Privacy Policy - TASTE. UNDERSTAND. ENJOY.

1. Data Protection at a Glance

General Information

The following information provides a brief overview of what happens to your personal data when you visit this website. Personal data means any data by which you can be personally identified. Detailed information on data protection can be found in the Privacy Policy set out below.

Data Collection on This Website

Who is responsible for collecting data on this website?

Data processing on this website is carried out by the website operator. The operator’s contact details can be found in the section “Information on the Controller” in this Privacy Policy.

How do we collect your data?

Some data are collected when you provide them to us. This may, for example, include data that you enter in a contact form.

Other data are collected automatically by our IT systems, or after you have given your consent, when you visit the website. These are primarily technical data (e.g. internet browser, operating system or time at which the page was accessed). These data are collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data are collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour. Where contracts may be concluded or initiated through the website, the data submitted are also processed in connection with offers to enter into contracts, orders or other contract-related enquiries.

What rights do you have regarding your data?

You have the right at any time and free of charge to obtain information about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of these data. If you have given consent to data processing, you may withdraw that consent at any time with effect for the future. You also have the right, in certain circumstances, to request restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You may contact us at any time regarding these and any other questions relating to data protection.

Analytics Tools and Third-Party Tools

When you visit this website, your browsing behaviour may be statistically analysed. This is primarily carried out using analytics programs.

Detailed information on these analytics programs can be found in the following Privacy Policy.

2. Hosting

We host the content of our website with the following provider:

webgo

The provider is webgo GmbH, Wendenstraße 8-12, 20097 Hamburg, Germany (hereinafter “webgo”). When you visit our website, webgo collects various log files, including your IP addresses.

For details, please refer to webgo’s privacy policy.

The use of webgo is based on Article 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible. Where the relevant consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act – Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), to the extent that the consent covers the storage of cookies or access to information on the user’s terminal equipment (e.g. for device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Data Processing Agreement

We have entered into a data processing agreement (DPA) for the use of the service referred to above. This is an agreement required under data protection law which ensures that the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

3. General Information and Mandatory Information

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with the applicable data protection legislation and this Privacy Policy.

When you use this website, various personal data are collected. Personal data are data by which you can be personally identified. This Privacy Policy explains which data we collect and what we use them for. It also explains how and for what purpose this is done.

Please note that data transmitted over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to protect such data completely against access by third parties.

Information on the Controller

The controller responsible for data processing on this website is:

Thomas Gutheil
Am Knick 4b
23843 Bad Oldesloe, Germany

Email: hello@winealltheway.com

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses or similar information).

Storage Period

Unless a more specific storage period is stated in this Privacy Policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you submit a legitimate request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be erased once those grounds no longer apply.

General Information on the Legal Bases for Data Processing on This Website

Where you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or Article 9(2)(a) GDPR where special categories of personal data within the meaning of Article 9(1) GDPR are processed. Where you have expressly consented to the transfer of personal data to third countries, the data processing is also based on Article 49(1)(a) GDPR. Where you have consented to the storage of cookies or to access to information on your terminal equipment (e.g. by means of device fingerprinting), the data processing is additionally based on Section 25(1) TDDDG. Consent may be withdrawn at any time. Where your data are required for the performance of a contract or in order to take steps prior to entering into a contract, we process your data on the basis of Article 6(1)(b) GDPR. Furthermore, where your data are required for compliance with a legal obligation, we process them on the basis of Article 6(1)(c) GDPR. Data processing may also be based on our legitimate interest pursuant to Article 6(1)(f) GDPR. Information on the legal basis applicable in each individual case is provided in the following sections of this Privacy Policy.

Recipients of Personal Data

In the course of our business activities, we work with various external organisations. In some cases, it is also necessary to transfer personal data to these external organisations. We disclose personal data to external organisations only where this is necessary for the performance of a contract, where we are legally required to do so (e.g. disclosure of data to tax authorities), where we have a legitimate interest in the disclosure pursuant to Article 6(1)(f) GDPR, or where another legal basis permits the disclosure. Where we use processors, we disclose our customers’ personal data only on the basis of a valid data processing agreement. In the case of joint controllership, a joint controllership arrangement is entered into.

