Skip to content
lwn.de → Privacy Policy

Privacy Policy

Privacy Policy

Status: 5 August 2026

Introduction

With the following privacy policy, we inform you about which personal data (hereinafter “data”) we process, for what purposes and to what extent. This policy applies to all processing carried out by us – in particular on our websites, in mobile applications and within external online presences (collectively referred to as the “online offering”).

Table of contents

Controller

Lebendigeweine.de
Taits U.G. (limited liability)
Konrad-Wolf-Straße 72
13055 Berlin, Germany

Managing Director: Dimitri Taits
Email: [email protected]

Overview of processing activities

Below is an overview of the types of data, purposes and data subjects involved.

Types of data processed

  • Master & contract data (e.g. names, addresses, order ID, contract terms)
  • Contact data (email, telephone)
  • Payment data (e.g. IBAN, Stripe token, PayPal transaction ID)
  • Usage & meta/communication data (IP address, device information, log files)
  • Content data (e.g. contact/review forms)
  • Location data (if released by the end device)

Categories of data subjects

  • Customers & prospective customers
  • Contractual partners & suppliers
  • Communication partners
  • Users of our online offering

Purposes of processing

  • Contract performance, shipping & payment processing
  • Newsletter & direct marketing (with opt-in)
  • Web analytics & reach measurement
  • Security measures & fraud prevention
  • Online marketing / remarketing
  • Office & organisational procedures

Relevant legal bases

  • Consent (Art. 6(1)(a) GDPR)
  • Contract performance / pre-contractual measures (Art. 6(1)(b) GDPR)
  • Legal obligation (Art. 6(1)(c) GDPR)
  • Legitimate interest (Art. 6(1)(f) GDPR)

For transfers to third countries, we rely on the EU Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework (DPF), provided the respective provider is certified accordingly.

Security measures

We implement technical and organisational measures in accordance with Art. 32 GDPR (including SSL/TLS encryption, access control, data processing agreements, data backups).

Disclosure of personal data

Data is only disclosed where this is necessary for contract performance, due to a legal obligation or on the basis of our legitimate interest. The categories of recipients include in particular:

  • Hosting & CDN: Timme Hosting (DE), Hetzner Online GmbH (DE – search server & own services), Cloudflare (USA, SCCs/DPF – CDN, web infrastructure & email dispatch)
  • Payment service providers: Stripe Payments (EU), PayPal (EU)
  • Newsletter: Listmonk (self-hosted on a server operated by Hetzner Online GmbH, DE), dispatch via SendGrid (Twilio USA, DPF); registration confirmations via Cloudflare (USA, SCCs/DPF)
  • Shipping logistics: Sendcloud (NL), DHL, UPS; wine shipments are partly dispatched directly from our logistics partner’s warehouse – for this purpose, they receive your name and delivery address
  • Accounting: Lexware Office (Haufe-Lexware GmbH & Co. KG, DE) – invoice and payment data
  • Legal & tax advice: Thoelke Przybilla Schaffner PartG mbB (DE)

Data processing in third countries

Where processing takes place in countries outside the EEA, we ensure an adequate level of data protection through SCCs, DPF certification or equivalent safeguards.

Use of cookies

We use cookies and comparable technologies. Further details are governed by our cookie banner (Usercentrics Cookiebot) and the consent history accessible there.

Commercial & business services

We process data of customers and prospective customers for contract processing, shipping and customer service. Retention period for tax-relevant data: 10 years.

Payment service providers

Newsletter

For our newsletter (Weinbrief), we use the Listmonk software, which we operate ourselves on a server belonging to Hetzner Online GmbH in Germany. Dispatch takes place via SendGrid (Twilio Inc., USA, DPF). Registration follows a double opt-in procedure: you will receive an email (sent via Cloudflare) with which you confirm your registration. We store the time and IP address of both registration and confirmation as proof. We analyse opens and clicks in order to improve the newsletter. You can unsubscribe at any time using the link provided in every newsletter. Unsubscribed addresses are stored on a blocklist so that they are not contacted again.

