Privacy Policy and Consents
Table of contents
1. Objective and responsible entity
2. Basic information on data processing
3. Processing of personal data
4. Collection of access data
5. Cookies & reach measurement
6. Google Analytics
7. Google Re/Marketing Services
8. Facebook Social Plugins
9. Facebook Remarketing
10. Twitter buttons
11. +1 button from Google+
12. Newsletter
13. Integration of third-party services and content
14. Rights of users and deletion
15. Changes to the privacy policy
1. Objective and responsible entity
This privacy policy explains the nature, scope and purpose of the processing (including collection, processing and use, as well as the obtaining of consents) of personal data within our online offering and the websites, functions and content connected with it (hereinafter jointly referred to as the “online offering” or “website”). The privacy policy applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) on which the online offering is run.
The provider of the online offering and the entity responsible under data protection law is [Umbriaweine.com, owner: André Johannes Keuter, Möllenkamp 9, 48455 Bad Bentheim] (hereinafter referred to as the “provider”, “we” or “us”). For contact options, we refer to our legal notice.
The term “user” covers all customers and visitors of our online offering. The terms used, such as “user”, are to be understood as gender-neutral.
2. Basic information on data processing
We process users’ personal data only in compliance with the relevant data protection provisions, in accordance with the principles of data economy and data avoidance. This means that users’ data is only processed where there is a legal permission, in particular where the data is necessary for the provision of our contractual services and online services, or is required by law, or where consent has been given.
We take organisational, contractual and technical security measures in accordance with the state of the art in order to ensure that the provisions of data protection laws are observed and thereby to protect the data processed by us against accidental or intentional manipulation, loss, destruction or against access by unauthorised persons.
Insofar as, within the scope of this privacy policy, content, tools or other means from other providers (hereinafter jointly referred to as “third-party providers”) are used and their stated registered office is abroad, it must be assumed that a data transfer to the countries of registered office of the third-party providers takes place. The transfer of data to third countries takes place either on the basis of a legal permission, a consent of the users, or special contractual clauses that guarantee the legally required security of the data.
3. Processing of personal data
In addition to the use expressly mentioned in this privacy policy, personal data is processed for the following purposes on the basis of legal permissions or consents of the users:
– The provision, execution, maintenance, optimisation and securing of our services, service and user performances;
– Ensuring effective customer service and technical support.
We transfer users’ data to third parties only where this is necessary for billing purposes (e.g. to a payment service provider) or for other purposes where these are necessary in order to fulfil our contractual obligations towards users (e.g. providing the address to suppliers).
When contacting us (by contact form or email), the user’s details are stored for the purpose of processing the enquiry and in case follow-up questions arise.
Personal data is deleted once it has fulfilled its purpose and no retention obligations prevent deletion.
4. Collection of access data
We collect data on every access to the server on which this service is located (so-called server log files). The access data includes the name of the retrieved web page, file, date and time of the retrieval, amount of data transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
We use the log data without attribution to the person of the user or other profiling, in accordance with the legal provisions, only for statistical evaluations for the purpose of operating, securing and optimising our online offering. However, we reserve the right to check the log data subsequently if, on the basis of concrete indications, there is a justified suspicion of unlawful use.
5. Cookies & reach measurement
Cookies are pieces of information that are transferred from our web server or web servers of third parties to the users’ web browsers and stored there for later retrieval. Users are informed about the use of cookies within the scope of pseudonymous reach measurement in this privacy policy.
Viewing this online offering is also possible with cookies disabled. If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. Disabling cookies may lead to functional limitations of this online offering.
It is possible to manage many online advertising cookies from companies via the US site http://www.aboutads.info/choices or the EU site http://www.youronlinechoices.com/uk/your-ad-choices/.
6. Google Analytics
We use Google Analytics, a web analytics service of Google Inc. (“Google”). Google uses cookies. The information generated by the cookie about users’ use of the online offering is generally transferred to a Google server in the USA and stored there.
Google will use this information on our behalf to evaluate users’ use of our online offering, to compile reports on the activities within this online offering and to provide us with further services connected with the use of this online offering and internet use. In doing so, pseudonymous usage profiles of the users can be created from the processed data.
We use Google Analytics only with IP anonymisation activated. This means that the users’ IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.
The IP address transmitted by the user’s browser is not merged with other data from Google. Users can prevent the storage of cookies by a corresponding setting of their browser software; users can furthermore prevent the collection of the data generated by the cookie and relating to their use of the online offering by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=en.
