the newsletter via the link at the end of each newsletter sent or a short message by e-mail to the e-mail address listed at 2.
To send our newsletter, we use a product of an external provider to whom we transfer the data you provided when registering for the newsletter. The transfer takes place in accordance with Art. 6 (1f) of the GDPR as it serves our legitimate interest regarding the use of a secure, effective and user-friendly system for sending newsletters. The service provider appointed by us uses the transmitted data exclusively for sending the newsletter and for the statistical evaluation of the newsletter on our behalf. For evaluation purposes, the e-mails sent via our service provider contain so-called tracking pixels or web beacons that make it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked on. Using this data, the service provider creates non-personal statistics for us about the success of our newsletters and the response behaviour of those interested in our newsletter.
All servers of the service provider working on our behalf are located in selected data centres in Germany and are ISO 27001-certified. Moreover, we have concluded the necessary processing contracts with the provider.
3.4 Online presence and website optimization
3.4.1 Cookies - general notes
We use so-called cookies on our website. We use necessary cookies to optimise our website and to statistically record and evaluate the use of our website for optimisation and security purposes. We base the processing of your data by the cookies and pixels used for the aforementioned technically necessary purposes on our legitimate interest in accordance with Art. 6 (1) sentence 1f) of the GDPR which is to be regarded as justified within the meaning of the aforementioned provision.
Moreover, we also use other cookies (i.e. functional, analytical and/or marketing cookies) and process the data via the cookies used only on the basis of your consent in accordance with art. 6 par. 1 sentence 1a) of the GDPR. You can revoke your consent at any time with effect for the future via our Consent Management Tool. You can open the Consent Management Tool again at any time by clicking on the button at the top of this webpage.
Cookies are small files automatically created by your browser and stored on your own device (laptop, tablet, mobile phone or similar) when you visit our site. The cookie stores information related to the specific device you are using. However, this does not mean that it allows us to directly identify you. The use of cookies serves, on the one hand, to make the use of our services more pleasant for you. For example, we use so-called (functional) session cookies to recognise whether you have previously visited individual pages on our website or whether you have already logged into your customer account. These are automatically deleted when you leave our site or end your browser session. We also use temporary functional cookies for usability purposes, which are stored on the device you use for a certain fixed period of time. When you revisit our site to use our services, it automatically recognises that you have been with us before and what entries and settings you have made, so you do not have to enter them again.
If you have a Whisky.de customer account or a community account and you are logged in or you activate the function 'remain logged in', the information stored in cookies will be added to your account.
On the other hand, we use (analytical and/or marketing) cookies to statistically record and evaluate the use of our website in order to optimise our offer for you and to display information specifically tailored to you. These cookies enable us to automatically recognise that you have been with us before when you next visit our website. These cookies are automatically deleted after a certain period of time. However, completely disabling cookies and/or not giving your consent for this in our Consent Management Tool may result in you not being able to use all the functions of our website. The storage duration of cookies depends on their purpose of use.
3.4.2 Google Analytics
We use Google Analytics on our website, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) (hereinafter "Google"). In this context, pseudonymous usage profiles are created and cookies are used. The information generated by the cookie about your use of this website, such as
- browser type/version,
- operating system used,
- referrer URL (the page visited for this purpose),
- host name of the contacting computer (IP address),
- time of the server request,
may be sent to a Google server in the USA and stored there (see our processing agreement with Google on this subject: https://business.safety.google/adsprocessorterms/sccs/eu-c2p/). The information will be used to evaluate the use of the website, to compile reports on the website activities and to enable other services related to the use of the website and the use of the Internet for the purpose of market research and needs-based design of these Internet pages. This information may also be passed on to third parties, insofar as this is prescribed by law or if third parties process this data on behalf of us. Under no circumstances will your IP address be linked to other Google data. The IP addresses are anonymised so that linking is not possible (so-called IP masking).
