Privacy Policy and Consents
Table of contents
1. Objective and responsible entity
2. Basic information on data processing
3. Processing of personal data
4. Collection of access data
5. Cookies & reach measurement
6. Google Analytics
7. Google Re/Marketing Services
8. Facebook Social Plugins
9. Facebook Remarketing
10. Twitter buttons
11. +1 button from Google+
12. Newsletter
13. Integration of third-party services and content
14. Rights of users and deletion
15. Changes to the privacy policy
1. Objective and responsible entity
This privacy policy explains the nature, scope and purpose of the processing (including collection, processing and use, as well as the obtaining of consents) of personal data within our online offering and the websites, functions and content connected with it (hereinafter jointly referred to as the “online offering” or “website”). The privacy policy applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) on which the online offering is run.
The provider of the online offering and the entity responsible under data protection law is [Umbriaweine.com, owner: André Johannes Keuter, Möllenkamp 9, 48455 Bad Bentheim] (hereinafter referred to as the “provider”, “we” or “us”). For contact options, we refer to our legal notice.
The term “user” covers all customers and visitors of our online offering. The terms used, such as “user”, are to be understood as gender-neutral.
2. Basic information on data processing
We process users’ personal data only in compliance with the relevant data protection provisions, in accordance with the principles of data economy and data avoidance. This means that users’ data is only processed where there is a legal permission, in particular where the data is necessary for the provision of our contractual services and online services, or is required by law, or where consent has been given.
We take organisational, contractual and technical security measures in accordance with the state of the art to ensure that the provisions of data protection laws are complied with and to protect the data processed by us against accidental or intentional manipulation, loss, destruction or access by unauthorised persons.
If, within the scope of this privacy policy, content, tools or other means from other providers (hereinafter jointly referred to as “third-party providers”) are used and their stated registered office is abroad, it is to be assumed that a data transfer to the countries in which the third-party providers are based will take place. Data is transferred to third countries either on the basis of a legal permission, users’ consent or special contractual clauses that ensure the legally required security of the data.
3. Processing of personal data
In addition to the uses expressly mentioned in this privacy policy, personal data is processed for the following purposes on the basis of legal permissions or users’ consent:
– Providing, delivering, maintaining, optimising and securing our services, service and user benefits;
– Ensuring effective customer service and technical support.
We only pass on users’ data to third parties if this is necessary for billing purposes (e.g. to a payment service provider) or for other purposes if these are necessary to fulfil our contractual obligations to users (e.g. passing on addresses to suppliers).
When contacting us (via contact form or email), the user’s details are stored for the purpose of processing the enquiry and in case follow-up questions arise.
Personal data is deleted as soon as it has fulfilled its purpose and there are no retention obligations preventing deletion.
4. Collection of access data
We collect data about every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
We use the log data, without assigning it to the person of the user or creating any other profiles, only for statistical evaluations for the purpose of operating, securing and optimising our online offering in accordance with the statutory provisions. However, we reserve the right to check the log data retrospectively if there is a justified suspicion of unlawful use based on specific indications.
5. Cookies & reach measurement
Cookies are information that is transferred from our web server or third-party web servers to users’ web browsers and stored there for later retrieval. Users are informed about the use of cookies in the context of pseudonymous reach measurement within the scope of this privacy policy.
Viewing this online offering is also possible without cookies. If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Excluding cookies may lead to functional restrictions of this online offering.
It is possible to manage many online advertising cookies from companies via the US website http://www.aboutads.info/choices or the EU website http://www.youronlinechoices.com/uk/your-ad-choices/.
6. Google Analytics
We use Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google uses cookies. The information generated by the cookie about users’ use of the online offering is usually transmitted to a Google server in the USA and stored there.
Google will use this information on our behalf to evaluate users’ use of our online offering, to compile reports on activities within this online offering and to provide us with other services related to the use of this online offering and internet usage. In doing so, pseudonymous user profiles may be created from the processed data.
We use Google Analytics only with IP anonymisation activated. This means that users’ IP addresses are shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.
