Privacy policy

Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide this data. Failure to provide it will have no consequences. This applies only insofar as no different information is provided for the processing operations described below. “Personal data” means any information relating to an identified or identifiable natural person.

Server log files

You can visit our website without providing information about yourself.

Whenever our website is accessed, usage data is transmitted by your internet browser to us or our web host/IT service provider and stored in log files (server log files). Such data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider. Processing is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in ensuring the uninterrupted operation of our website and improving our services.

Your data may be transferred to and processed in third countries outside the EU, particularly Canada and the USA. The European Commission has adopted an adequacy decision for Canada. For the USA, an adequacy decision exists under the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. Such transfers are based on contractual obligations comparable to the European Commission's Standard Contractual Clauses.

Contact

Responsible Person

Please contact us if you wish. The responsible person for data processing is: ALANDIA GmbH & Co KG, Landgrafenstrasse 121, 50931 Cologne, Germany, telephone +49 221 4248749, mail@absinth-alandia.de

Customer-initiated contact by email

If you initiate business contact with us by email, we collect your personal data (name, email address and message text) only to the extent provided by you. Processing serves to handle and respond to your enquiry. If the contact relates to pre-contractual measures (such as advice about a prospective purchase or preparation of a quotation) or to an existing contract between you and us, processing is based on Article 6(1)(b) GDPR. If contact is made for other reasons, processing is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in handling and responding to your enquiry.

In the latter case, you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR.

We use your email address solely to process your enquiry. Your data will subsequently be deleted, subject to statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the contact form

When you use the contact form, we collect your personal data (name, email address and message text) only to the extent provided by you. Processing serves the purpose of contacting you. If the contact relates to pre-contractual measures (such as advice about a prospective purchase or preparation of a quotation) or to an existing contract between you and us, processing is based on Article 6(1)(b) GDPR. If contact is made for other reasons, processing is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in handling and responding to your enquiry.

In the latter case, you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR.

We use your email address solely to process your enquiry. Your data will subsequently be deleted, subject to statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the withdrawal button

If you have concluded a contract through our online presence, we provide a withdrawal function (withdrawal button) through which you can submit your declaration of withdrawal directly.

When you use this function, we collect your personal data (name, email address, information identifying the contract or part of the contract from which you wish to withdraw, and the date and time at which your declaration of withdrawal was sent) only to the extent provided by you. Processing serves to provide the legally required option to withdraw from your contract and to handle your withdrawal correctly.

If the contact concerns an existing contract between you and us, processing is based on Article 6(1)(b) GDPR. Otherwise, processing is based on Article 6(1)(c) GDPR to fulfil the legal obligation to provide a withdrawal function on our online presence.

We use your email address solely to process your declaration of withdrawal. Your data will subsequently be deleted, subject to statutory retention periods, unless you have consented to further processing and use.

Disclosure to third-party providers (use of plugins)

For the technical provision and management of the withdrawal function on our online presence, we use a software solution from Händlerbund Legal GmbH, Kohlgartenstraße 11–13, 04315 Leipzig, Germany, as a processor. The plugin allows you to submit your declaration of withdrawal directly via the withdrawal button if you have concluded a contract with us through our website. Technically necessary cookies are used for this purpose, and the following information is collected: an encrypted session ID.

Your data may be transferred to third countries such as the USA. The European Commission has adopted an adequacy decision for the USA under the Trans-Atlantic Data Privacy Framework (TADPF). Where providers are not certified under the TADPF, transfers to the USA are based on Standard Contractual Clauses as appropriate safeguards for personal data protection, available at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de.

When you use the withdrawal function, the personal data collected is transmitted to the servers of the third-party providers named above.

Processing serves to comply with the statutory requirements governing the design of the withdrawal function and is based on Article 6(1)(c) GDPR. Processing is also based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in providing a user-friendly withdrawal option.

In the latter case, you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR.

The use of cookies or similar technologies is based on Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act). Further privacy information is available at https://www.haendlerbund.de/de/datenschutzerklaerung.