Further information on the use of data for advertising purposes by Google, settings and objection options, can be found on Google’s websites: https://www.google.com/intl/en/policies/privacy/partners (“Data use by Google when you use our partners’ websites or apps”), http://www.google.com/policies/technologies/ads (“Data use for advertising purposes”), http://www.google.de/settings/ads (“Manage information that Google uses to show you advertising”) and http://www.google.com/ads/preferences (“Determine which advertising Google shows you”).
7. Google Re/Marketing Services
We use the marketing and remarketing services (in short “Google marketing services”) of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (“Google”).
The Google marketing services allow us to display advertisements for and on our website in a more targeted manner, in order to present users only with advertisements that potentially correspond to their interests. If, for example, a user is shown advertisements for products in which he has shown interest on other websites, this is referred to as “remarketing”. For these purposes, when our and other websites on which Google marketing services are active are accessed, a code from Google is executed directly by Google and so-called (re)marketing tags (invisible graphics or code, also referred to as “web beacons”) are integrated into the website. With their help, an individual cookie, i.e. a small file, is stored on the user’s device (instead of cookies, comparable technologies can also be used). The cookies can be set by various domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com or googleadservices.com. This file records which websites the user has visited, which content he is interested in and which offers he has clicked on, as well as technical information about the browser and operating system, referring websites, visit time and further details about the use of the online offering. The user’s IP address is also recorded, whereby, in the context of Google Analytics, we state that the IP address is shortened within member states of the European Union or in other contracting states of the Agreement on the European Economic Area and only transferred in full to a Google server in the USA and shortened there in exceptional cases. The IP address is not merged with the user’s data within other Google offerings. The aforementioned information can also be combined with such information from other sources. If the user subsequently visits other websites, the advertisements tailored to him can be displayed to him according to his interests.
Users’ data is processed pseudonymously within the scope of the Google marketing services. This means that Google does not store or process, for example, the name or email address of the users, but processes the relevant data cookie-related within pseudonymous user profiles. This means that, from Google’s point of view, the advertisements are not managed and displayed for a specifically identified person, but for the cookie holder, regardless of who this cookie holder is. This does not apply if a user has expressly permitted Google to process the data without this pseudonymisation. The information collected about users by “DoubleClick” is transmitted to Google and stored on Google’s servers in the USA.
The Google marketing services used by us include, among others, the online advertising programme “Google AdWords”. In the case of Google AdWords, each AdWords customer receives a different “conversion cookie”. Cookies can therefore not be tracked across the websites of AdWords customers. The information obtained with the help of the cookie serves to compile conversion statistics for AdWords customers who have opted for conversion tracking. The AdWords customers learn the total number of users who clicked on their advertisement and were forwarded to a page provided with a conversion tracking tag. However, they do not receive any information with which users can be personally identified.
On the basis of the Google marketing service “DoubleClick”, we integrate advertisements from third parties. DoubleClick uses cookies with which Google and its partner websites are enabled to place advertisements on the basis of users’ visits to this website or other websites on the internet.
We furthermore integrate advertisements from third parties on the basis of the Google marketing service “AdSense”. AdSense uses cookies with which Google and its partner websites are enabled to place advertisements on the basis of users’ visits to this website or other websites on the internet.
Another Google marketing service used by us is the “Google Tag Manager”, with the help of which further Google analysis and marketing services can be integrated into our website (e.g. “AdWords”, “DoubleClick” or “Google Analytics”).
For further information on the use of data for marketing purposes by Google, please see the overview page: https://www.google.com/policies/technologies/ads; Google’s privacy policy is available at https://www.google.com/policies/privacy.
If you wish to object to the collection by Google marketing services, you can use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences.
8. Facebook Social Plugins
Our online offering uses social plugins (“plugins”) of the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). The plugins are recognisable by one of the Facebook logos (white “f” on a blue tile, the terms “Like”, “Gefällt mir” or a “thumbs up” sign) or are marked with the addition “Facebook Social Plugin”. The list and appearance of the Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/.
When a user calls up a function of this online offering that contains such a plugin, his device establishes a direct connection with Facebook’s servers. The content of the plugin is transmitted by Facebook directly to the user’s device and integrated by it into the online offering. In doing so, usage profiles of the users can be created from the processed data. We therefore have no influence on the scope of the data that Facebook collects with the help of this plugin and inform the users accordingly to the best of our knowledge.
