Privacy Policy - WineSign.io

Version: January 2024

1. Scope

This privacy policy applies to the collection, processing, and use of your personal data by [Name of the company/website].

2. Collection and Processing of Personal Data

Personal data refers to information that relates to an identified or identifiable natural person. We only collect personal data that is necessary for the provision of our services. This includes, but is not limited to, name, address, email address, and telephone number.

2.1 Description and Scope of Data Processing

In order for you to view our website on winesign.io, our system must automatically collect data and information from the computer system of the calling computer or from the browser of the end device in use (in log files) each time our website is accessed. This data is stored until it is automatically deleted. The following data is collected:

• Information about the browser type and version used

• Screen resolution

• Every page view

• User's operating system

• Information about the category of the end device (mobile phone, desktop PC, tablet) as well as end device information

• IP address assigned by the user's Internet provider

• Date and time of access

• Websites from which the user's system reaches our website

The data is deleted after a statistical evaluation, which can no longer be traced back to the website visitor, but at the latest after one year.

2.2 Use of Cookies and other Tracking Tools and other Service Providers

2.2.1 Description and Scope of Data Processing

Our website uses cookies, pixels, and similar technologies. Cookies are small text files that are stored on your end device by the Internet browser when you visit a website. Cookies contain a characteristic string that allows the browser to be identified when the website is accessed again. Pixels are miniature graphics that can be embedded in emails or on the accessing device, enabling a statistical evaluation of advertising campaigns. When accessing our website, the user is informed about the use of cookies and his voluntary, informed consent to the processing of the personal data used is obtained. At the same time, the user is immediately informed about the essential purposes of the cookies used and processing activities and is referred to this privacy policy to be fully informed.

These cookies can be divided into three categories: essential cookies, marketing cookies, and functional cookies.

By essential cookies, we mean cookies that make your preferences for the use of cookies manageable and those that are necessary for the operation of the webshop. The latter are also called session cookies, which serve to assign displayed content, items in the shopping cart, and the like to your end device, enabling a purchase to be made. We use marketing cookies to display personalized advertisements on third-party websites that should be relevant to you and your interests. Based on these cookies, no direct personal data is stored, but features of your browser and end device are captured and your interests assigned. If the cookie comes from a social platform and you are logged in there, your account on this platform can be linked to this information from said third parties with the cookie. In addition, marketing cookies enable us to measure and evaluate the effectiveness of search engine advertising campaigns.

Functional cookies enable us to count the visits to our websites so that we can identify more popular content and increase the attractiveness of the entire website and improve your user experience. In addition, media content from video platforms, such as YouTube, embedded in the websites, will only be playable if you choose to do so. If you have an account on one of the platforms used, the provider may link your account identification with the stated information and assign it to you.

Both marketing cookies and functional cookies mainly come from US providers, whose level of data protection has been successfully assessed according to the E.U.-US Data Privacy Framework. Personal data may be transferred to these companies according to Art 45 GDPR.

2.2.2 Duration of Storage and Revocation of Consent

Cookies are stored on the user's end device and transmitted to our website by it. You can revoke your already given consent or approval at any time with effect for the future in the privacy settings at the bottom of each page. You also have the option to prevent the storage of cookies on your computer by making the appropriate settings in your browser, or to set the settings in social media so that no cookies are set during your visit. Details can be found in the respective processing operations.

2.2.3 On the Individual Online Processing Activities

2.2.3.1 Google Analytics

Our website uses "Google Analytics," a web analytics service provided by Google Ireland Limited, located at Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website, such as browser type/version, operating system used, referrer URL (the previously visited page), IP address, time of the server request, is usually transferred to a Google server in the USA and stored there. The information is used to perform analyses of Internet and website usage, such as anonymized evaluations and graphics on PageViews and Visits. The data is processed exclusively for market research, to optimize the website, and to provide further services associated with Internet use. This information may also be transferred to third parties if this is required by law, or if third parties process the data on behalf of Google. In no case will your IP address be merged with other Google data. The IP addresses are anonymized after transmission, so that assignment is not possible (IP masking).

