Privacy policy

1. Controller

The controller for data processing on this website is:

VINOSAS Fine Rarities
Daniel Sutil
Südliche Münchner Str. 60c
82031 Grünwald
Germany

Email: weinankauf@vinosas.com
Phone: +49 8170 317 99 52

2. Data protection officer

⚠ TO BE CHECKED: Under § 38 BDSG a data protection officer must be appointed where at least 20 people are constantly engaged in automated processing of personal data, or where a data protection impact assessment is required. If that does not apply to you, replace this paragraph with: “We are not obliged to appoint a data protection officer.” Otherwise, enter the contact details here.

3. Visiting the website (server log files)

Each time a page is called up, your browser transmits technically necessary data to our server. Our hosting provider records these in log files.

Data processed: IP address, date and time of access, page requested, volume of data transferred, HTTP status code, referrer URL, browser type and operating system.

Purpose: delivering the website, ensuring system security and stability, detecting and repelling attacks.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically sound and secure operation of the website.

Retention: ⚠ TO BE CHECKED: retention of log files is determined by your host. Seven to fourteen days is typical. Please obtain the actual figure and enter it here.

This data is not merged with other sources and is not evaluated for marketing purposes.

4. Hosting

The website is hosted by an external service provider, who processes the data listed under section 3 on our behalf.

⚠ TO BE CHECKED: please enter the name and full address of your host here, and confirm that a data processing agreement under Art. 28 GDPR is in place. If the host processes data outside the EU, that must also be stated here, together with the basis for the third-country transfer (e.g. EU standard contractual clauses or the EU-US Data Privacy Framework).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating the website) in conjunction with a data processing agreement under Art. 28 GDPR.

5. Contact form and purchase enquiry

When you submit the contact form, we process the details you provide.

Mandatory: name, email address, your message.

Optional: phone number, uploaded files (Excel lists, PDFs, photographs of your bottles), and – if you used the purchase list on the site – the wine data recorded there (producer, wine, vintage, bottle size, quantity, fill level, original wooden case, note).

Also processed technically: your IP address, the date and time of submission, and the language version selected. These record receipt of the enquiry and serve to prevent misuse.

Purpose: handling your enquiry, valuing your wines, preparing a purchase offer and the associated correspondence.

Legal basis: Art. 6 (1) (b) GDPR. Processing is necessary for pre-contractual measures taken at your request. Where your enquiry is not aimed at concluding a contract, we base the processing on Art. 6 (1) (f) GDPR – our legitimate interest in answering enquiries.

The checkbox in the form is an acknowledgement of this privacy policy, not a consent. We process your data on the statutory basis set out above, not on the basis of consent.

Retention: if no business results, we delete your enquiry and its attachments no later than six months after the correspondence ends. If a contract of sale is concluded, the contract and invoice records are subject to commercial and tax retention periods (§ 257 HGB, § 147 AO) and are kept for up to ten years accordingly.

Recipients: the contents of the form are delivered to our email address weinankauf@vinosas.com. A copy is additionally stored on our server in a directory that is not publicly accessible, so that no enquiry is lost if email delivery fails. Those copies are subject to the same retention periods.

6. Email

⚠ TO BE CHECKED: if you receive your email through an external provider (e.g. Google Workspace, Microsoft 365 or your host's mail service), that provider must be named here, with name, address and, where data is transferred to the USA, the basis for the third-country transfer. Please complete. If the mail server is the same as the web host, a reference to section 4 is sufficient.

7. Spam and abuse protection

To repel automated bulk submissions, we limit the number of form submissions per sender. To do so we form a hash (SHA-256) from your IP address and the current hour, and count the submissions. The IP address cannot be reconstructed from that hash. The counter is deleted after one hour at the latest.

The form also contains a field invisible to humans that only automated scripts fill in. If it is filled in, we discard the submission. No personal data is stored in that case.

We deliberately use no captcha – including no Google reCAPTCHA. That saves you both from clicking on traffic lights and from having your data sent to Google.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in preventing spam and automated attacks.

8. The purchase list

On the site you can record your wines line by line and download the list as an Excel file.

This feature runs entirely in your browser. The data is not transmitted to us while you type. Nor is it stored in your browser – neither in cookies nor in local storage. Close the page and the entries are gone.

The Excel file is likewise generated locally on your device. Downloading it involves no contact with our server whatsoever.

The purchase list data reaches us only if you submit the contact form. In that case, section 5 applies.

The same holds for the downloadable Excel template: downloading it is an ordinary file request. We learn what you enter into the template only once you send it back to us.

9. WhatsApp

Several buttons on the site offer to let you write to us on WhatsApp. These buttons are plain links, not embedded content. Unless you click them, no data is transmitted to WhatsApp or Meta.

If you click one, WhatsApp opens (in the app or in your browser) with a pre-written message addressed to our number. From that moment, WhatsApp Ireland Ltd. processes your data – in particular your phone number and the content of your message – under its own terms. We have no influence over that.

WhatsApp belongs to the Meta group. Transfer of data to the USA cannot be ruled out. Details can be found in WhatsApp's own privacy policy.

Messages that reach us via WhatsApp are processed for the same purpose and on the same legal basis as form enquiries (see section 5).

If you would rather avoid this: use the contact form, email or the telephone instead. All three lead to the same result.

10. Links to other websites

We link to our online shop vinosas.com and to our Instagram and Facebook profiles. These are text links only. No social media plugins, like buttons or tracking pixels are loaded. No connection to those providers exists unless you click the link.

The respective operator is responsible for data processing on the linked sites.

11. Typefaces

This website uses the typefaces Bodoni Moda, Archivo and IBM Plex Mono. All font files sit on our own server. No connection is made to Google Fonts or any other font service, and your IP address is not transmitted to third parties.

12. Your rights

You have the following rights regarding your personal data:

Access (Art. 15 GDPR) – you can find out what data we process about you.
Rectification (Art. 16 GDPR) – you can have inaccurate data corrected.
Erasure (Art. 17 GDPR) – you can request deletion, unless a statutory retention obligation prevents it.
Restriction of processing (Art. 18 GDPR).
Data portability (Art. 20 GDPR) – you can receive your data in a common format.
Objection (Art. 21 GDPR) – you can object to processing based on a legitimate interest.

An informal message to weinankauf@vinosas.com is enough for all of these.

Right to complain: you may lodge a complaint with a supervisory authority at any time. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also contact the authority where you live.

13. No automated decision-making

We use no automated decision-making and no profiling within the meaning of Art. 22 GDPR. Whether we buy your wines, and at what price, is decided by people.

14. Changes to this policy

We update this policy when the website or the legal position changes. The current version is always available on this page.