Privacy Policy

Responsible under data protection laws, particularly the EU General Data Protection Regulation (GDPR), is:

Spiritory GmbH Oberländerstr. 33 81371 Munich

Phone Number: +49 (0) 89 69313426 Email: info [at] spiritory.com

I. Your rights as the data subject

Responsible under data protection laws, particularly the EU General Data Protection Regulation (GDPR), is:

Information about your stored data and its processing (Art. 15 GDPR)
Correction of incorrect personal data (Art. 16 GDPR)
Deletion of your stored data (Art. 17 GDPR)
Restriction of data processing if we cannot delete your data due to legal obligations (Art. 18 GDPR)
Objection to the processing of your data by us (Art. 21 GDPR) and data portability, if you have given your consent for data processing or have entered into a contract with us (Art. 20 GDPR)

If you have given us consent, you can revoke it at any time without affecting the legality of processing based on consent before its revocation.

Automated decision-making, including profiling, is not carried out.

You can lodge a complaint at any time with a supervisory authority, for example, with the competent supervisory authority in the federal state of your residence or with the authority responsible for us.

You can find a list of supervisory authorities (for the non-public sector) with addresses at:https://www.bfdi.bund.de/EN/Infothek/Anschriften_Links/anschriften_links-node.html

Information about your right to object under Art. 21 GDPR - Right to object in individual cases

You have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data carried out under Article 6(1)(f) GDPR (processing for legitimate interests); this also applies to profiling based on these provisions.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

The objection should be addressed to us (contact details above).

II. Collection of general information when visiting our website Type and purpose of processing:

When you access our website, i.e., if you do not register or provide information in any other way, general non-personal information is automatically collected. This information (server log files) includes the type of web browser, the operating system used, the domain name of your Internet service provider, your IP address, and similar data.

These are processed for the following purposes:

Ensuring a smooth connection to the website,
Ensuring the smooth use of our website,
Evaluation of system security and stability, as well as
Optimizing our website.

We do not use your data to draw conclusions about you personally. We may analyze this information statistically and anonymously to optimize our online presence and the underlying technology.

Legal basis and legitimate interest:

Processing is carried out in accordance with Art. 6(1)(f) GDPR due to our legitimate interest in improving the stability and functionality of our website.

Data processors:

For certain services necessary for the operation, maintenance, development, execution, and administration of our systems, we partially transmit your data to service providers as part of order data processing. A precise list of data processors and their purposes can be found in VI. Where necessary, we have concluded order data processing agreements with the service providers.

Transfer to third countries:

As part of data processing, we partially transmit your data to service providers abroad. To ensure the legality of data transfer, we have concluded order data processing agreements and, where necessary, EU standard contractual clauses in accordance with Art. 46(2)(c) GDPR with data processors.

Retention period:

The data is deleted as soon as it is no longer required for the purpose of its collection. This is generally the case for data used to provide the website when the respective session ends. In the case of data stored in log files, this is done no later than 30 days afterward. Extended storage is permitted. In this case, user IP addresses are anonymized, making it impossible to trace the client.

Necessity or requirement to provide:

The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website cannot be guaranteed. Moreover, certain services and features may not be available or may be limited. For this reason, objection is excluded.

III. Registration on our website

Type and purpose of processing: To register on our website, we require some personal data that is sent via an input form. The following data is collected and may be used to fulfill the contract: email address, full name, and date of birth.

At the time of registration, the following data is also collected: timestamp.

Your registration is necessary to create a user account. This user account allows additional functions related to buying and/or selling liquors and wines, access to price and historical market data, or managing your own portfolio.

Additionally, when using Spiritory to buy products, the following data is collected: address, possibly phone number or mobile number, and a payment method such as a credit card. When using Spiritory to sell products, an IBAN must be provided for payments.

Legal basis:

The processing of data entered during registration is based on the user's consent (Art. 6(1)(a) GDPR).

Data processors:

Transfer to third countries:

Retention period:

We process the data collected in accordance with Art. 6(1)(b) GDPR for the purpose of fulfilling the contract.

Data necessary to fulfill the contract is stored with us as a user account and can be deleted at any time upon request. Data is not deleted if there are still outstanding claims after termination of the contract. In the case of legal retention periods, the affected data is archived for the duration of these periods.

Necessity or requirement to provide:

The provision of your personal data is voluntary and is based solely on your consent. Without providing your personal data, we cannot grant you access to our offered content.

IV. Provision of payment services

Nature and purpose of processing:

To provide payment services, the data stored in 'III. Registration on our website' is used. Additional data may be requested if it is not already in the user account to fulfill your order. The following data is additionally collected for order processing and contract fulfillment:

Name, last name, possibly company name, address.

Legal basis:

The processing of data necessary to conclude the contract is based on Art. 6(1)(b) GDPR.

Data processors:

Transfer to third countries:

Retention period:

We store this data in our systems until the contract is fulfilled or the voucher credit expires and legal retention periods expire. These periods are generally 6 or 10 years for accounting and tax purposes. In the event of legal disputes, we only delete data necessary for successful legal action after the legal conclusion of the process and the complete resolution of disputed claims; this may be done after the expiration of legal retention periods on a case-by-case basis.

Necessity or requirement to provide:

Providing your personal data is voluntary. However, we cannot grant you access to our content and services offered without providing your personal data.

V. Contact form

Nature and purpose of processing:

The data you enter is stored for the purpose of personalized communication with you. To do this, providing a valid email address and your name is required. This is for the assignment of the request and the subsequent response to it. Providing other data is optional.

Legal basis:

The processing of data entered in the contact form is based on legitimate interests (Art. 6(1)(f) GDPR).

By providing the contact form, we aim to enable uncomplicated contact. The information you provide is stored for the purpose of processing the request and possible follow-up questions.

If you contact us to request an offer, the processing of data entered in the contact form is carried out to perform pre-contractual measures (Art. 6(1)(b) GDPR).

Data processors:

Transfer to third countries:

Retention period:

Data will be deleted no later than 6 months after the request has been processed. If a contractual relationship is established, we will only delete your data after the contract has been fully fulfilled and legal retention periods have expired.

Necessity or requirement to provide:

Providing your personal data is voluntary. However, we can only process your request if you provide your name, email address, and the reason for the request.

SSL encryption:

To ensure the security of your data during transmission, we use suitable encryption methods according to the state of the art (e.g., SSL) via HTTPS.

VI. Use of cookies

VII. Data processors

Recipients of the data are technical service providers who act as data processors for the operation, maintenance, development, execution, and administration of our website and voucher system.

Payment processing is not only conducted through banks but also through the payment service providers mentioned below. The collection and processing of payment data are carried out directly by the payment service provider. We do not store payment information during the purchase process. For the use of data by payment service providers, please refer to their terms and conditions and privacy policies.

Hosting and Operation

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, www.google.de
Typesense, Inc., 14090 Southwest Freeway, Suite 300, Sugar Land, TX, 77478 ("Typesense"), www.typesense.org

Payment Providers

Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA, www.stripe.com

Software Development

Spiritory GmbH, Oberländerstr. 33, 81371 Munich

VIII. Changes to Our Privacy Policy

We reserve the right to modify this Privacy Policy, including the Cookie Policy, to ensure that it is always in compliance with current legal requirements or to implement changes in our services within the Privacy Policy, such as the introduction of new services. The new Privacy Policy will apply on your next visit.

IX. Questions

If you have any questions regarding privacy, please contact us using the provided contact information above.