Orders

Collection, processing and disclosure of personal data when placing orders

When you place an order, we collect and process your personal data only to the extent necessary to fulfil and process your order and handle your enquiries. Providing this data is necessary to conclude the contract; without it, no contract can be concluded. Processing is based on Article 6(1)(b) GDPR and is necessary for the performance of a contract with you.

Your data may be disclosed, for example, to shipping companies, dropshipping or fulfilment providers, payment service providers, order-processing service providers and IT service providers. We strictly comply with statutory requirements in all cases. The extent of any disclosure is limited to the minimum necessary.

Reviews

Data collection when submitting a comment or review

When you comment on or review an article or post, we collect your personal data (name, email address and comment text) only to the extent provided by you. Processing serves to enable comments and reviews to be submitted and displayed. By submitting your comment or review, you consent to processing of the transmitted data. Processing is based on Article 6(1)(a) GDPR. You may withdraw your consent at any time by contacting us, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. Your personal data will then be deleted. When your comment or review is published, only the name you have provided will be displayed.

Use of Judge.me

We use the “Judge.me” review system provided by Judge.me Ltd (c/o Buckworths, 2nd Floor, 1–3 Worship Street, London, England, EC2A 2AB; “Judge.me”) on our website. Judge.me enables us to collect customer reviews and display them on our website, giving you an insight into the quality of our services.

Following an order, you may receive an invitation from us or Judge.me to submit a review. In this context, we or Judge.me may process, among other things, your email address, name, telephone number, address, information about your device (IP address, web browser and operating system), information about the product purchased or service used (order number and product details), the content of your review and the star rating given, and any product photos or videos attached to your review. This data may also be used to verify your review. Judge.me uses technologies such as cookies.

Your data may be transferred outside the EU to the United Kingdom, for which the European Commission has adopted an adequacy decision. Your data may also be transferred to the USA. For the USA, an adequacy decision exists under the Trans-Atlantic Data Privacy Framework (TADPF). Judge.me is not certified under the TADPF. The transfer takes place on the basis of specific agreements approved for use in the United Kingdom that provide the same protection as personal data enjoys in the United Kingdom.

Cookies or similar technologies are used with your consent under Section 25(1), first sentence, TDDDG in conjunction with Article 6(1)(a) GDPR. Your personal data is processed with your consent under Article 6(1)(a) GDPR where you have expressly consented to disclosure of your data and receipt of the review invitation. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Further information about privacy when using Judge.me is available at https://judge.me/privacy.

Use of your email address to send newsletters

We use your email address to send information and offers by newsletter where you have expressly consented. Processing is carried out solely for promotional purposes. For this purpose, we process your email address and any other information you voluntarily provided when subscribing. Processing is based on Article 6(1)(a) GDPR.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. You can unsubscribe at any time using the link in the newsletter or by contacting us. Your email address will then be removed from the mailing list. Despite removal, we may continue to store your email address on a suppression list (blacklist) to prevent newsletters from being sent to you again. This storage is based on Article 6(1)(f) GDPR, reflecting our and your legitimate interests in preventing renewed use of your email address for newsletter distribution.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data.

Inventory management

Use of an external inventory management system

We use an inventory management system for contract processing as part of processing on our behalf. Personal data collected in connection with your order is transferred to Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany. Processing serves to perform the contract concluded with you and is based on Article 6(1)(b) GDPR.

Payment service providers

Use of PayPal

We use the PayPal payment service provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg; “PayPal”). Processing serves to offer you payment through this service. When you select and use PayPal, the data required to process payment is transmitted to PayPal so that we can fulfil the contract with you using your chosen payment method. Processing is based on Article 6(1)(b) GDPR.

All PayPal transactions are subject to PayPal's privacy policy: https://www.paypal.com/uk/legalhub/paypal/privacy-full.