The IP address transmitted by the user’s browser is not merged with other Google data. Users can prevent the storage of cookies by adjusting their browser software settings; users can also prevent the collection of the data generated by the cookie and related to their use of the online offering and the processing of this data by Google by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
Further information on Google’s use of data for advertising purposes, setting and objection options can be found on Google’s websites: https://www.google.com/intl/de/policies/privacy/partners (“Google’s use of data when you use our partners’ websites or apps”), http://www.google.com/policies/technologies/ads (“Use of data for advertising purposes”), http://www.google.de/settings/ads (“Manage information Google uses to show you ads”) and http://www.google.com/ads/preferences (“Determine which ads Google shows you”).
7. Google Re/Marketing Services
We use the marketing and remarketing services (“Google Marketing Services” for short) of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).
Google Marketing Services allow us to display advertisements for and on our website in a more targeted way, in order to present users only with ads that potentially match their interests. For example, if users are shown ads for products they have been interested in on other websites, this is referred to as “remarketing”. For these purposes, when our website and other websites on which Google Marketing Services are active are accessed, Google immediately executes a code from Google and so-called (re)marketing tags (invisible graphics or code, also known as “web beacons”) are integrated into the website. With their help, an individual cookie, i.e. a small file, is stored on the user’s device (comparable technologies can also be used instead of cookies). Cookies can be set by various domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com or googleadservices.com. This file records which websites the user has visited, which content they are interested in and which offers they have clicked, as well as technical information about the browser and operating system, referring websites, visit time and other information about the use of the online offering. Users’ IP addresses are also recorded, whereby we inform Google Analytics that the IP address is shortened within member states of the European Union or in other contracting states of the Agreement on the European Economic Area and only in exceptional cases is it transmitted in full to a Google server in the USA and shortened there. The IP address is not merged with the user’s data within other Google services. The aforementioned information may also be combined with such information from other sources. If the user subsequently visits other websites, ads tailored to their interests may be displayed to them.
Users’ data is processed pseudonymously within the scope of Google Marketing Services. This means that Google does not store and process, for example, users’ names or email addresses, but processes the relevant data cookie-related within pseudonymous user profiles. This means that from Google’s perspective, the ads are not managed and displayed for a specifically identified person, but for the cookie holder, regardless of who that cookie holder is. This does not apply if a user has expressly allowed Google to process the data without this pseudonymisation. The information collected by “DoubleClick” about users is transmitted to Google and stored on Google’s servers in the USA.
The Google Marketing Services we use include, among others, the online advertising programme “Google AdWords”. In the case of Google AdWords, each AdWords customer receives a different “conversion cookie”. Cookies therefore cannot be tracked across the websites of AdWords customers. The information obtained with the help of the cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking. AdWords customers learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.
On the basis of the Google Marketing Service “DoubleClick”, we integrate third-party advertisements. DoubleClick uses cookies to enable Google and its partner websites to place ads based on users’ visits to this website or other websites on the internet.
We also integrate third-party advertisements on the basis of the Google Marketing Service “AdSense”. AdSense uses cookies to enable Google and its partner websites to place ads based on users’ visits to this website or other websites on the internet.
Another Google Marketing Service we use is “Google Tag Manager”, which can be used to integrate additional Google analytics and marketing services into our website (e.g. “AdWords”, “DoubleClick” or “Google Analytics”).
Further information on Google’s use of data for marketing purposes can be found on the overview page: https://www.google.com/policies/technologies/ads; Google’s privacy policy is available at https://www.google.com/policies/privacy.
If you would like to object to collection by Google Marketing Services, you can use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences.
8. Facebook Social Plugins
Our online offering uses social plugins (“plugins”) of the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). The plugins can be recognised by one of the Facebook logos (white “f” on a blue tile, the terms “Like”, “Gefällt mir” or a “thumbs up” sign) or are marked with the addition “Facebook Social Plugin”. The list and appearance of Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/.
When a user accesses a function of this online offering that contains such a plugin, their device establishes a direct connection to Facebook’s servers. The content of the plugin is transmitted by Facebook directly to the user’s device and integrated into the online offering by it. User profiles may be created from the processed data. We therefore have no influence on the scope of the data that Facebook collects with the help of this plugin and therefore inform users according to our level of knowledge.