Withdrawal of Your Consent to Data Processing

Many data processing operations are possible only with your express consent. You may withdraw consent already given at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to Object to Data Collection in Specific Cases and to Direct Marketing (Article 21 GDPR)

WHERE DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE APPLICABLE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21(1) GDPR).

WHERE YOUR PERSONAL DATA ARE PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSES OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE PROCESSED FOR SUCH DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ARTICLE 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

Right to Data Portability

You have the right to receive data that we process by automated means on the basis of your consent or in performance of a contract, either yourself or through a third party, in a commonly used, machine-readable format. Where you request the direct transmission of the data to another controller, this will be carried out only where technically feasible.

Right of Access, Rectification and Erasure

Within the scope of the applicable statutory provisions, you have the right at any time and free of charge to obtain access to the personal data concerning you that we hold, including information on their origin and recipients and the purposes of processing, and, where applicable, to request the rectification or erasure of those data. You may contact us at any time regarding these and any other questions relating to personal data.

Right to Restriction of Processing

You have the right to request restriction of the processing of your personal data. You may contact us at any time for this purpose. The right to restriction of processing applies in the following cases:

If you contest the accuracy of the personal data stored by us, we will generally require time to verify this. For the duration of the verification, you have the right to request restriction of the processing of your personal data.
If the processing of your personal data was or is unlawful, you may request restriction of data processing instead of erasure.
If we no longer require your personal data, but you require them for the establishment, exercise or defence of legal claims, you have the right to request restriction of the processing of your personal data instead of erasure.
If you have objected pursuant to Article 21(1) GDPR, your interests and our interests must be balanced. For as long as it has not yet been determined whose interests prevail, you have the right to request restriction of the processing of your personal data.

Where the processing of your personal data has been restricted, such data may, with the exception of storage, be processed only with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line in your browser changes from “http://” to “https://” and by the padlock symbol in your browser bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Payment Processing via Lemon Squeezy

Paid digital products, including digital content and digital services, are purchased through Sold through Link, LLC f/k/a Lemon Squeezy LLC (hereinafter “Lemon Squeezy”), which acts as the Merchant of Record (“MoR”). Payment data are entered and processed exclusively within the checkout environment provided by Lemon Squeezy.

Wine all the Way does not have access to full payment data such as credit card, bank or PayPal details. Wine all the Way receives only the order and transaction information required to provide the purchased digital products, including digital content and digital services (e.g. name, email address, order identifier, product and order status).

Payment data are transmitted through the encrypted connections provided by Lemon Squeezy and its payment service providers. Lemon Squeezy’s privacy policy applies to the processing of payment data.

Objection to Unsolicited Marketing Emails

We hereby object to the use of contact details published in compliance with the German statutory legal notice requirements for the purpose of sending unsolicited advertising and informational materials. The website operator expressly reserves the right to take legal action in the event of unsolicited marketing information being sent, for example by spam email.

4. Data Collection on This Website

Cookies

Our websites use “cookies”. Cookies are small data files and do not cause any damage to your terminal equipment. They are stored on your terminal equipment either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain stored on your terminal equipment until you delete them yourself or they are deleted automatically by your web browser.

Cookies may be set by us (first-party cookies) or originate from third-party companies (third-party cookies). Third-party cookies enable certain services provided by third-party companies to be integrated into websites (e.g. cookies used to process payment services).

Cookies have various functions. Many cookies are technically necessary because certain website functions would not work without them (e.g. the shopping basket function or the display of videos). Other cookies may be used to analyse user behaviour or for advertising purposes.

Cookies that are required to carry out the electronic communications process, to provide certain functions requested by you (e.g. the shopping basket function) or to optimise the website (e.g. cookies used to measure the website audience) (necessary cookies) are stored on the basis of Article 6(1)(f) GDPR unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the technically error-free and optimised provision of its services. Where consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of that consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG); consent may be withdrawn at any time.

You can configure your browser to inform you when cookies are set, to permit cookies only in individual cases, to exclude the acceptance of cookies in certain cases or in general, and to activate the automatic deletion of cookies when the browser is closed. Disabling cookies may limit the functionality of this website.

Where additional cookies and services are used on this website, details can be found in this Privacy Policy.