Use of PayPal Plus

We use PayPal Plus, provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg; “PayPal”). Processing serves to offer you payment through this service. When you select and use PayPal, credit card via PayPal or direct debit via PayPal, the data required for payment processing is transmitted to PayPal to fulfil the contract with you using your chosen payment method. Processing is based on Article 6(1)(b) GDPR.

For certain payment methods, such as credit card or direct debit via PayPal, PayPal reserves the right to obtain a credit report using mathematical and statistical procedures and credit reference agencies. For this purpose, PayPal transfers the personal data required for a credit check to a credit reference agency and uses the resulting information about the statistical probability of payment default to make a balanced decision on establishing, performing or terminating the contractual relationship. The credit report may include probability or score values calculated using scientifically recognised mathematical and statistical methods, which may also take address data into account. Your legitimate interests are taken into account in accordance with applicable law. The purpose of processing is to assess creditworthiness when initiating a contract. Processing is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in protection against payment default where PayPal makes an advance payment.

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR by notifying PayPal.

Providing the data is necessary to conclude a contract using your chosen payment method. Without it, the contract cannot be concluded using that payment method.

Use of PayPal Express

We use PayPal Express, provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg; “PayPal”). Processing serves to offer you payment via PayPal Express.

To integrate this payment service, PayPal needs to collect, store and analyse data when the website is accessed (for example, IP address, device type, operating system, browser type and device location). Cookies may also be used for this purpose, enabling your browser to be recognised.

Cookies or similar technologies are used with your consent under Section 25(1), first sentence, TDDDG in conjunction with Article 6(1)(a) GDPR. Your personal data is processed with your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

When you select and use PayPal Express, the data required for payment processing is transmitted to PayPal to fulfil the contract with you using your chosen payment method. Processing is based on Article 6(1)(b) GDPR.

Further information: https://www.paypal.com/uk/legalhub/paypal/privacy-full.

Use of PayPal Checkout

We use PayPal Checkout, provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg; “PayPal”). Processing serves to offer you payment through this service. When you select and use PayPal, credit card via PayPal, direct debit via PayPal or Pay Later via PayPal, the data required to process payment is transmitted to PayPal to fulfil the contract with you using your chosen payment method. Processing is based on Article 6(1)(b) GDPR.

Cookies may be stored that enable your browser to be recognised. The associated processing is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in providing a customer-oriented range of payment methods. You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data.

Credit card via PayPal, direct debit via PayPal and Pay Later via PayPal. For certain payment methods, PayPal reserves the right to obtain a credit report using mathematical and statistical procedures and credit reference agencies. PayPal transmits the personal data required for a credit check to a credit reference agency and uses the resulting information about the statistical probability of payment default to make a balanced decision on establishing, performing or terminating the contractual relationship. The report may include probability or score values calculated using scientifically recognised mathematical and statistical procedures, including address data. Your legitimate interests are taken into account in accordance with applicable law. Processing serves to assess creditworthiness when initiating a contract and is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in protection against payment default where PayPal makes an advance payment.

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR by notifying PayPal.

Providing the data is necessary to conclude a contract using your chosen payment method. Without it, the contract cannot be concluded using that payment method.

Third-party providers. When you pay using a third-party payment method, the data required for payment processing is transferred to PayPal on the basis of Article 6(1)(b) GDPR. PayPal may then disclose the data to the relevant provider to execute that payment method, also on the basis of Article 6(1)(b) GDPR. Local third-party providers may include:

Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland).
Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland).

Purchase on invoice via PayPal. Where you choose payment by invoice, the data required for payment processing is initially transmitted to PayPal. To execute this payment method, PayPal then transfers the data to Ratepay GmbH (Franklinstraße 28–29, 10587 Berlin, Germany; “Ratepay”) to fulfil the contract with you using your chosen payment method. Processing is based on Article 6(1)(b) GDPR. Ratepay may obtain a credit report using mathematical and statistical procedures (probability or score values) and credit reference agencies, as described above. Processing serves to assess creditworthiness when initiating a contract and is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in protection against payment default where Ratepay makes an advance payment. Further information about privacy and the credit reference agencies used by Ratepay is available at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

Further information about data processing by PayPal is available at https://www.paypal.com/uk/legalhub/paypal/privacy-full.