Google processes the information on our behalf in order to evaluate the use of the website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage for the purpose of market research and to enable needs-based design of these websites. For the use of Google Analytics, we have concluded a processing contract with Google (see https://business.safe ty.google/adsprocessorterms/). Through this contract, Google ensures that they process the data in accordance with the GDPR and guarantee the protection of the data subject's rights.
The use of Google Analytics is based on your consent in accordance with Article 6 par. 1 sentence 1a) of the GDPR. In this case, you also consent to the transfer of your data to the US in accordance with Art. 49 para. 1 sentence 1a) of the GDPR, with full knowledge of the risks described above.
You can prevent the installation of cookies for Google Analytics by a setting in the browser software and not consent to the installation of the associated cookies in our Consent Management Tool (see above); however, we point out that in this case, not all functions of this website may be fully used. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing this browser add-on. As an alternative to the browser add-on, particularly for browsers on mobile devices, you can also prevent collection by Google Analytics by clicking on the following link:
An opt-out cookie is set which prevents the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If cookies are deleted in this browser, the opt-out cookie must be reset.
More information on data protection in conjunction with Google Analytics can be found on the Google Analytics website.
3.4.3 Targeting procedure
The targeting procedures listed below and used by us are carried out on the basis of Article 6(1f) of the GDPR. Through the targeting measures used, we aim to ensure that you only see advertising on the devices you use that is targeted to your actual or assumed interests. It is in your and our interest not to bother you with uninteresting advertisements.
3.4.3.1 Use of Google AdWords
We use the Google AdWords service to advertise our website by displaying ads that match your interests. Google AdWords is a service operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland. Google AdWords allows advertisers to place ads in Google's search engine results and in Google's advertising network. For this purpose, predefined keywords are defined by the advertiser. If a user retrieves a search result in the Google search engine that matches the keyword, the ads are filtered accordingly. Similarly, ads are placed on relevant websites in Google's ad network by means of an automatic algorithm, taking into account the specified keywords.
When a data subject visits a Whisky.de website via a Google AdWords ad, a conversion cookie is stored by Google on the data subject's system. Such a conversion cookie loses its validity after 30 days and is not used to identify the person concerned, but to check whether certain subpages of whisky.de (e.g. the shopping basket) are called up within the period and thus make the success of the advertising via AdWords measurable. The information collected by Google in the process may be used statistically by Whisky.de. However, it is not possible for Whisky.de or other Google AdWords advertisers to identify the individuals involved.
Google's conversion cookie stores personal data, e.g. the web pages you visit. With every visit to Whisky.de, personal data, including the IP address of the internet connection used by the individual concerned, is therefore potentially transmitted to Google in the US and stored there. Google may share this personal data with third parties. Please see our agreements with Google in this regard: https://business.safety.google/adscontrollerterms/sccs/eu-c2c/
More information and details about Google's privacy policy can be found under this link.
Whisky.de and Google are joint controllers regarding the processing of data resulting from the use of Ads. The agreements made in this regard can be found here: https://business.safety.google/adscontrollerterms/. This agreement provides that each data controller, namely Google and Whisky.de, will deal with the data subject's requests relating to the part of the processing for which they are respectively responsible.
3.4.3.2 Onsite targeting
On our website, information is collected and analysed using cookies to optimise advertising. Prior consent is requested from you for setting these cookies. This information includes, for example, details on which of our products interest you. The collection and evaluation takes place exclusively under a pseudonym and does not allow us to identify you. In particular, the information will not be merged with your personal data. Based on this information, we can show you offers on our site that are specifically tailored to your interests, as they result from your previous user behaviour. The cookie is automatically deleted after 30 days.
3.4.3.3 Objection/opt-out option
You can prevent the targeting technologies described by making the appropriate cookie settings in your browser and our Conent Management Tool (see also 3.4.1) and delete existing cookies on your device via the Internet browser settings or using other software. In addition, you have the option to disable preference-based advertising for different providers using the preferences manager available here. Personalised advertising from Google can be disabled on this page.