Through the integration of the plugins, Facebook receives the information that a user has called up the corresponding page of the online offering. If the user is logged in to Facebook, Facebook can attribute the visit to his Facebook account. When users interact with the plugins, for example press the Like button or submit a comment, the corresponding information is transmitted directly from their device to Facebook and stored there. If a user is not a member of Facebook, there is nevertheless the possibility that Facebook finds out and stores his IP address. According to Facebook, only an anonymised IP address is stored in Germany.
Users can take the purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as the related rights and setting options for protecting users’ privacy, from Facebook’s privacy notices: https://www.facebook.com/about/privacy/.
If a user is a Facebook member and does not want Facebook to collect data about him via this online offering and link it to his membership data stored on Facebook, he must log out of Facebook before using our online offering and delete his cookies. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. The settings are made platform-independently, i.e. they are adopted for all devices, such as desktop computers or mobile devices.
9. Facebook Remarketing
Within our online offering, so-called “Facebook pixels” of the social network Facebook are used, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are resident in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). With the help of the Facebook pixel, it is possible for Facebook to determine the visitors of our offering as a target group for the display of advertisements, so-called “Facebook Ads”. Accordingly, we use the Facebook pixel in order to display the Facebook Ads placed by us only to those Facebook users who have also shown an interest in our internet offering. This means that, with the help of the Facebook pixel, we want to ensure that our Facebook Ads correspond to the potential interest of the users and do not have a harassing effect. With the help of the Facebook pixel, we can furthermore track the effectiveness of the Facebook advertisements for statistical and market research purposes, by seeing whether users were forwarded to our website after clicking on a Facebook advertisement.
The Facebook pixel is integrated directly by Facebook when our web pages are called up and can store a so-called cookie, i.e. a small file, on your device. If you subsequently log in to Facebook or visit Facebook while logged in, the visit to our offering is noted in your profile. The data collected about you is anonymous for us, i.e. it does not provide us with any conclusions about the identity of the users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible. The processing of the data by Facebook takes place within the scope of Facebook’s data use policy. Accordingly, you receive further information on the functioning of the remarketing pixel and generally on the display of Facebook Ads in Facebook’s data use policy: https://www.facebook.com/policy.php.
You can object to the collection by the Facebook pixel and the use of your data for the display of Facebook Ads. To do this, you can call up the page set up by Facebook and follow the instructions there on the settings for usage-based advertising: https://www.facebook.com/settings?tab=ads or declare the objection via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. The settings are made platform-independently, i.e. they are adopted for all devices, such as desktop computers or mobile devices.
10. Twitter buttons
We use the buttons of the Twitter service. These buttons are offered by Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA. They are recognisable by terms such as “Twitter” or “Follow” or connected with a stylised blue bird. With the help of the buttons, it is possible to share a post or web page of this online offering on Twitter or to follow the provider on Twitter.
When a user calls up a web page of this online offering that contains such a button, his browser establishes a direct connection with Twitter’s servers. The content of the Twitter button is transmitted by Twitter directly to the user’s browser. We therefore have no influence on the scope of the data that Twitter collects with the help of this plugin and inform users accordingly to the best of our knowledge. According to this, only the user’s IP address and the URL of the respective web page is transmitted when the button is retrieved, but is not used for purposes other than the display of the button.
Further information on this can be found in Twitter’s privacy policy at http://twitter.com/privacy.
12. Google+
We use the buttons of the social network Google+ (e.g. “+1” button), which is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (“Google”).
When a user calls up a web page of this online offering that contains such a button, the browser establishes a direct connection with Google’s servers. The content of the buttons is transmitted by Google directly to his browser and integrated by it into the web page. The provider therefore has no influence on the scope of the data that Google collects with the buttons.
According to Google, no personal data is collected without a click on the button. Only for logged-in members of Google+ is such data, including the IP address, collected and processed.
Further information on the processing of your data by Google can be found on the overview page: https://www.google.com/policies/technologies/ads/; Google’s privacy policy is available at https://www.google.com/policies/privacy/ .
If you wish to object to the collection by Google marketing services, you can use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences/.
13. Newsletter
With the following notes, we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedure and your rights of objection. By subscribing to our newsletter, you agree to the receipt and the described procedures.
Content of the newsletter: We send newsletters, emails and further electronic notifications with promotional information (hereinafter “newsletter”) only with the consent of the recipients or a legal permission. Insofar as the contents of the newsletter are specifically described in the context of a registration for the newsletter, they are decisive for the users’ consent. Otherwise, our newsletters contain the following information: [e.g. “our products, offers, promotions and our company”].