Use of Shopify Payments

We use the “Shopify Payments” payment service provided by Shopify International Limited (2nd Floor, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”). In this case, payment processing is carried out by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; “Stripe”). Processing serves to offer you payment through Shopify Payments. When you select and use a Shopify Payments payment method, the data required to process payment is transmitted to Stripe to fulfil the contract with you using your chosen payment method. Processing is based on Article 6(1)(b) GDPR.

Stripe reserves the right to obtain a credit report using mathematical and statistical procedures and credit reference agencies. For this purpose, Stripe transmits the personal data required for a credit check to a credit reference agency and uses the resulting information about the statistical probability of payment default to make a balanced decision on establishing, performing or terminating the contractual relationship. The report may include probability or score values calculated using scientifically recognised mathematical and statistical methods, including address data. Your legitimate interests are taken into account in accordance with applicable law. Processing serves to assess creditworthiness when initiating a contract and is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in protection against payment default where Stripe makes an advance payment.

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR by notifying Stripe.

Providing the data is necessary to conclude a contract using your chosen payment method. Without it, the contract cannot be concluded using that payment method.

Further information about Shopify Payments is available in Shopify's privacy policy at https://www.shopify.com/legal/privacy. Further information about Stripe is available at https://stripe.com/privacy.

Cookies

Our website uses cookies. Cookies are small text files stored in a user's internet browser or by the browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is accessed again.

Cookies are stored on your computer. You therefore have full control over their use. By selecting appropriate technical settings in your browser, you can be notified before cookies are set and decide whether to accept them individually, and you can prevent cookies from being stored and the data they contain from being transmitted. Cookies already stored can be deleted at any time. Please note, however, that you may then be unable to use all functions of this website to their full extent.

The following links explain how to manage (including disable) cookies in major browsers:

Technically necessary cookies

Unless otherwise stated below in this privacy policy, we use only technically necessary cookies to make our website more user-friendly, effective and secure. Cookies also allow our systems to recognise your browser after you change pages and to offer you services. Some functions of our website cannot be offered without cookies; these require the browser to be recognised after a page change.

The use of cookies or similar technologies is based on Section 25(2) TDDDG. Processing of your personal data is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in ensuring the optimal functionality of our website and making our offering user-friendly and effective.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data.

Use of the CCM19 Cookie Consent Manager

We use the CCM19 Cookie Consent Manager provided by Papoo Software & Media GmbH (Auguststr. 4, 53229 Bonn, Germany; “CCM19”). The plugin enables you to grant consent to data processing via the website, particularly the setting of cookies, and to exercise your right to withdraw consent already given. Processing serves to obtain and document the necessary consent to data processing and thus comply with legal obligations.

Cookies are used for this purpose. The following information, among other things, may be collected, stored and, where applicable, transferred to CCM19: randomly assigned ID, consent status, and the date and time of acceptance or rejection. The data is stored for one year and one month and then deleted. This data is not disclosed to other third parties.

Processing is carried out to fulfil a legal obligation on the basis of Article 6(1)(c) GDPR.

Further privacy information about CCM19 is available at https://www.ccm19.de/datenschutzerklaerung.html.

Analytics and advertising tracking

Use of Google Analytics 4

We use the Google Analytics web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). Processing serves to analyse this website and its visitors and for marketing and advertising purposes. On behalf of the website operator, Google uses the information obtained to evaluate your use of the website, compile reports on website activity and provide other services relating to website and internet use.

The information collected may include your IP address, date and time of access, click path, browser and device information, pages visited, referring URL (the website from which you reached us), location data and purchasing activity. Google may combine your data with other data it holds about you, such as your search history, personal accounts and usage data from other devices. The IP address is shortened by Google within Member States of the European Union or other states party to the Agreement on the European Economic Area. Google uses technologies such as cookies, browser storage and tracking pixels to analyse website use.