3.4.4 Use of Google Maps
Whisky.de uses the Google Maps API in some places to visually map geographical information. The Google Maps service is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). When using Google Maps, Google also collects, processes and uses data on the use of the map functions by visitors to our website.
More information on Google's processing of data can be found in the Google Maps terms of use and privacy policy.
3.4.5 Use of the Google reCaptcha
At certain places on our website and for conspicuous requests, we use the 'Google reCaptcha' service (hereinafter reCaptcha) to protect us from misuse by automated programs (bots), spam or cyber-attacks on our online presence. The reCaptcha service is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland - ('Google').
Using reCaptcha, we try to check whether the relevant data entry on our websites (e.g. in the contact form, during registration) is made by a human or by a bot. To this end, reCaptcha analyses a visitor's behaviour based on various characteristics. For this analysis, reCaptcha evaluates various information (e.g. IP address, behaviour on the page in question). The data collected in the process is forwarded to Google.
Data processing through the use of Google reCaptcha takes place on the basis of Article 6(1f) of the GDPR legitimate interest). Whisky.de has a legitimate interest in protecting its website from abuse, cyber attacks and SPAM. This serves not least to protect the data stored on Whisky.de from criminal access.
More information about Google reCaptcha can be found in Google's privacy policy and terms of use.
3.4.6 YouTube videos on Whisky.de/Whisky.com
We use components (videos) of the company Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as 'YouTube') on our website, a part of Google. This implementation is based on your consent in accordance with Article 6 par 1 sentence 1a) of the GDPR. By loading the videos on our website, data are transmitted to Google. In particular, Google receives which of our websites you have visited, as well as device-specific information, including the IP address.
Whisky.de uses YouTube videos exclusively in the so-called 'extended data protection mode', where, according to its own information, YouTube does not store any information about users on Whisky.de when the video is not viewed. However, when you call up a website with an embedded YouTube video, your browser connects to YouTube's servers to display a preview of the video. In doing so, YouTube/Google knows which Whisky.de page you are visiting.
When you launch an embedded video, Google also uses cookies that collect information about your user behaviour. If you want to prevent this, you must block the storage of cookies in the browser altogether. You can also completely prevent the loading of Google plug-ins with add-ons for your browser, for example with the script-blocker 'NoScript'.
If you are currently logged into YouTube with your YouTube or Google account, YouTube/Google can assign your surfing behaviour to you personally. You can prevent this by logging out of your Google or YouTube account beforehand.
More information about YouTube's data protection can be found in Google's privacy policy in the YouTube Privacy and Security Centre.
Whisky.de and Google are joint controllers. The agreements made in this regard can be found here: https://business.safety.google/controllerterms. This agreement provides that each controller will comply with the data subject's requests regarding the part of the processing for which they are respectively responsible. You can find Google's privacy policy, including all information on the processing of your personal data and how to exercise your rights at the following link: https://policies.google.com/privacy.
3.4.7 Instagram content on Whisky.de/Whisky.com
The Whisky.de websites contain content from the social network Instagram via relevant plug-ins. The operator of the embedded plug-ins is Metaplatforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland ('Meta'). This may include images, videos or text and buttons allowing users to express their preference for that content and/or subscribe to messages from the creators of that content and/or our messages. The content can be identified by the 'Instagram symbol'.
When you call up a website with embedded Instagram content, your browser connects to Instagram's servers to preview the content. If you are registered as a user on the social network Instagram and logged in to Instagram with the browser that is displaying the webpage at the same time, the pages visited may be assigned to your account by Instagram.
Please note that the content of the data transmitted and its use by Instagram are beyond our knowledge. More information on Instagram's privacy policy can be found on this Instagram website.
Whisky.de and Meta are joint data controllers. The agreements made in this regard can be found here: https://www.facebook.com/legal/controller_addendum. This agreement states that Meta will handle all requests from data subjects regarding personal data and/or rights granted by articles 15-20 of the GDPR. The information to be provided by Meta as joint data controller in accordance with Article 13(1)(a) and (b) GDPR is set out in its privacy policy, which can be accessed at the following link : https://www.facebook.com/about/privacy. This policy contains information on the legal basis for (data) processing by Meta and how to exercise your rights.