Consent Management Using Complianz

Our website uses the consent technology provided by Complianz to obtain your consent to the storage of certain cookies on your terminal equipment or to the use of certain technologies and to document that consent in compliance with data protection law. The provider of this technology is Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, the Netherlands (hereinafter “Complianz”).

Complianz is hosted on our servers, so no connection is established to the servers of the Complianz provider. Complianz stores a cookie in your browser so that the consents you have given, or their withdrawal, can be associated with you. The data collected in this way are stored until you ask us to erase them, delete the Complianz cookie yourself or the purpose for storing the data no longer applies. Mandatory statutory retention obligations remain unaffected.

Complianz is used to obtain and document the consents required by law. The processing of personal data for this purpose is based on Article 6(1)(c) GDPR. To the extent that Complianz stores information on or accesses information from your terminal equipment in order to store and apply the consent choices you have made, this is strictly necessary for the consent-management functionality and is carried out pursuant to Section 25(2) no. 2 TDDDG.

Server Log Files

The provider of the website automatically collects and stores information in server log files, which your browser automatically transmits to us. These are:

browser type and browser version
operating system used
referrer URL
host name of the accessing computer
time of the server request
IP address

These data are not combined with data from other sources.

These data are collected on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of the website; for this purpose, the server log files must be collected.

Contact Form

If you send us enquiries using the contact form, the information you provide in the enquiry form, including the contact details stated there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. We do not disclose these data without your consent.

These data are processed on the basis of Article 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in responding effectively to enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), where this has been requested; consent may be withdrawn at any time.

The data you enter in the contact form will remain with us until you ask us to erase them, withdraw your consent to storage or the purpose for storing the data no longer applies (e.g. once your enquiry has been fully processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Enquiries by Email

If you contact us by email, your enquiry, including all personal data arising from it (name and enquiry), will be stored and processed by us for the purpose of dealing with your request. We do not disclose these data without your consent.

The data you send to us in connection with an enquiry will remain with us until you ask us to erase them, withdraw your consent to storage or the purpose for storing the data no longer applies (e.g. once your request has been fully dealt with). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

Registration on This Website

You may register on this website in order to use additional functions offered on the site. We use the data entered for this purpose only for the use of the relevant offer or service for which you have registered. The mandatory information requested during registration must be provided in full. Otherwise, we will reject the registration.

We use the email address provided during registration to inform you of important changes, for example changes to the scope of the offer or technically necessary changes.

The data entered during registration are processed for the purpose of administering the contractual relationship established by registration and, where applicable, taking steps prior to entering into further contracts (Article 6(1)(b) GDPR).

The data collected during registration are stored by us for as long as you are registered on this website and are subsequently erased. Statutory retention periods remain unaffected.

5. Analytics Tools and Advertising

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that enables us to integrate tracking or statistics tools and other technologies into our website. Google Tag Manager itself does not create user profiles or carry out independent analyses. According to Google, technical log and diagnostic data are generated in connection with the use of Google Tag Manager. In particular, Google Tag Manager may collect aggregated diagnostic data about tag firing. Google states that these diagnostic data do not include user IP addresses or measurement identifiers associated with a particular individual. In addition, standard HTTP request logs may be generated which, according to Google, are deleted within 14 days of receipt.

Google Tag Manager is loaded on our website only after you have given your consent via the consent-management tool used on our website. Its use is based exclusively on your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG, to the extent that information is stored on or accessed from your terminal equipment. You may withdraw your consent at any time with effect for the future by changing your selection in the cookie settings.

In connection with the use of Google Tag Manager, technical log and diagnostic data may also be transferred to Google LLC in the United States and processed there.

Google LLC is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is a framework between the European Union and the United States intended to ensure compliance with European data protection standards for the processing of personal data in the United States. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available here.

Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables us to analyse the use of our website and to compile reports on website activity. Depending on the configuration of the service, the data processed may include, in particular, page views, session information, browser and device information, the operating system used, approximate geographic location, referral information and interactions with the website, such as scrolling activity and clicks. The data are associated with the relevant device. We do not use the Google Analytics User-ID feature.