Cookies or similar technologies are used with your consent under Section 25(1), first sentence, TDDDG in conjunction with Article 6(1)(a) GDPR. Your personal data is processed with your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

In this context, we also use Google Signals. Google Signals enables cross-device tracking. Your data can therefore be analysed across devices if you have enabled “personalised advertising” in your account settings and your devices are linked to your Google account. This makes it possible to recognise which device you use to search for products and whether you return later and purchase using another device, such as a tablet.

The resulting cross-device reports contain only aggregated data. We therefore receive statistics created on the basis of Google Signals. To prevent cross-device collection and storage by Google Signals, you can disable “personalised ads” in your Google account settings. Further information is available at https://support.google.com/ads/answer/2662922?hl=en and https://support.google.com/analytics/answer/7532985?hl=en.

The information generated about your use of this website is generally transferred to a Google server in the USA and stored there. For the USA, the European Commission has adopted an adequacy decision under the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and has committed to European data protection principles. Both Google and US government authorities have access to your data.

Further information about terms of use and privacy is available at https://policies.google.com/technologies/partner-sites, https://policies.google.com/privacy?hl=en&gl=de and https://business.safety.google/privacy/.

Use of Shopify Analytics

We use the statistics and analytics features of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) as part of processing on our behalf. Shopify is affiliated with Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

Processing serves to analyse this website and its visitors. Data is stored for marketing and optimisation purposes and made available in reports, analyses and statistics. Device information collected and processed may include browser information, IP address, time zone and certain cookies installed on your device. As you navigate the website, information is also collected about pages or products viewed, the referring URL (the website from which you reached us) and how you interact with the website. Technologies used for this purpose include cookies, web beacons, tags and pixels (electronic files used to collect information about your navigation of the website).

Cookies or similar technologies are used with your consent under Section 25(1), first sentence, TDDDG in conjunction with Article 6(1)(a) GDPR. Your personal data is processed with your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Further information about Shopify's privacy practices is available at https://www.shopify.com/legal/privacy, the Data Processing Agreement at https://www.shopify.com/legal/dpa and cookies at https://www.shopify.com/legal/cookies.

Use of Microsoft Clarity

We use the “Microsoft Clarity” analytics tool provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; “Microsoft”). Microsoft is affiliated with Microsoft Corporation (One Microsoft Way, Redmond, Washington 98052, USA).

Processing serves to tailor, optimise and analyse our website. The tool records samples of website visitors' movements. This produces a record of mouse movements, scrolling behaviour, time spent on the website and clicks (a “heatmap”).

Cookies or similar technologies are used for this purpose. Information collected may include IP address, time of access, click path, device information (device type, screen size and resolution, unique device identifier and operating system), browser information (type and version), location data, preferred website language, subpages visited, time spent, content viewed and the website or file requested.

Pseudonymous user profiles are created from this data. The data is not used to identify visitors personally and is not combined with personal data relating to the holder of the pseudonym. Microsoft is contractually prohibited from selling the collected data to other third parties.

Your data may be transferred to the USA. The European Commission has adopted an adequacy decision for the USA under the Trans-Atlantic Data Privacy Framework (TADPF). Microsoft is certified under the TADPF and has committed to European data protection principles.

Cookies or similar technologies are used with your consent under Section 25(1), first sentence, TDDDG in conjunction with Article 6(1)(a) GDPR. Your personal data is processed with your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Information about cookies and their functions is available at https://learn.microsoft.com/en-us/clarity/setup-and-installation/cookie-list; retention periods at https://learn.microsoft.com/en-us/clarity/setup-and-installation/data-retention; and further privacy information at https://learn.microsoft.com/en-us/clarity/faq#privacy, https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data and https://clarity.microsoft.com/terms. Microsoft's general privacy statement is available at https://privacy.microsoft.com/en-gb/privacystatement.