3.4.8 Use of Meta Pixel
This website uses Meta's visitor action pixel to measure conversions. The service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Meta, the data collected may also be transferred to the United States and other third countries.
Using the pixel, the behaviour of visitors who reach the Whisky.de/Whisky.com website via a Meta ad, for example on Meta platforms such as Instagram or Facebook, can be tracked. This enables us to evaluate the effectiveness of these ads for statistical and market research purposes and to optimise future advertising measures.
The data collected is anonymous to us as operator of this website and does not allow any conclusions about the identity of users. However, the data is stored and processed by Meta so that a link to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with its data use policy. This enables Facebook to display ads on Facebook pages and beyond. As a page administrator, we have no control over this use of the data. More information on the use and utilisation of the Meta Pixel can be found on the manufacturer's website: https://de-de.facebook.com/business/tools/meta-pixel.
The use of the Meta Pixel is based on Art. 6(1)(f) GDPR. As a website operator, we have a legitimate interest in effective advertising measures, including the use of social media. If the appropriate consent is obtained (e.g. consent to store cookies), processing is based solely on Art. 6(1)(a) GDPR (m.e. consent); consent can be withdrawn at any time.
The transfer of data to the United States is based on the European Commission's standard contractual clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.
For further information on the protection of your privacy, please refer to Facebook's privacy policy: https://de-de.facebook.com/about/privacy/.
You can also disable the remarketing feature "Custom audiences" in the ad settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen if you are logged into Facebook.If you do not have a Facebook account, you can disable Facebook's interest-based ads on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.
Whisky.de and Meta are joint controllers. The agreements made in this regard can be found here: https://www.facebook.com/legal/controller_addendum.
3.5 Customer account
To offer you the greatest possible convenience when shopping, your personal data are permanently stored in a password-protected customer account. Creating a customer account is voluntary and based on your consent within the meaning of Article 6(1a) of the GDPR. After creating a customer account, you do not have to enter your data again and again. Moreover, in your customer account you can view and change the data stored about you at any time.
In addition to the data requested when placing an order, you must enter a password of your choice to create a customer account. This serves together with your e-mail address to access your customer account. Please treat your personal access data confidentially and, above all, do not make it accessible to unauthorised third parties. We cannot accept liability for misused passwords unless we are responsible for the misuse. Please note that you will automatically remain logged in after leaving our website unless you actively log out. You have the option of having your customer account deleted at any time. To do so, please use the contact details listed under 2.
If you do not wish to create a customer account with Whisky.de, please use the option of ordering from Whisky.de by telephone.
3.5.1 Login via third parties (Facebook, Google, Apple, PayPal)
To make it easier for you to log into the Whisky.de shop, you can also voluntarily register at Whisky.de with your own Facebook, Google, Apple or PayPal account. You can recognise these by the corresponding buttons with the provider's name and logo on the registration pages or login pages in the shop below the username and password entry fields. It is also possible to subsequently link existing Whisky.de customer accounts to the services of these third parties. In both cases, instead of entering a username and password at Whisky.de, it is possible to log into the Whisky.de shop via the websites/services of these third parties.
When you click on the corresponding button, you will be redirected to the pages of this third-party provider to log in. If you successfully log in there, you will be asked to explicitly disclose the following data, depending on the provider:
- Facebook:
- email address
- name
- Google:
- email address
- name
- Apple:
- email address
- name
- address
- country
This data will be used by Whisky.de to create your new customer account or to log into your linked Whisky.de account and will not be made available to third parties. The transmission of the data is encrypted. This data is processed on the basis of your consent within the meaning of Article 6(1a) of the GDPR or, in the case of an order, also within the meaning of Article 6(1b) of the GDPR.