By integrating the plugins, Facebook receives the information that a user has accessed the corresponding page of the online offering. If the user is logged in to Facebook, Facebook can assign the visit to their Facebook account. If users interact with the plugins, for example by clicking the Like button or leaving a comment, the corresponding information is transmitted directly from their device to Facebook and stored there. If a user is not a Facebook member, it is still possible that Facebook will obtain and store their IP address. According to Facebook, only an anonymised IP address is stored in Germany.
Users can find out the purpose and scope of data collection and the further processing and use of the data by Facebook, as well as the related rights and setting options to protect users’ privacy, in Facebook’s privacy policy: https://www.facebook.com/about/privacy/.
If a user is a Facebook member and does not want Facebook to collect data about them via this online offering and link it to their membership data stored on Facebook, they must log out of Facebook before using our online offering and delete their cookies. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.
9. Facebook Remarketing
Within our online offering, so-called “Facebook pixels” of the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are based in the EU, by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”), are used. With the help of the Facebook pixel, Facebook is able to determine the visitors to our offering as a target group for the display of ads, so-called “Facebook ads”. Accordingly, we use the Facebook pixel to display the Facebook ads we place only to those Facebook users who have also shown an interest in our online offering. This means that with the help of the Facebook pixel, we want to ensure that our Facebook ads match users’ potential interests and do not appear annoying. With the help of the Facebook pixel, we can also track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad.
The Facebook pixel is integrated by Facebook directly when our websites are accessed and can store a so-called cookie, i.e. a small file, on your device. If you then log in to Facebook or visit Facebook while logged in, the visit to our offering is noted in your profile. The data collected about you is anonymous to us, so it does not allow us to draw any conclusions about the identity of users. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible. Facebook processes the data in accordance with Facebook’s data use policy. Accordingly, you can find further information on how the remarketing pixel works and on the display of Facebook ads in general in Facebook’s data use policy: https://www.facebook.com/policy.php.
You can object to collection by the Facebook pixel and the use of your data to display Facebook ads. To do so, you can visit the page set up by Facebook and follow the instructions on the settings for usage-based advertising: https://www.facebook.com/settings?tab=ads or declare your objection via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.
10. Twitter buttons
We use the buttons of the Twitter service. These buttons are provided by Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA. They can be recognised by terms such as “Twitter” or “Follow” or are linked to a stylised blue bird. With the help of the buttons, it is possible to share a post or website of this online offering on Twitter or to follow the provider on Twitter.
When a user accesses a website of this online offering that contains such a button, their browser establishes a direct connection to Twitter’s servers. The content of the Twitter buttons is transmitted by Twitter directly to the user’s browser. We therefore have no influence on the scope of the data that Twitter collects with the help of this plugin and inform users according to our level of knowledge. According to this, only the user’s IP address and the URL of the respective website are transmitted when the button is accessed, but are not used for purposes other than displaying the button.
Further information can be found in Twitter’s privacy policy at http://twitter.com/privacy.
12. Google+
We use the buttons of the social network Google+ (e.g. “+1” button), which is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (“Google”).
When a user accesses a website of this online offering that contains such a button, the browser establishes a direct connection to Google’s servers. The content of the buttons is transmitted by Google directly to their browser and integrated into the website by it. The provider therefore has no influence on the scope of the data that Google collects with the buttons.
According to Google, no personal data is collected without clicking the button. Only for logged-in members of Google+ is such data, including the IP address, collected and processed.
Further information on the processing of your data by Google can be found on the overview page: https://www.google.com/policies/technologies/ads/; Google’s privacy policy is available at https://www.google.com/policies/privacy/ .
If you would like to object to collection by Google Marketing Services, you can use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences/.
13. Newsletter
With the following information, we inform you about the content of our newsletter as well as the registration, dispatch and statistical evaluation procedures and your rights of objection. By subscribing to our newsletter, you agree to receive it and to the procedures described.
Newsletter content: We send newsletters, emails and other electronic notifications with promotional information (hereinafter “newsletter”) only with the recipients’ consent or a legal permission. If the content of the newsletter is specifically described when registering for the newsletter, it is decisive for the users’ consent. Otherwise, our newsletters contain the following information: [e.g. “our products, offers, promotions and our company”].