For more information on privacy in connection with Google Analytics, see the Google Analytics Help: https://support.google.com/analytics/answer/6004245. Google uses suppliers in the USA, whose level of data protection has been successfully assessed according to the E.U.-US Data Privacy Framework. Personal data may be transferred to these companies according to Art 45 GDPR. The data processing is based on your consent (Art 6 Para 1 lit a GDPR).

2.2.3.2 Google Tag Manager

We use the "Google Tag Manager" from Google on our website. This service allows website tags to be managed via an interface. Tags are small code elements on a website that serve, among other things, to measure traffic and visitor behavior, to record the impact of online advertising and social channels, to use remarketing and targeting on target groups, and to test and optimize the website. The Google Tag Manager only implements tags. The Google Tag Manager follows a series of triggering rules that specify when these tags should be used on a website. When a user visits the website, the tags are triggered according to the configuration and the corresponding cookies are loaded into their browser. It contains instructions on which tags should be triggered. By using the Google Tag Manager, your use of our website becomes more efficient and faster, as the management of the correct tags accelerates our website.

Google uses suppliers in the USA, whose level of data protection has been successfully assessed according to the E.U.-US Data Privacy Framework. Personal data may be transferred to these companies according to Art 45 GDPR. The data processing is based on your consent (Art 6 Para 1 lit a GDPR).

2.2.3.3 Google Ads Conversion Tracking

We use the online advertising program Google Ads from Google and, within this framework, the conversion tracking offered by Google. A cookie for conversion tracking is stored on your computer when you click on an ad placed by us in the Google search or advertising network. These cookies expire after 30 days and are not used for personal identification. If you visit certain pages of our website while the cookie is valid, both we and Google can recognize that you clicked on an ad and were redirected to this page. Each Google Ads customer receives a different cookie. The information obtained using the conversion cookie is used to create conversion statistics for us as an Ads customer. We learn the total number of users who clicked on our ad and were redirected to a page tagged with a conversion tracking tag. However, we do not receive any information that allows users to be personally identified. If you do not want to participate in the tracking process, you can also refuse the required setting of a cookie – for example, by a browser setting that generally deactivates the automatic setting of cookies. You can also deactivate cookies for conversion tracking by setting your browser to block cookies from the domain "www.googleadservices.com". Google's privacy policy on conversion tracking can be found here https://policies.google.com/privacy. Google uses suppliers in the USA, whose level of data protection has been successfully assessed according to the E.U.-US Data Privacy Framework. Personal data may be transferred to these companies according to Art 45 GDPR. The data processing is based on your consent (Art 6 Para 1 lit a GDPR).

2.2.3.4 "Enhanced Conversion Tracking" Google Ads

In addition to our Google Ads Conversion Tracking, we use the so-called Enhanced Conversion Tracking from Google. With Enhanced Conversions, we extend the Google Ads tracking with data collected by users themselves. This includes, among other things, data such as the email address, name, or telephone number. These data are converted into mathematically unique values ("hash values") based on your consent and sent to Google. Thus, Google does not see your actual email address, but only the encrypted version of it. This technology allows a subsequent assignment of calls to our advertising offer to actual order processes. If the same hash value is detected on different devices, these calls are associated with our advertising campaign. The purpose of this processing is to measure whether our advertising campaign was interesting to customers. The provider of Google Ads Conversion Tracking uses suppliers in the USA. Google uses suppliers in the USA, whose level of data protection has been successfully assessed according to the E.U.-US Data Privacy Framework. Personal data may be transferred to these companies according to Art 45 GDPR. The data processing is based on your consent (Art 6 Para 1 lit a GDPR).