Please note that if you use this option voluntarily, the relevant third party may see that you are using our website due to Whisky.de's request to use your data. Also after linking your customer account, each time you log in via this link, the third-party provider will be contacted once to verify your identity. These procedures may be recorded by the third-party providers. For more information, please refer to the respective third-party providers' privacy policies and terms of use.
3.6 Community account
We run an Online Community for whisky lovers and connoisseurs to exchange ideas. This includes the use of the so-called Whisky/Flaschendatenbank, the Whisky.de Forum & the Whisky.de Blog. The use of the Community requires a Community account. The creation of a Community account is voluntary and is based on your consent within the meaning of Article 6(1a) of the GDPR. To create a user account, we require your e-mail and a freely selectable user name. Your e-mail address is not visible to other members. Providing further information (e.g. photo, first name, surname) is optional and done on a voluntary basis.
3.6.1 Logging in via third parties
To facilitate your registration with the Whisky.de community, whisky.de also offers you logging in via your own Facebook account ('logging in with Facebook') or your own Google/YouTube account ('logging in with Google/YouTube'). This enables you to log in to the Whisky.de community using the data stored by the relevant third party. When using this function, Whisky.de requests the following data from the named third parties: ID, email address, first name, last name and profile picture. The data is only used for account creation and subsequent logins and is not made accessible to third parties. The transmission of the data is encrypted.
Please note that if you use this option voluntarily, the relevant third party may see that you are using our website due to Whisky.de's request to use your data and may process it further.
3.6.2 Deleting the community account
You have the option to delete your Community account at any time. This will delete your data stored in the background (email address, first and last name, interests, profile picture). However, please note that your previous activities in the Community are not deleted at the same time and are still displayed under an anonymous user name ('[Verwijderde gebruiker]').
3.7 Contacting Whisky.de
3.7.1 Getting in touch
The online presence of Whisky.de provides you with a contact form and an e-mail address so that you can easily get in touch. If you contact Whisky.de by e-mail or via the contact form, your transmitted personal data will be stored automatically. We use the information you provide via the contact form (mandatory information is marked with an asterisk) exclusively to process your request. The legal bases for this are both your consent within the meaning of Article 6 (1a) of the GDPR and Article 6 (1f) of the GDPR. The correct processing of your request/problem is considered legitimate interest within the meaning of the GDPR. Furthermore, if you contact us in connection with a contractual relationship between you and us, Article 6(1b) of the GDPR, i.e. this contractual relationship, is the legal basis for data processing. You may withdraw your consent to the above data use at any time free of charge by sending a short message to the contact details listed under 1. This does not affect the lawfulness of the processing based on your consent until the time of your withdrawal. Please note, however, that your request cannot be processed from the time of revocation. You can read below how we proceed in case of exercise of data subjects' rights.
3.7.2 Use of the Zammad Ticketing System
In order to process or answer your requests in our internal processes as quickly as possible, documented and reliable, we use the ticketing solution 'Zammad' of Zammad GmbH, Marienstraße 11, 10117 Berlin and thereby process your personal data (see above for the applicable legal basis). This data is in particular the fields visible in the contact form or, in the case of contact by e-mail to info@whisky.de, your used e-mail address and any other data you provide during contact with us. This data is used exclusively to process and respond to your request. Using Zammad, we can better track open support requests and optimise our support processes - with the aim of handling all open customer requests quickly and reliably.
Communication and data transfer with the ticketing system is always encrypted and data is stored exclusively in German data centres. No transfer to third states takes place. Moreover, the necessary processing contract was concluded with Zammad GmbH.
The data recorded in the ticketing system are automatically deleted at the latest after 24 months, unless they are subject to the legal retention obligation.
If you do not want your personal data to be processed via the ticketing system, you can make use of the option to contact us by telephone and inform our staff accordingly.