Double opt-in and logging: Registration for our newsletter takes place using a so-called double opt-in procedure. This means that after registering, you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with someone else’s email address. Newsletter registrations are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the registration and confirmation time as well as the IP address. Likewise, changes to your data stored with the shipping service provider are logged.
Shipping service provider: The newsletters are sent via “[NAME, PROVIDE ADDRESS OF SHIPPING SERVICE PROVIDER]” (hereinafter referred to as the “shipping service provider”). You can view the shipping service provider’s privacy policy here: [PLEASE PROVIDE LINK].
The email addresses of our newsletter recipients, as well as their other data described in these notes, are stored on the servers of the shipping service provider. The shipping service provider uses this information to send and evaluate the newsletters on our behalf. Furthermore, according to its own information, the shipping service provider may use this data to optimise or improve its own services, e.g. to technically optimise the dispatch and presentation of the newsletters or for economic purposes in order to determine which countries the recipients come from. However, the shipping service provider does not use the data of our newsletter recipients to write to them itself or to pass it on to third parties.
Registration data: To register for the newsletter, it is sufficient to provide your email address. Optionally, we ask you to provide the following data: [PLEASE PROVIDE FURTHER DATA REQUESTED HERE AND ITS PURPOSE, e.g. “First and last name for personalising the newsletter. Date of birth, gender and industry to tailor the newsletter content to the interests of our readers”].
Statistical collection and analyses – The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from the shipping service provider’s server when the newsletter is opened. As part of this retrieval, technical information is first collected, such as information about the browser and your system, as well as your IP address and the time of retrieval. This information is used to technically improve the services based on the technical data or the target groups and their reading behaviour based on the retrieval locations (which can be determined using the IP address) or the access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, neither we nor the shipping service provider endeavour to monitor individual users. The evaluations serve much more to recognise our users’ reading habits and to adapt our content to them or to send different content according to our users’ interests.
Cancellation/revocation – You can cancel receiving our newsletter at any time, i.e. revoke your consents. This simultaneously expires your consent to its dispatch by the shipping service provider and the statistical analyses. Unfortunately, a separate revocation of dispatch by the shipping service provider or the statistical evaluation is not possible. You will find a link to cancel the newsletter at the end of each newsletter.
14. Integration of third-party services and content
It may happen that content or services from third-party providers, such as city maps or fonts from other websites, are integrated within our online offering. The integration of content from third-party providers always requires that the third-party providers can perceive the users’ IP address, as they could not otherwise send the content to the users’ browser without the IP address. The IP address is therefore required for the display of this content. Furthermore, the providers of the third-party content may set their own cookies and process users’ data for their own purposes. User profiles may be created from the processed data. We will use this content as sparingly as possible and avoid data wherever possible, and will select reliable third-party providers with regard to data security.
The following presentation provides an overview of third-party providers and their content, along with links to their privacy policies, which contain further information on data processing and, in some cases already mentioned here, objection options (so-called opt-out):
– External fonts from Google, Inc., https://www.google.com/fonts (“Google Fonts”). Google Fonts are integrated by calling a server at Google (usually in the USA). Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://www.google.com/settings/ads/.
– Maps from the “Google Maps” service provided by the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://www.google.com/settings/ads/.
– Videos from the “YouTube” platform of the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://www.google.com/settings/ads/.
15. Rights of users and deletion of data
Users have the right, upon request, to receive information free of charge about the personal data stored by us about them.
In addition, users have the right to have incorrect data corrected, to revoke consents, to block and delete their personal data, and the right to lodge a complaint with the competent supervisory authority in the event of suspected unlawful data processing.
The data stored by us is deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing deletion.
16. Changes to the privacy policy
We reserve the right to change the privacy policy in order to adapt it to changed legal situations or in the event of changes to the service and data processing. However, this applies only with regard to statements on data processing. If users’ consent is required or parts of the privacy policy contain provisions of the contractual relationship with users, the changes will only be made with users’ consent.
Users are asked to regularly inform themselves about the content of the privacy policy.
Status: [15 February 2017]