Use of Google Ads conversion tracking

We use the online advertising programme “Google Ads”, including conversion tracking, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). If you click on an advertisement placed by Google, a conversion-tracking cookie is stored on your computer. These cookies have a limited lifetime, do not contain personal data and are therefore not used to identify you personally.

If you visit certain pages of our website before the cookie expires, Google and we can recognise that you clicked on the advertisement and were redirected to that page. Each Google Ads customer receives a different cookie, so cookies cannot be tracked across the websites of different Google Ads customers. Information obtained through the conversion cookie is used to compile conversion statistics. We learn the total number of users who clicked one of our advertisements and were redirected to a page containing a conversion-tracking tag. We do not receive information that enables us to identify users personally.

Your data may be transmitted to Google LLC servers in the USA. For the USA, the European Commission has adopted an adequacy decision under the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and has committed to European data protection principles.

Cookies or similar technologies are used with your consent under Section 25(1), first sentence, TDDDG in conjunction with Article 6(1)(a) GDPR. Your personal data is processed with your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Further information and Google's privacy policy are available at https://policies.google.com/privacy?hl=en and https://business.safety.google/privacy/.

Plugins and other services

Use of Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). This application manages JavaScript and HTML tags used in particular to implement tracking and analytics tools. Processing serves to tailor and optimise our website. Google Tag Manager itself does not store cookies and, according to the original policy text, does not process personal data. However, it enables other tags to be triggered that may collect and process personal data.

Further information about Google's terms of use and privacy is available at https://policies.google.com/privacy?hl=en.

Use of hCaptcha

We use the hCaptcha service provided by Intuition Machines Inc. (1065 SW 8th St #704, Miami, FL 33130, USA; “hCaptcha”) as part of processing on our behalf.

hCaptcha protects our website against spam and misuse through automated access (bots). By implementing hCaptcha, we ensure that certain actions on our website can be performed only by real people, thereby protecting the security and integrity of our online services. When hCaptcha is used, the following data may be collected and processed: the user's IP address; information about the device used (such as browser and operating system); mouse movements and interactions on the website; time spent on the website; and user input behaviour.

Your data may be transferred to the USA. The European Commission has adopted an adequacy decision for the USA under the Trans-Atlantic Data Privacy Framework (TADPF). hCaptcha is certified under the TADPF and has committed to European data protection principles.

Cookies or similar technologies are used with your consent under Section 25(1), first sentence, TDDDG in conjunction with Article 6(1)(a) GDPR. Your personal data is processed with your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Further information about hCaptcha's data processing and privacy practices is available at https://www.hcaptcha.com/gdpr.

Use of Cloudflare

We use the Cloudflare content delivery network (CDN) provided by Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA; “Cloudflare”). This is a geographically distributed network of servers in different data centres to which our web server connects and through which certain content on our website is delivered. Processing serves to optimise website loading times and make our offering more user-friendly.

Information collected may include IP addresses, system configuration information and information about traffic to and from customer websites (server log files). Your data may be transferred to the USA. The European Commission has adopted an adequacy decision for the USA under the Trans-Atlantic Data Privacy Framework (TADPF). Cloudflare is certified under the TADPF and has committed to European data protection principles.

Processing of your personal data is based on Article 6(1)(f) GDPR, reflecting our overriding legitimate interest in the needs-based and targeted design of our website.

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR.

Further information about privacy when using Cloudflare is available at https://www.cloudflare.com/privacypolicy/.

Use of YouTube

We use the function for embedding YouTube videos provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”). YouTube is affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”). The function displays videos hosted on YouTube in an iframe on our website. The “privacy-enhanced mode” option is enabled. According to the original policy text, this means YouTube does not store information about website visitors until they watch a video; when they watch, information is transmitted to and stored by YouTube.

Your data may be transferred to the USA. The European Commission has adopted an adequacy decision for the USA under the Trans-Atlantic Data Privacy Framework (TADPF). YouTube is certified under the TADPF and has committed to European data protection principles.