4 Transfer to recipients outside the EU
With the exception of some of the processing described in 3.4 (online presence and website optimisation) such as, we do not share your data with recipients outside the European Union or the European Economic Area. The processing mentioned in 3.4 may involve the transfer of data to the servers and/or partners of the third parties we engage localised in the EEA for analytics and targeting technologies. These servers may be located and/or inter alia in the U.S. The data transfer takes place in accordance with the principles of the so-called Privacy Shield and on the basis of the so-called Standard Contractual Clauses of the EU Commission (see above for details and links to the relevant SCCs).
5 Your rights
5.1 Overview
In addition to the right to revoke the consents you have provided to us, if the relevant legal conditions apply, you also have the following rights:
- The right to receive information about your personal data stored by us in accordance with Art. 15 of the GDPR; in particular, you may receive information about the processing purposes, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the origin of your data if it was not collected directly from you,
- The right to correct or supplement incorrect data in accordance with Art. 16 of the GDPR,
- The right to deletion of your data stored by us in accordance with art. 17 of the GDPR insofar as no legal or contractual retention periods or other legal obligations exist,
- The right to restriction of the processing of your data in accordance with Art. 18 of the GDPR, insofar as the correctness of the data is disputed by you, the processing is unlawful, but you object to its deletion; the controller no longer needs the data, but you need it to assert, exercise or defend legal claims or you have objected to the processing in accordance with Art. 21 of the GDPR,
- The right to dataportability in accordance with Art. 20 of the GDPR, i.e. the right to transfer selected data stored by us about you in a common machine-readable format, or to request that it be transferred to another controller.
- Right to object to a supervisory authority: If you believe that the processing of your data is in breach of data protection law or that your data protection rights have otherwise been violated, you may lodge a complaint with the competent supervisory authority. This is the Bayerische Landesamt für Datenschutzaufsicht, Promenade 27, D-91522 Ansbach, Germany.
5.2 Right of objection
Under the conditions of Article 21 paragraph 1 of the GDPR, data processing may be objected to on the basis of reasons arising from the particular situation of the affected person.
The preceding general right to object applies to all processing purposes described in this Privacy Statement, which are processed on the basis of Article 6 (1f) of the GDPR. In contrast to the special right to object aimed at data processing for commercial purposes (see 3.3 above), we are obliged under the GDPR to apply such a general right to object, unless we can invoke compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms or which are related to the establishment, exercise or substantiation of a legal claim in which we are involved. In addition, there is the possibility of contacting the data protection officer responsible for Whisky.de or the competent supervisory authority. That is the Belgian Data Protection Authority (GBA), Printing Press Street 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be.
6 Data security measures
All data transmitted by you personally, including your payment details, are transmitted using the widely accepted and secure standard SSL (Secure Socket Layer). SSL is a secure and proven standard that is also used, for example, in online banking. You can recognise a secure SSL connection, for example, by the 's' after http (i.e. https://...) in your browser's address bar or by the lock symbol at the top or bottom of your browser.
To further protect our customers' personal data (such as name, address, telephone number and e-mail address), we use an external control system. Here we cooperate with AC Süppmayer GmbH - a leading provider of professional address verification systems in Germany. With the help of this system - in addition to our other technical IT security measures - we can determine whether customer data has been unauthorisedly used or lost. For example, our customers are protected from unwanted e-mail advertising and harassing telephone advertising, as the checks are not limited to postal addresses, but also extend to e-mail addresses and telephone numbers. More information on this cooperation can be found at this link.
We also use appropriate technical and organisational security measures to protect your personal data stored with us against manipulation, partial or total loss and against unauthorised access by third parties. Our security measures are constantly improved by us and by the service providers we engage in line with technological developments.
7 Changes to the data protection policy
We reserve the right to amend the Data Protection Notice from time to time to adapt it to changed legal situations, changes in data processing or updated services. Changes affecting your contractual relationship with Whisky.de or requiring your consent as a user will only be made with the user's consent.
Customers, interested parties and users of Whisky.de are requested to regularly inform themselves about the current content of data protection information.
Status: 18.04.2023