2.2.3.5 Google Remarketing (Adwords)

We also use the remarketing technology of "Google". This technology allows users who have already visited our website and were interested in it to be addressed again through targeted advertising on the pages of the Google Partner Network. The display of the advertisement is done by the use of cookies. With the help of text files, user behavior can be analyzed when visiting the website and then used for advertising according to your interests. If you perform search queries, visit other websites, or use other mobile apps, it is possible for us to offer you targeted, interest- and need-based advertising through the use of Google Remarketing. As a user, you benefit from personalized advertising on other websites. Only in this way can we continuously optimize our offer to you. Further information on Google Remarketing and Google's privacy policy can be viewed at: https://www.google.com/privacy/ads/.

2.2.3.6 Facebook

WineSign.io has integrated online components of the provider Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook") on its website. The data processing is based on your consent and follows Art 49 Para 1 lit a GDPR. By consenting to the use of cookies from this provider, you also consent to the processing of your data in the USA (Art 49 Para 1 lit a GDPR). Facebook is a social network that provides WineSign.io with so-called "Page-Insights" in a joint processing according to GDPR Art 26. "Page-Insights" are page statistics on "Likes," post reach, and other topics that WineSign.io primarily uses on an anonymized basis. More information can be found at the following link: https://www.facebook.com/business/a/page/page-insights.

Details on the joint processing between WineSign.io and Facebook can be found at: https://www.facebook.com/legal/terms/page_controller_addendum. This agreement stipulates that Facebook bears the primary responsibility for processing. Since Facebook is a global social network, we have no influence on the technical and organizational aspects. Each time one of the individual pages of this website, operated by the controller and on which a Facebook component (Facebook plug-in) has been integrated, is accessed, the Internet browser on the information technology system of the data subject is automatically prompted by the respective Facebook component to download a display of the corresponding Facebook component from Facebook. An overview of all Facebook plug-ins can be retrieved at https://developers.facebook.com/docs/plugins/. In the course of this technical process, Facebook becomes aware of each visit to our website by the data subject, provided that the data subject is simultaneously logged in to Facebook, and during the entire duration of the respective stay on our website, which specific subpage of our website the data subject accesses. This information is collected by the Facebook component and assigned by Facebook to the respective Facebook account of the data subject. If the data subject clicks one of the Facebook buttons integrated on our website, for example, the "Like" button, or if the data subject makes a comment, Facebook assigns this information to the personal Facebook user account of the data subject and stores this personal data. If such a transmission of this information to Facebook is not desired by the data subject, he or she can prevent the transmission by logging out of his or her Facebook account before a call-up to our website. The data policy published by Facebook, which is available at https://dede.facebook.com/about/privacy/, provides information on the collection, processing, and use of personal data by Facebook. It also explains what setting options Facebook offers to protect the privacy of the data subject. In addition, various applications are available that make it possible to suppress data transmission to Facebook. Such applications can be used by the data subject to suppress data transmission to Facebook. Legal basis: Consent for processing (Art 6 Para 1 lit a GDPR) is obtained within the framework of joint responsibility by Facebook. The social plugins "Like" and "Comment" are only activated if users

1) are logged in to their Facebook account and

2) have given their consent to cookies for apps and websites. If both of these conditions are met, users can see and use plugins like the "Like" or "Comment" buttons. If one of these conditions is not met, users cannot see these plugins.

2.2.3.7 Facebook Conversion Pixels

By using the service Facebook Conversion Pixels from Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"), statistical data is collected, which can measure the success of a Facebook ad. In addition, data about your usage behavior is collected on the website to create usage-based online advertising for you. As a user, you benefit from personalized advertising on other websites. Only in this way can we continuously optimize our offer to you. Here you can access the privacy conditions of Facebook Inc: https://www.facebook.com/about/privacy If you are logged in to Facebook, you can object to the use of the Conversion Pixel at the following link: https://www.facebook.com/settings?tab=ads The level of data protection of Facebook has been successfully assessed according to the E.U.-US Data Privacy Framework. Personal data may be transferred to this company according to Art 45 GDPR. The data processing is based on your consent (Art 6 Para 1 lit a GDPR).