Cookies or similar technologies are used with your consent under Section 25(1), first sentence, TDDDG in conjunction with Article 6(1)(a) GDPR. Your personal data is processed with your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Further information about the collection and use of data by YouTube and Google, your rights and ways to protect your privacy is available in YouTube's privacy information at https://www.youtube.com/t/privacy.

Use of Elfsight

Elfsight Reviews: display of Google and Amazon reviews. Service provider: Elfsight LLC, Paronyana str., 19/3, 201 0015 Yerevan, Armenia. Privacy policy: https://elfsight.com/privacy-policy/.

Use of the SmartBot AI chatbot (Bitcloud Technology Inc., Canada)

We use the AI-powered live chat service “SmartBot” on our website (provider: Bitcloud Technology Inc., 2402 Richmond St W, Unit 36E, Toronto, ON, M6P 3A5, Canada). SmartBot is used to answer customer questions about absinthe and our products and to provide product advice.

Categories of data: When the chatbot is used, SmartBot typically processes your IP address, browser and device data, timestamps of use and the content of your chat messages. If you voluntarily provide personal details in the chat (for example, your name, email address or product preferences), these are also collected. SmartBot also creates a first-party browser-storage entry to recognise the same browser, manage chat invitations and maintain ongoing conversations (for example, a connection ID). This storage is used solely to operate the chat.

Legal basis and consent: SmartBot is integrated through our CCM19 consent manager. SmartBot is loaded only after you have consented to the corresponding integration (functional category). Storage of information on your device (cookies/local storage) is based on your express consent under Section 25(1) TDDDG. The associated processing of personal data is based on your consent under Article 6(1)(a) GDPR (and, where applicable, Article 6(1)(b) GDPR for pre-contractual purposes). Without your consent, SmartBot remains disabled; other shop functions are unaffected.

Processing on our behalf: A Data Processing Agreement (DPA) under Article 28 GDPR is in place for SmartBot. Under this agreement, Bitcloud undertakes, among other things, to maintain confidentiality and security measures and assist with data subject requests. According to Bitcloud, customer data and chat histories are not used to train AI models. Bitcloud currently does not use additional subprocessors or external AI services to process chats.

Retention period: According to the provider, chat histories are generally stored while the SmartBot account remains active unless deleted earlier by you or us. Technical logs (for example, error logs) are retained for no more than 30 days. After the service ends, personal data is deleted in accordance with the agreement and statutory requirements (with any remaining retention limited to what is legally permitted).

Transfers to third countries: The provider, Bitcloud Technology Inc., is based in Canada. According to the provider, personal data may also be processed in the USA or other third countries. For transfers to Canadian companies covered by the relevant European Commission adequacy decision, an adequate level of data protection is recognised. Where personal data is transferred to other third countries without an applicable adequacy decision, appropriate safeguards under Article 46 GDPR are required, such as EU Standard Contractual Clauses.

Notice to users: Please do not enter sensitive information in the chat (for example, passwords, bank details or health information).

Data subject rights and retention periods

Retention period

After a contract has been fully performed, data is initially stored for the duration of the statutory warranty period and thereafter subject to statutory retention periods, particularly those under tax and commercial law. It is deleted after these periods expire unless you have consented to further processing and use.

Rights of the data subject

Where the statutory conditions are met, you have the following rights under Articles 15 to 20 GDPR: the right of access, rectification, erasure, restriction of processing and data portability. Under Article 21(1) GDPR, you also have the right to object to processing based on Article 6(1)(f) GDPR and to processing for direct marketing purposes.

Right to lodge a complaint with a supervisory authority

Under Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is unlawful. You may lodge a complaint with the supervisory authority responsible for us, among others:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen)

Postfach 20 04 44
40102 Düsseldorf
Germany
Telephone: +49 211 384240
Fax: +49 211 38424999
Email: poststelle@ldi.nrw.de

Right to object

Where the processing of personal data described here is based on our legitimate interest under Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to this processing with effect for the future. Following an objection, processing of the relevant data will cease unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless processing is necessary for the establishment, exercise or defence of legal claims.