Double opt-in and logging: Registration for our newsletter takes place in a so-called double opt-in procedure. This means that, after registration, you receive an email in which you are asked to confirm your registration. This confirmation is necessary so that no one can register with other people’s email addresses. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes the storage of the registration and confirmation time, as well as the IP address. Likewise, the changes to your data stored at the dispatch service provider are logged.
Dispatch service provider: The newsletters are dispatched by means of “[INSERT NAME, ADDRESS OF THE DISPATCH SERVICE PROVIDER]” (hereinafter referred to as the “dispatch service provider”). You can view the privacy provisions of the dispatch service provider here: [PLEASE PROVIDE LINK].
The email addresses of our newsletter recipients, as well as their further data described within these notes, are stored on the servers of the dispatch service provider. The dispatch service provider uses this information to dispatch and evaluate the newsletters on our behalf. Furthermore, according to its own information, the dispatch service provider can use this data to optimise or improve its own services, e.g. for the technical optimisation of the dispatch and display of the newsletters or for economic purposes, in order to determine which countries the recipients come from. However, the dispatch service provider does not use the data of our newsletter recipients to write to them itself or to pass them on to third parties.
Registration data: To register for the newsletter, it is sufficient for you to provide your email address. Optionally, we ask you to provide the following data: [PLEASE PROVIDE FURTHER REQUESTED DATA AND ITS PURPOSE HERE, e.g. “first and last name for the purpose of personalising the newsletter. Date of birth, gender and industry in order to adapt the contents of the newsletter to the interests of our readers”].
Statistical collection and analyses – The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from the server of the dispatch service provider when the newsletter is opened. In the course of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and time of retrieval, is initially collected. This information is used for the technical improvement of the services on the basis of the technical data or the target groups and their reading behaviour on the basis of their retrieval locations (which can be determined with the help of the IP address) or the access times. The statistical collections also include the determination of whether the newsletters are opened, when they are opened and which links are clicked. This information can, for technical reasons, be attributed to the individual newsletter recipients. However, it is neither our endeavour nor that of the dispatch service provider to observe individual users. The evaluations serve us much more to recognise the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.
Cancellation/revocation – You can cancel the receipt of our newsletter at any time, i.e. revoke your consents. This simultaneously extinguishes your consents to its dispatch by the dispatch service provider and the statistical analyses. A separate revocation of the dispatch by the dispatch service provider or the statistical evaluation is unfortunately not possible. You will find a link to cancel the newsletter at the end of each newsletter.
14. Integration of third-party services and content
It may happen that, within our online offering, content or services of third-party providers, such as maps or fonts from other websites, are integrated. The integration of content of the third-party providers always presupposes that the third-party providers perceive the users’ IP address, since without the IP address they could not send the content to the users’ browser. The IP address is thus required for the display of this content. Furthermore, the providers of the third-party content can set their own cookies and process the users’ data for their own purposes. In doing so, usage profiles of the users can be created from the processed data. We will use this content as data-economically and data-avoidingly as possible, and choose reliable third-party providers with regard to data security.
The following presentation provides an overview of third-party providers and their content, together with links to their privacy policies, which contain further information on the processing of data and, in some cases already mentioned here, objection options (so-called opt-out):
– External fonts from Google, Inc., https://www.google.com/fonts (“Google Fonts”). The integration of the Google Fonts takes place through a server call at Google (generally in the USA). Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://www.google.com/settings/ads/.
– Maps of the service “Google Maps” of the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://www.google.com/settings/ads/.
– Videos of the platform “YouTube” of the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://www.google.com/settings/ads/.
15. Rights of users and deletion of data
Users have the right, upon request and free of charge, to obtain information about the personal data that has been stored by us about them.
In addition, users have the right to the correction of incorrect data, revocation of consents, blocking and deletion of their personal data, as well as the right, in the event of the assumption of unlawful data processing, to lodge a complaint with the competent supervisory authority.
The data stored by us is deleted as soon as it is no longer required for its intended purpose and no legal retention obligations prevent deletion.
16. Changes to the privacy policy
We reserve the right to change the privacy policy in order to adapt it to changed legal situations, or in the event of changes to the service and data processing. This applies, however, only with regard to declarations on data processing. Insofar as users’ consents are required or components of the privacy policy contain provisions of the contractual relationship with the users, the changes are made only with the users’ consent.
Users are asked to inform themselves regularly about the content of the privacy policy.
Status: [15 February 2017]