This data protection declaration gives you an overview of how we guarantee this protection and which categories of personal data we process for which purposes. This data protection declaration also explains which rights you may have.
A. Contact / Responsible
If you have any questions about our processing of your personal data or in connection with this data protection declaration, if you have a complaint about how we handle your data or if you want to assert your rights as a data subject, please contact us at:
Hermes Capital GmbH
Hofacker line 10
D-13627 Berlin
Phone: +49 (0) 33762 808870
Email: info@hermes-capital.de
Our The data protection officer can be reached under the following contact details:
Phone: +49 (0) 33762 814895
Email: datenschutz@hermes-capital.de
B. Affected Persons
This data protection declaration applies to the processing of personal data of users of the website https://www.vinofan.de.
C. Categories of personal data, purposes of processing and legal bases
We process your personal data for the following purposes:
Acquisition of our products, i.e. fulfillment of your order – to process, pack, ship and make payment on your order. The processing of your personal data (i.e. first name, surname, date of birth, age, address, telephone number and email address, order data, IBAN / payment method data) takes place for the purpose of executing the contract with you for the purchase of our products, i.e. the execution of your order. The legal basis is the need for processing to carry out a contract (Art. 6 Para. 1 lit.b GDPR) to which the data subject is a party or to carry out pre-contractual measures that are carried out at the request of the data subject. To process your order, we use a shipping service provider (processor) based in the EU (e.g. DHL).
Newsletter advertising – to enable you to register for our newsletter and to make this newsletter available to you. If you would like to receive the newsletter offered on the website, we need a valid e-mail address from you as well as information that allows us to verify that you are the owner of the specified e-mail address or that the owner is the owner upon receipt of the Newsletter. When you register for the newsletter, we save your email address for advertising and market research purposes until you unsubscribe from the newsletter. You can revoke your consent to the storage of the data, the email address and their use for sending the newsletter at any time. The legal basis of the newsletter advertising is your consent, Art. 6 Para. 1 lit. a GDPR. To send the newsletter, we use a service provider who sends it by email (processor). This service provider is based in the EU. However, the data is stored on a server in the USA. The service provider sets appropriate guarantees to protect the data i.S.d. Art. 46 GDPR.
Quality assurance – in order to enable you to use (i.e. access and browse) the website, it is technically necessary for us to process certain personal data transmitted by the web browser (i.e. the IP address). The legal basis is the need for processing in order to achieve our legitimate interests with regard to the high quality of our services (Art. 6 Para. 1 lit. f GDPR). Upon request, we will be happy to provide you with the information on which the weighing of interests is based.
Security purposes – to ensure IT security and to prevent and detect criminal offenses. Your personal data (i.e. the IP address) will e.g. to protect against fraudulent activities, to guarantee IT security and to prevent and detect criminal offenses and thus serve your own safety. The legal basis is the necessity of processing in order to achieve our legitimate interests with regard to the security of our website (Art. 6 Para. 1 lit.f GDPR). Upon request, we will be happy to provide you with the information on which the weighing of interests is based.
Credit Reporting – to obtain information about your creditworthiness. It is our aim to check your creditworthiness if you choose invoice as the payment method or if you are a new customer and choose the direct debit payment method. To do this, we give your personal data (i.e. name, address and date of birth) to a credit agency (Producta Daten-Service GmbH), which checks your creditworthiness for us.
The credit risk is assessed on the basis of mathematical-statistical procedures at the credit agency (scoring). Based on this information, a statistical probability for a loan default and thus your solvency is calculated. If the credit check is positive, an order on account / direct debit is possible as a new customer. If the credit check turns out negative, our online shop will not offer you payment on account. The legal basis for the use of scoring are our legitimate interests in your creditworthiness in the case of a purchase on account (Art. 6 Paragraph 1 lit. f GDPR). Upon request, we will be happy to provide you with the information on which the weighing of interests is based.
Web Analytics – to generate reports on website activity, e.g. with the help of Google Analytics. Please see the details under G.1.
Remarketing – to examine information about the surfing behavior of website visitors for marketing purposes, e.g. with the help of CRITEO. Please see the details under G.2.
We only process your personal data for purposes other than those described above, if we are legally obliged to do so (e.g. transmission of personal data to a court or law enforcement authority), if you have consented to the processing or if the processing is lawful under applicable law.
The provision of your personal data is necessary for the use of the website or the conclusion / execution of the contract and is voluntary. However, if you do not provide your personal data, you may not be able to use parts of the website. It is also possible that in this case we will not be able to conclude a contract with you or that a closed contract cannot be fully fulfilled.
D. Recipients and Categories of Recipients
Your personal data will be processed by the people in departments who need to know the personal data.
We transmit your personal data to the recipients and categories of recipients for the respective purposes as follows – you can find more information on the recipients and categories of recipients in individual cases under C.
Private third parties – other third parties.