Subject to your consent, Google Analytics uses cookies and similar technologies that enable your browser or device to be recognised and your use of the website to be analysed. The information collected by Google Analytics about the use of this website may also be transferred to servers operated by Google LLC in the United States and processed there.

According to Google, IP addresses are used at the time of data collection to derive approximate location information and are discarded before the data are logged or stored in any data centre or server. IP addresses are therefore not logged or stored in Google Analytics.

We have set the retention period for user- and event-level data in our Google Analytics 4 property to two months. Data subject to this retention setting are automatically deleted after the retention period in accordance with the Google Analytics deletion process. The retention setting does not affect standard aggregated reports, which may be retained for longer.

Google Analytics is used exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG, to the extent that information is stored on or accessed from your terminal equipment. You may withdraw your consent at any time with effect for the future by changing your selection in the cookie settings.

Google LLC is certified under the EU–US Data Privacy Framework. The certification is intended to ensure compliance with European data protection standards when personal data are processed in the United States. In addition, Google relies on the European Commission’s Standard Contractual Clauses for relevant international transfers of personal data. Further information is available here and here.

Further information on how Google processes personal data in connection with Google Analytics can be found in Google’s Privacy Policy and in the Google Analytics privacy documentation.

Browser Add-on

You can also prevent Google Analytics from collecting and processing data about your use of websites by downloading and installing the Google Analytics opt-out browser add-on provided by Google. The browser add-on prevents the Google Analytics JavaScript used on websites from sharing information about your visit activity with Google Analytics.

Data Processing Agreement

We have entered into a data processing agreement with Google in accordance with Article 28 GDPR for the use of Google Analytics.

Meta Pixel (formerly Facebook Pixel)

This website uses the Meta Pixel for conversion measurement. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Dublin, D04 X2K5, Ireland. According to Meta, however, the data collected are also transferred to the United States and other third countries.

This makes it possible to track the behaviour of website visitors after they have been redirected to the provider’s website by clicking on a Meta advertisement. This enables the effectiveness of Meta advertisements to be evaluated for statistical and market research purposes and future advertising measures to be optimised.

We cannot directly identify individual users from the reports made available to us. However, the data are stored and processed by Meta, so that they may be linked to the relevant user profile on Facebook or Instagram and Meta may use the data for its own advertising purposes in accordance with Meta’s data use policy. This may enable Meta to place advertisements on Facebook or Instagram pages and through other advertising channels. We, as the website operator, have no influence over this use of the data.

This service is used on the basis of your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

According to Meta’s Business Tools Terms, Meta may retain Event Data collected through the Meta Business Tools for a maximum of two years. Where audiences are created using such Event Data, Meta may retain those audiences until they are deleted via the relevant account tools.

To the extent that personal data are collected on our website using the tool described here and forwarded to Meta, we and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Dublin, D04 X2K5, Ireland, are joint controllers in respect of this data processing (Article 26 GDPR). Joint controllership is limited exclusively to the collection of the data and their transmission to Meta. Processing carried out by Meta after the data have been forwarded is not part of the joint controllership. The obligations incumbent on us jointly have been set out in a joint controllership arrangement. The wording of the arrangement can be found here. Under this arrangement, we are responsible for providing data protection information when using the Meta tool and for implementing the tool on our website in a manner that complies with data protection law. Meta is responsible for the data security of Meta products. You may exercise data subject rights (e.g. requests for access) in respect of data processed by Facebook or Instagram directly with Meta. If you exercise your data subject rights with us, we are required to forward them to Meta.

The transfer of data to the United States is based on the European Commission’s Standard Contractual Clauses. Details can be found here: and here.

Further information on protecting your privacy can be found in Meta’s privacy information .

You can also disable the “Custom Audiences” remarketing function in the advertising settings. You must be logged in to Facebook to do so.

If you do not have a Facebook or Instagram account, you can disable interest-based advertising from Meta on the website of the European Interactive Digital Advertising Alliance.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is a framework between the European Union and the United States intended to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider here.

6. Newsletter

Newsletter Data

If you would like to receive the newsletter offered on the website, we require your email address as well as information that enables us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. No further data are collected, or they are collected only on a voluntary basis. We use newsletter service providers, which are described below, to manage the newsletter.

