Privacy policy

1. Controller

The controller for data processing on this website is:

VINOSAS Fine Rarities
Daniel Sutil
Südliche Münchner Str. 60c
82031 Grünwald
Germany

Email: weinankauf@vinosas.com
Phone: +49 8170 317 99 52

2. Data protection officer

We are not required to appoint a data protection officer and have not appointed one. For questions regarding data protection, please contact the controller named under section 1.

3. Visiting the website (server log files)

Each time a page is called up, your browser transmits technically necessary data to our server. Our hosting provider records these in log files.

Data processed: IP address, date and time of access, page requested, volume of data transferred, HTTP status code, referrer URL, browser type and operating system.

Purpose: delivering the website, ensuring system security and stability, detecting and repelling attacks.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically sound and secure operation of the website.

Retention: the server log files are created by our hosting provider and kept there for a maximum of eight weeks, after which they are automatically deleted. IP addresses are anonymised by the hosting provider at the point of collection.

This data is not merged with other sources and is not evaluated for marketing purposes.

4. Hosting

The website is hosted by an external service provider, who processes the data listed under section 3 on our behalf.

The provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. A data processing agreement under Art. 28 GDPR is in place with IONOS, ensuring that the data collected through our website is processed in accordance with the contract and with data protection law. IONOS processes this data exclusively on servers within the European Union; no transfer to a third country takes place.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating the website) in conjunction with a data processing agreement under Art. 28 GDPR.

5. Contact form and purchase enquiry

When you submit the contact form, we process the details you provide.

Mandatory: name, email address, your message.

Optional: phone number, uploaded files (Excel lists, PDFs, photographs of your bottles), and – if you used the purchase list on the site – the wine data recorded there (producer, wine, vintage, bottle size, quantity, fill level, original wooden case, note).

Also processed technically: your IP address, the date and time of submission, and the language version selected. These record receipt of the enquiry and serve to prevent misuse.

Purpose: handling your enquiry, valuing your wines, preparing a purchase offer and the associated correspondence.

Legal basis: Art. 6 (1) (b) GDPR. Processing is necessary for pre-contractual measures taken at your request. Where your enquiry is not aimed at concluding a contract, we base the processing on Art. 6 (1) (f) GDPR – our legitimate interest in answering enquiries.

The checkbox in the form is an acknowledgement of this privacy policy, not a consent. We process your data on the statutory basis set out above, not on the basis of consent.

Retention: if no business results, we delete your enquiry and its attachments no later than six months after the correspondence ends. If a contract of sale is concluded, the contract and invoice records are subject to commercial and tax retention periods (§ 257 HGB, § 147 AO) and are kept for up to ten years accordingly.

Recipients: the contents of the form are delivered to our email address weinankauf@vinosas.com. A copy is additionally stored on our server in a directory that is not publicly accessible, so that no enquiry is lost if email delivery fails. Those copies are subject to the same retention periods.

6. Email

To receive and manage email we use the mailbox of our hosting provider IONOS SE (see section 4); messages are retrieved via SMTP/IMAP in Microsoft Outlook. When you write to us by email or through the contact or enquiry form, we process the information you provide (in particular your name, email address, telephone number, the details you give about your wines and any attachments) in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry concerns the conclusion or performance of a contract, and otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to your enquiry). The data is deleted once it is no longer required to handle your enquiry, provided no statutory retention obligations apply.

7. Spam and abuse protection

To repel automated bulk submissions, we limit the number of form submissions per sender. To do so we form a hash (SHA-256) from your IP address and the current hour, and count the submissions. The IP address cannot be reconstructed from that hash. The counter is deleted after one hour at the latest.

The form also contains a field invisible to humans that only automated scripts fill in. If it is filled in, we discard the submission. No personal data is stored in that case.

We deliberately use no captcha – including no Google reCAPTCHA. That saves you both from clicking on traffic lights and from having your data sent to Google.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in preventing spam and automated attacks.

8. The purchase list

On the site you can record your wines line by line and download the list as an Excel file.

This feature runs entirely in your browser. The data is not transmitted to us while you type. Nor is it stored in your browser – neither in cookies nor in local storage. Close the page and the entries are gone.

The Excel file is likewise generated locally on your device. Downloading it involves no contact with our server whatsoever.

The purchase list data reaches us only if you submit the contact form. In that case, section 5 applies.

The same holds for the downloadable Excel template: downloading it is an ordinary file request. We learn what you enter into the template only once you send it back to us.

9. WhatsApp

Several buttons on the site offer to let you write to us on WhatsApp. These buttons are plain links, not embedded content. Unless you click them, no data is transmitted to WhatsApp or Meta.

If you click one, WhatsApp opens (in the app or in your browser) with a pre-written message addressed to our number. From that moment, WhatsApp Ireland Ltd. processes your data – in particular your phone number and the content of your message – under its own terms. We have no influence over that.

WhatsApp belongs to the Meta group. Transfer of data to the USA cannot be ruled out. Details can be found in WhatsApp's own privacy policy.

Messages that reach us via WhatsApp are processed for the same purpose and on the same legal basis as form enquiries (see section 5).

If you would rather avoid this: use the contact form, email or the telephone instead. All three lead to the same result.

10. Links to other websites

We link to our online shop vinosas.com and to our Instagram and Facebook profiles. These are text links only. No social media plugins, like buttons or tracking pixels are loaded. No connection to those providers exists unless you click the link.

The respective operator is responsible for data processing on the linked sites.

11. Typefaces

This website uses the typefaces Bodoni Moda, Archivo and IBM Plex Mono. All font files sit on our own server. No connection is made to Google Fonts or any other font service, and your IP address is not transmitted to third parties.

12. Your rights

You have the following rights regarding your personal data:

Access (Art. 15 GDPR) – you can find out what data we process about you.
Rectification (Art. 16 GDPR) – you can have inaccurate data corrected.
Erasure (Art. 17 GDPR) – you can request deletion, unless a statutory retention obligation prevents it.
Restriction of processing (Art. 18 GDPR).
Data portability (Art. 20 GDPR) – you can receive your data in a common format.
Objection (Art. 21 GDPR) – you can object to processing based on a legitimate interest.

An informal message to weinankauf@vinosas.com is enough for all of these.

Right to complain: you may lodge a complaint with a supervisory authority at any time. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also contact the authority where you live.

13. No automated decision-making

We use no automated decision-making and no profiling within the meaning of Art. 22 GDPR. Whether we buy your wines, and at what price, is decided by people.

14. Changes to this policy

We update this policy when the website or the legal position changes. The current version is always available on this page.