Processors – When providing our services, we use various (technical) service providers (affiliated companies or third parties) to provide our services in compliance with applicable data protection law. The transfer of personal data to third parties takes place in this context only for the processing of the personal data by these service providers on our behalf and on the basis of our instructions (so-called “order processing”, the service provider “order processors”), insofar as this is necessary for the provision of our services is. The processors are subject to contractual obligations to implement appropriate technical and organizational measures to protect your personal data and process your data exclusively in accordance with our instructions.
Government agencies, courts, external consultants – if required or permitted by law.
E. Data storage
We do not store your data longer than we need it for the respective processing purposes, i.e. to provide the requested service. If we no longer need your personal data to comply with contractual or legal obligations, we will delete it from our systems or anonymise it accordingly so that identification is not possible, unless we have to keep information, including your personal data, in order to to comply with legal or official obligations to which we are subject, e.g. statutory retention periods, which can result from the commercial code or the tax code and can generally last 6 to 10 years, or if we have to secure evidence during the statutory limitation periods, which are usually 3 years but can be up to 30 years.
F. Cookies
This website uses cookies. A cookie is a small text file that is stored on your computer or mobile device if your web browser allows it. You can set your web browser to reject cookies or to inform you before they are saved. We use both session cookies and permanent cookies. A session cookie disappears after you close the web browser. In this respect, we have the SID cookie, which makes the website function as such. Without this necessary cookie, we cannot operate our website. The legal basis for the use of the session cookie are our legitimate interests in the functioning of the website (Art. 6 Paragraph 1 lit. f GDPR).
Upon request, we will be happy to provide you with the information on which the weighing of interests is based.
A permanent cookie remains on your device when you close the web browser and can be used again by the web browser when you visit the website in the future. The web browser provides you with certain options for the use of cookies. You can stop the placement of cookies on your device by using the opt-out options. You can also use the browser settings to control and restrict the placement of cookies. In this respect, you can also delete existing cookies. However, this can limit the functionality of the website.
We use cookies to collect and process information, including personal data, and to use it in pseudonymised form to adapt the website to your interests. We can also use third-party cookies for this, such as Google Analytics. The analytical data obtained in this way can contain data such as general demographic characteristics and usage habits that allow conclusions to be drawn about the users of the website. We use cookies in particular to save information about the content of your shopping cart, which can then be called up on your next visit. The data stored in a cookie means you don’t have to fill out the forms again.
G. Your Rights
If you have consented to the processing of your personal data, you can revoke your consent at any time with effect for the future. Such a revocation does not affect the legality of the processing carried out on the basis of the consent until the revocation.
According to the applicable data protection law, you may have the right to (i) information, (ii) correction, (iii) deletion, (iv) restriction of processing, (v) data portability and / or (vi) objection to processing. The aforementioned rights may be restricted under national data protection law. To exercise these rights, please contact us as described in Section A.
In detail:
(i) Right to information: You may have the right to request confirmation from us as to whether personal data relating to you is being processed and, if this is the case, a right to information about this personal data. The right to information includes, among other things, the processing purposes, the categories of personal data that are processed and the recipients or categories of recipients to whom the personal data are disclosed. You may also have the right to receive a copy of the personal data that is the subject of the processing. However, this right is not unlimited, as the rights of other people can limit your right to receive a copy.
The right to information is restricted by § 34 BDSG, e.g. if the data (a) are only stored because they may not be deleted due to legal or statutory retention requirements, or (b) are used exclusively for data backup or data protection purposes, and the provision of information would require a disproportionate effort and processing for other purposes is excluded by suitable technical and organizational measures.
(ii) Right to correction: You may have the right to request the correction of incorrect personal data concerning you. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of a supplementary declaration
(iii) Right to deletion (right to be forgotten): Under certain conditions, you have the right to request that we delete personal data concerning you and that we are obliged to delete personal data. The right to deletion exists e.g. according to § 35 BDSG, if deletion in the case of non-automated data processing is not possible or only possible with disproportionately high effort due to the special type of storage and the interest of the person concerned in the deletion is to be regarded as low. In this case, instead of deletion, processing is restricted. The aforementioned exception does not apply if the personal data has been processed unlawfully.
(iv) Right to restriction of processing: Under certain conditions, you have the right to request that we restrict the processing of your personal data. In this case, the relevant data will be marked and processed by us only for certain purposes.
(v) Right to data portability: Under certain conditions, you have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format and you have the right to this data to transmit to another person in charge without hindrance from us.
(vi) Right to Object
For reasons that arise from your particular situation, you have the right at any time to object to the processing of personal data relating to you, which is based on Art. e (data processing in the public interest) and f (data processing based on legitimate interests) General Data Protection Regulation takes place, to lodge an objection. If you object, we will no longer process your personal data unless we can prove compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
If personal data is processed in order to operate direct mail, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. This also applies to profiling insofar as it is related to such direct mail.