Brevo

This website uses Brevo to send newsletters. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo is a service that can be used, among other things, to organise and analyse the distribution of newsletters. The data you enter for the purpose of receiving the newsletter are processed and stored on servers located within the European Union.

Data Analysis by Brevo

Brevo enables us to analyse our newsletter campaigns. For example, we can see whether a newsletter message has been opened and which links, if any, have been clicked. This enables us, among other things, to determine which links have been clicked particularly frequently.

We can also determine whether certain predefined actions were carried out after a message was opened or a link was clicked (conversion rate). For example, we can determine whether you made a purchase after clicking on the newsletter.

Brevo also enables us to divide newsletter recipients into different categories (“clusters”). Newsletter recipients can, for example, be divided by age, gender or place of residence. This allows newsletters to be adapted more closely to the relevant target groups.

If you do not wish your data to be analysed by Brevo, you must unsubscribe from the newsletter. We provide an appropriate link in every newsletter message for this purpose.

Detailed information on Brevo’s functions can be found here.

Legal Basis

The data processing is based on your consent (Article 6(1)(a) GDPR). You may withdraw this consent at any time. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal.

Storage Period

The data you provide to us for the purpose of receiving the newsletter are stored by us or the newsletter service provider until you unsubscribe from the newsletter and are erased from the newsletter distribution list after you unsubscribe. Data stored by us for other purposes remain unaffected.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider on a suppression list where this is necessary to prevent future mailings. The data on the suppression list are used only for this purpose and are not combined with other data. This serves both your interests and our interest in complying with the statutory requirements governing the sending of newsletters (legitimate interest within the meaning of Article 6(1)(f) GDPR). Storage on the suppression list is not limited in time. You may object to the storage if your interests override our legitimate interest.

Further details can be found in Brevo’s privacy information.

Data Processing Agreement

Transactional Communications Following the Purchase of Paid Digital Products

Following the purchase of a paid digital product, including digital content or a digital service, through Lemon Squeezy, the order information required for the performance and administration of the contractual relationship is transmitted to Wine all the Way.

This includes, in particular, the name, email address, order identifier, customer identifier and information about the digital product purchased as well as, where applicable, details of the start and expiry of an access period.

The data are used to provide and administer the purchased digital product and to send transaction-related information. Depending on the product purchased, such communications may include information concerning the right of withdrawal, information relating to the purchase or provision of digital content, access information for digital services, reminders before an access period expires or technical service information.

For this purpose, selected data are transmitted to the service provider Brevo. These may include, in particular, the email address, name, information about the digital product purchased, where applicable information about the start and end of an access period, the order identifier, the customer identifier and other technical reference data required to administer the contractual relationship and send the relevant transactional communications.

The data are transmitted exclusively for the purpose of carrying out automated transaction-related communications and, where applicable, managing the relevant access entitlement. Payment data are not transmitted to Brevo.

For transaction-related emails, Brevo may record opens and link clicks in an aggregated form that is not associated with individual contacts. This information is not associated with individual recipients or contact profiles. The analysis is used exclusively for technical quality control and to verify the functioning of email delivery.

These data are not used for the general newsletter. Transaction-related communications are sent exclusively for the performance and administration of the existing contractual relationship and, where applicable, to provide information required by law in connection with the purchase. Subscription to the general newsletter continues to require a separate registration and consent.

The processing is based on Article 6(1)(b) GDPR to the extent that it is necessary for the performance and administration of the contractual relationship. To the extent that processing is necessary to comply with statutory information or documentation obligations applicable to Wine all the Way, it is based on Article 6(1)(c) GDPR.

7. E-Commerce and Payment Providers

Processing of Customer and Contract Data

We collect, process and use personal customer and contract data in order to establish, structure and amend our contractual relationships. We collect, process and use personal data relating to the use of this website (usage data) only to the extent necessary to enable the user to use the service or for billing purposes. The legal basis for this is Article 6(1)(b) GDPR.

The customer data collected are erased after completion of the order or termination of the business relationship and expiry of any applicable statutory retention periods. Statutory retention periods remain unaffected.