2.2.3.8 Stripe Payments

Stripe is a US technology company that offers online payment services. On our website, we use Stripe as a payment method, where Stripe Payments Europe is responsible in the EU. Choosing Stripe as a payment option means that your payment data is transmitted to Stripe for processing and stored there. In this privacy policy, we inform you about the processing and storage of your data by Stripe and explain why we use Stripe on our website. Stripe offers online payment solutions that enable the acceptance of credit and debit card payments in our webshop. Stripe takes over the entire payment process, including fast processing, without you having to leave our website. We use Stripe on our website to offer you an optimal service experience. Stripe guarantees secure and efficient payment processing, which is an important aspect for us alongside other payment providers. When selecting Stripe as a payment method, personal data is transmitted to Stripe and stored there. This includes transaction data such as payment method, bank code, currency, amount, and date. In addition, your name, email address, billing or shipping address, and sometimes your transaction history may be transferred. This information is necessary for authentication. Stripe may also collect additional data for fraud prevention and for its services, such as technical data of your device. Stripe does not sell your data to third parties and only discloses it under certain circumstances, e.g., to internal departments, selected external partners, or to comply with legal regulations. Stripe uses cookies to collect data during the payment process. Personal data is stored by Stripe as long as it is necessary for the provision of the service. Stripe may also store data longer to comply with legal requirements. As a global company, Stripe may store data in various countries, including the USA. You can view, correct, or have your data deleted by Stripe. When using Stripe, your data may also be processed outside the EU. Please note that most countries outside the EU are considered unsafe from a data protection perspective. Deleting or managing cookies used by Stripe is browser-dependent and may affect the payment process.

The level of data protection of Stripe has been successfully assessed according to the E.U.-US Data Privacy Framework. Personal data may be transferred to this company according to Art 45 GDPR. The data processing is based on your consent (Art 6 Para 1 lit a GDPR).

3. Purpose of Data Processing

The collected data is used for the purpose of contract processing, customer support, marketing measures, and to improve our services and content.

4. Legal Basis for Processing

The processing of your personal data is based on your consent, for the fulfillment of a contract or pre-contractual measures, to fulfill legal obligations, or if it is in the legitimate interest of WineSign.IO.

5. Data Transfer to Third Parties

A transfer of your data to third parties only takes place if this is necessary for the fulfillment of the contract, based on your explicit consent, or if there is a legal obligation to do so.

6. Data Security

We take technical and organizational measures to ensure that your data is secure and treated in accordance with legal regulations.

7. Your Rights

Under the GDPR, you have the following legal data subject rights, provided their requirements are met:

• Right of access to your data stored by us according to Art. 15 GDPR

• Right to rectification of incorrect data according to Art. 16 GDPR

• Right to erasure of data stored by us according to Art. 17 GDPR

• Right to restriction of processing of data stored by us according to Art. 18 GDPR

• Right to withdraw at any time according to Art 7 Para 3 GDPR a consent possibly given to us; this has the consequence that we may no longer continue the data processing, which was based on this consent, for the future.

• Right to data portability according to Art. 20 GDPR

• Right to lodge a complaint with a supervisory authority according to Art 77 GDPR, if you believe that the processing of your personal data violates regulations of the GDPR.

8. Right to Object

If your personal data is processed on the basis of legitimate interests according to Art 6 Para 1 lit f GDPR, you have the right, according to Art 21 GDPR, to object to the processing of your personal data, provided there are reasons for this arising from your particular situation. If you wish to exercise your right to object, an email to dsgvo@winesign.io is sufficient.

9. Contact

For questions regarding data protection, please contact dsgvo@winesign.io.

10. Currency and Amendment of this Privacy Policy

This privacy policy is currently valid and has the status of December 2023. Due to the further development of our website and offers about it or due to changed legal or regulatory requirements, it may be necessary to change this privacy policy. The current privacy policy can be accessed and printed at any time on the website at https://www.winesign.io/gdpr.html. You can also request changes by email at dsgvo@winesign.io or by mail to WineSign.io, Wiener Straße 27, A-3500 Krems.