Online marketing & web analytics

  • Google Analytics 4 (IP anonymisation) – Google Ireland Ltd.; opt-out via browser plug-in
  • Meta Pixel (Facebook & Instagram Ads) – Meta Platforms Ireland Ltd.; opt-out via ad settings

Product search & search statistics

We operate the product search ourselves on our own servers (Typesense search server, Hetzner Online GmbH, Germany). When you use the search function, we process the search text entered, the filters selected, the number of results, the language setting, the time and a randomly generated session identifier, which is stored only in the current browser tab and expires when it is closed. IP addresses or account data are not stored in the search log. Purposes: providing the search function, measuring and improving search quality (e.g. search queries without results) and protecting against misuse. Search events are automatically deleted after 90 days.

If a session involving the use of the search function leads to an order, we store the session identifier together with the order in order to measure the search function’s contribution to the purchase. This means that the search history of this session can be assigned to the order for the duration of the 90-day storage period. The legal basis is our legitimate interest in measuring and improving our own offering (Art. 6 para. 1 lit. f GDPR); you may object to this assignment at any time (Art. 21 GDPR).

In the case of search queries that are difficult to interpret, the search text – without names, account or order data – may be transmitted in anonymised form to Anthropic PBC (USA) for linguistic analysis; the basis for this is the EU-US Data Privacy Framework.

Social media presence

We maintain profiles on Facebook, Instagram, LinkedIn & X. When you access them, the privacy notices of the respective platform apply.

Plug-ins & embedded content

  • YouTube videos (enhanced privacy mode)
  • Google Maps (only with consent)
  • ReCaptcha v3 (spam protection)
  • Google Fonts (hosted locally)

Refer friends

What we process. If you take part in our “Refer friends” referral campaign, we store your email address, first name, language, personal referral code and the delivery and billing address of your order in abbreviated form (postcode and street). If someone redeems your code, we also store the order number, the email address and the abbreviated address of that person, the order date, the value of the goods and the status of the referral.

Why. We assign redemptions to the correct referral code, check whether it is a first order and whether the referral complies with the terms and conditions of participation, issue the vouchers and prevent misuse. The legal basis is the execution of the campaign pursuant to Art. 6 para. 1 lit. b GDPR as well as our legitimate interest in preventing misuse pursuant to Art. 6 para. 1 lit. f GDPR. We send the reference to the campaign in our emails to existing customers on the basis of § 7 para. 3 UWG (German Act Against Unfair Competition); you may object to this at any time (see below).

No disclosure to the other party. We will not disclose your name, address or order to the person who referred you. Conversely, we will not tell you who redeemed your code. We do not ask for contact details of acquaintances; you share your code yourself.

Storage period. We delete the data relating to the campaign three years after the end of the year in which the last redemption took place, unless statutory retention obligations preclude this.

Service providers. We manage the vouchers in our shop system and send the emails via Cloudflare. Data processing agreements are in place with both service providers.

Right to object. You may object to the use of your email address for referral notifications at any time without incurring any costs other than transmission costs according to the basic rates. A short message stating “No referral emails” to [email protected] is sufficient. Your further rights (access, rectification, erasure, restriction, data portability, complaint to a supervisory authority) apply as described in the remainder of this policy.

Deletion of data

Data is deleted as soon as the purpose no longer applies and there is no obligation to retain it. Instead of deletion, data may be blocked where applicable.

Changes to this declaration

We update this privacy policy whenever changes to data processing make this necessary. Please check it regularly.

Rights of data subjects

  • Withdrawal of consent given (Art. 7 GDPR)
  • Access, rectification, erasure, restriction (Art. 15–18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to direct marketing & legitimate interests (Art. 21 GDPR)
  • Lodging a complaint with a supervisory authority (Art. 77 GDPR)

Definitions

Terms such as “profiling”, “consent”, “SCC”, etc. correspond to the definitions in the GDPR (Art. 4) or the EDPB guidelines.

Created and updated with Datenschutz-Generator.de – adapted to our setup (WooCommerce 9.8.5, Listmonk, SendGrid, Stripe, PayPal, Timme Hosting)

en_GBEN
de_DEDE fr_FRFR it_ITIT en_GBEN