Order and Purchase Processing via Lemon Squeezy (Merchant of Record)

Paid digital products, including digital content and digital services, offered on this website are not sold directly by Wine all the Way. Instead, the purchase contract is concluded with Lemon Squeezy as Merchant of Record.

As the legal seller, Lemon Squeezy is responsible in particular for checkout processing, payment processing, invoicing, tax handling, fraud prevention, chargeback handling and refund processes.

The personal data collected in this context are processed by Lemon Squeezy in accordance with its role in the relevant processing operation, as described below.

The following Merchant of Record is used in connection with this website:

Lemon Squeezy

Lemon Squeezy is operated by Sold through Link, LLC f/k/a Lemon Squeezy LLC, 354 Oyster Point Blvd., South San Francisco, CA 94080.

Lemon Squeezy acts as Merchant of Record and, for the buyer-facing processing required to conclude and administer purchases, including checkout, payment processing, invoicing, tax handling, fraud prevention, chargebacks and refunds, independently determines the purposes and means of processing and acts as an independent controller within the meaning of Article 4(7) GDPR. Separately, to the extent that Lemon Squeezy processes personal data solely on behalf of Wine all the Way for services governed by the applicable data processing agreement and in accordance with Wine all the Way’s documented instructions, Lemon Squeezy acts as a processor within the meaning of Article 28 GDPR. Once order information is transmitted to Wine all the Way, Wine all the Way processes those data as controller for the provision and administration of the purchased digital products, including digital content and digital services, and the related access rights.

During the purchase process, the customer enters the data required to conclude the purchase contract directly in Lemon Squeezy’s checkout environment.

Wine all the Way does not transmit credit card, bank or other payment data to Lemon Squeezy.

Following a successful purchase, Wine all the Way receives from Lemon Squeezy, by means of a technical notification (webhook), the order information required for the performance of the contractual relationship. This includes, in particular, the name, email address, order number, customer identifier, order status, product information and information about the start and expiry of the relevant access entitlement.

The data transmitted are processed to provide the purchased digital products, including digital content and digital services, and to provide transaction-related communications. Where required for a digital service, the data are also processed to create or update user accounts and manage access entitlements.

Payment instruments such as credit card details, bank details or PayPal account details are not transmitted to Wine all the Way. They remain exclusively within the checkout and payment infrastructure of Lemon Squeezy and its payment service providers.

User Account and Access Management for Digital Services

To provide purchased digital services that require a user account or access entitlement (e.g. wine quizzes), the order information transmitted by Lemon Squeezy is processed within the members’ area of the website. The email address transmitted may be used to assign the purchase to an existing user account or to create a new user account.

Where required for the purchased digital service, the relevant access entitlement is assigned to the user automatically following a successful purchase and managed for the intended term.

In addition, technical reference data may be stored, in particular order identifiers, customer identifiers, product or service assignments and, where applicable, information about the start and end of the relevant access period.

The processing is carried out for the purpose of providing and managing the digital service purchased on the basis of Article 6(1)(b) GDPR.

The order and usage data transmitted by Lemon Squeezy to Wine all the Way are processed on the following legal bases:

Article 6(1)(b) GDPR (performance of the contractual relationship, in particular the provision of the purchased digital service and, where applicable, the management of the associated user account and access entitlement);
Article 6(1)(f) GDPR (legitimate interest in the secure, traceable and efficient technical administration of the contractual relationship, including support and the prevention of misuse);
Article 6(1)(c) GDPR (compliance with statutory retention, record-keeping and documentation obligations, to the extent that these apply to Wine all the Way).

Lemon Squeezy is based in the United States. To the extent that personal data are transferred to or processed by Lemon Squeezy, this is carried out in accordance with the privacy information provided by Lemon Squeezy and the applicable safeguards for transfers to third countries, in particular the European Commission’s Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR, where required.

To the extent that Lemon Squeezy processes personal data in its capacity as an independent controller, data subjects may exercise their rights under data protection law directly with Lemon Squeezy. Lemon Squeezy’s contact details and further information on its processing of personal data can be found in Lemon Squeezy’s Privacy Policy and in its Data Processing Agreement.

The period for which your data are stored by Lemon Squeezy is governed by its privacy policy and the retention periods stated there (in particular retention obligations under tax and commercial law in the United States and the EU).