Privacy / Data Protection
Privacy policy
Preamble
With the following data protection declaration, we would like to inform you about which types of your personal data (hereinafter also referred to as "data") we process, for what purposes and to what extent. This data protection declaration applies to all processing of personal data carried out by us, both in the context of the provision of our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offering").
The terms used are not gender-specific.
As of December 10, 2024
Table of contents
1. Preamble
2. Person responsible
3. Overview of processing
4. Relevant legal bases
5. Security measures
6. Transmission of personal data
7. International data transfers
8. General information on data storage and deletion
9. Business Services
10. Provision of the online offer and web hosting
11. Use of cookies
12. Contact and inquiry management
13. Advertising communication via email, post, fax or telephone
14. Plug-ins and embedded functions and content
Responsible person
Andreas Strutzberg
14. Rugby Road
8001 Cape Town, South Africa
E-mail address:
info@80wineriesaroundtheworld.com
Imprint: https://www.80wineriesaroundtheworld.com/imprint
Overview of processing
The following overview summarises the types of data processed and the purposes of their processing and refers to the persons concerned.
Types of data processed
inventory data.
payment details.
contact details.
content data.
contract data.
usage data.
Meta-, communication- and procedural data.
log data.
Categories of data subjects
service recipient and client.
interested parties.
communication partner.
users.
business and contractual partners.
Purposes of processing
Provision of contractual services and fulfillment of contractual obligations.
Communication.
security measures.
direct marketing.
office and organizational procedures.
organizational and administrative procedures.
feedback.
Marketing.
Provision of our online offering and user-friendliness.
Information technology infrastructure.
sales promotion.
business processes and business management procedures.
Relevant legal bases
Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. If more specific legal bases are relevant in individual cases, we will inform you of these in the data protection declaration.
- Consent (Article 6, Paragraph 1, Sentence 1, Letter a) of GDPR) - The data subject has given his or her consent to the processing of personal data concerning him or her for a specific purpose or for several specific purposes.
- Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
- Legal obligation (Article 6 (1) sentence 1 lit. c) GDPR) - Processing is necessary to fulfill a legal obligation to which the controller is subject.
- Legitimate interests (Article 6 (1) sentence 1 lit. f) GDPR) - processing is necessary to protect the legitimate interests of the controller or of a third party, provided that the interests, fundamental rights and freedoms of the data subject which require protection of personal data do not prevail.
National data protection regulations in Germany : In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. This includes in particular the law on protection against misuse of personal data in data processing (Federal Data Protection Act - BDSG). The BDSG contains in particular special regulations on the right to information, the right to erasure, the right of objection, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases including profiling. In addition, state data protection laws of the individual federal states may apply.
Reference to the validity of the GDPR: This data protection notice serves to provide information in accordance with both the Swiss DSG and the General Data Protection Regulation (GDPR). For this reason, we ask you to note that the terms of the GDPR are used due to the broader spatial application and comprehensibility. In particular, instead of the terms "processing" of "personal data", "overriding interest" and "personal data requiring particular protection" used in the Swiss DSG, the terms "processing" of "personal data" as well as "legitimate interest" and "special categories of data" used in the GDPR are used. However, the legal meaning of the terms will continue to be determined according to the Swiss DSG within the scope of the validity of the Swiss DSG.
Third country (outside the EU): The data protection regulations in the country in which the controller is based apply in addition to or alongside the data protection regulations of the GDPR. These regulations may contain specific provisions that go beyond or deviate from the requirements of the GDPR. These include, among others, provisions to protect against misuse of personal data, provisions on rights of information and deletion, rights of objection, processing of special categories of personal data, processing for other purposes, transmission and automated decision-making including profiling.
Security measures
We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.
The measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, transfer, securing availability and separation. Furthermore, we have set up procedures that ensure the exercise of data subject rights, the deletion of data and reactions to threats to data. Furthermore, we take the protection of personal data into account when developing or selecting hardware, software and processes in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.
Securing online connections through TLS/SSL encryption technology (HTTPS): To protect user data transmitted through our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user's browser (or between two servers), protecting the data from unauthorized access. TLS, as the advanced and more secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is signaled by the display of HTTPS in the URL. This serves as an indicator for users that their data is being transmitted securely and encrypted.
Transmission of personal data
As part of our processing of personal data, it may happen that these are transmitted to or disclosed to other bodies, companies, legally independent organizational units or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.
International data transfers
Data processing in third countries: If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or if the processing takes place in the context of the use of third-party services or the disclosure or transmission of data to other persons, bodies or companies, this will only be done in accordance with the legal requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise, data transfers only take place if the level of data protection is otherwise ensured, in particular through standard contractual clauses (Art. 46 Para. 2 lit. c) GDPR), explicit consent or in the case of contractual or legally required transmission (Art. 49 Para. 1 GDPR). In addition, we will inform you of the basis of third-country transfers for the individual providers from the third country, with the adequacy decisions taking priority as the basis. Information on third-country transfers and existing adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en. As part of the so-called "Data Privacy Framework" (DPF), the EU Commission has also recognized the level of data protection as secure for certain companies from the USA as part of the adequacy decision of July 10, 2023. The list of certified companies as well as further information on the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English). In the privacy policy we will inform you which service providers we use are certified under the Data Privacy Framework.
General information on data storage and deletion
We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consent is revoked or there are no further legal bases for the processing. This applies to cases in which the original processing purpose no longer applies or the data is no longer required. Exceptions to this rule exist if legal obligations or special interests require the data to be stored or archived for a longer period.
In particular, data that must be retained for commercial or tax law reasons or whose storage is necessary for legal proceedings or to protect the rights of other natural or legal persons must be archived accordingly.
Our privacy policy contains additional information on the retention and deletion of data that applies specifically to certain processing operations.
If there are several specifications regarding the retention period or deletion period for a date, the longest period always applies.
If a period does not expressly begin on a specific date and is at least one year, it automatically begins at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the context of which data is stored, the event triggering the period is the time at which the termination or other termination of the legal relationship takes effect.
We process data that is no longer stored for the originally intended purpose but due to legal requirements or other reasons, only for the reasons that justify its storage.
Further information on processing procedures, methods and services:
Storage and deletion of data: The following general periods apply to storage and archiving under German law:
- 10 years - retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets as well as the work instructions and other organizational documents, accounting documents and invoices required for their understanding (Section 147 Paragraph 3 in conjunction with Paragraph 1 Nos. 1, 4 and 4a AO, Section 14b Paragraph 1 UStG, Section 257 Paragraph 1 Nos. 1 and 4, Paragraph 4 HGB).
- 6 years - Other business documents: received commercial or business letters, reproductions of sent commercial or business letters, other documents, insofar as they are relevant for taxation, e.g. hourly wage slips, operating accounting sheets, calculation documents, price labels, but also payroll documents, insofar as they are not already accounting documents and cash register slips (Section 147 Paragraph 3 in conjunction with Paragraph 1 Nos. 2, 3, 5 AO, Section 257 Paragraph 1 Nos. 2 and 3, Paragraph 4 HGB).
- 3 years - Data required to consider potential warranty and compensation claims or similar contractual claims and rights as well as to process related inquiries based on previous business experience and standard industry practices will be stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).