Privacy policy

General information

Unless stated otherwise below, providing your personal data is neither a statutory nor a contractual requirement and is not necessary to enter into a contract. You are not obliged to provide the data. Not providing it has no consequences, except where a particular processing activity described below requires it.

Personal data means any information relating to an identified or identifiable natural person. This policy explains how we process data when you visit our website or use our services.

Controller and contact details

The controller responsible for processing your data is Jörg Matzdorff, Atelier Matzdorff, Habichtweg 7, 51429 Bergisch Gladbach, Germany. You can contact us by telephone at +49 151 14 73 83 83 or by email at joerg@antiquewinesandspirits.com.

Purposes and legal bases

We process data to deliver and protect the website, handle enquiries and contracts, and provide newsletters and statistical analysis. Depending on the purpose, we rely on Article 6(1)(a) GDPR (consent), (b) (contracts and steps prior to a contract), (c) (legal obligations) or (f) (legitimate interests). Details appear in the relevant sections and in the General Data Protection Regulation (GDPR).

Web hosting and technical support

We use Contabo GmbH, Germany to host our website. Its systems process data needed to operate the website, including technical access data and the contact, newsletter and order information you submit. Team Bitfuture provides technical support. Service providers receive access only as necessary to perform their respective tasks.

Processing for secure and reliable operation is based on Article 6(1)(f) GDPR. Article 6(1)(b) GDPR additionally applies when we handle your enquiries and contracts. Where providers process data on our behalf, Article 28 GDPR applies. See Contabo’s privacy information and Team Bitfuture’s provider information.

Cloudflare: delivery, images and documents

Our website uses services provided by Cloudflare, Inc., USA. Images and logos are delivered through Cloudflare Images (imagedelivery.net). Stylesheets, icons and font files, including the MDBootstrap and Font Awesome presentation libraries, are delivered through Team Bitfuture’s Cloudflare Pages address (tbf-commons.pages.dev). Magazine PDF links may redirect you to Cloudflare R2.

This involves IP addresses, requested resources, timestamps and technical browser information for content delivery and attack prevention. The legal basis is Article 6(1)(f) GDPR: our interest in secure and reliable operation. Processing outside the EEA is possible. Cloudflare identifies the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses as transfer mechanisms. See Cloudflare’s privacy information and its data processing terms.

Retention periods

We retain personal data only for as long as needed for the relevant purpose or required by law. We then delete or anonymise it unless you have consented to further processing or another legal basis applies. For enquiries, retention depends on handling the enquiry and any subsequent retention obligations; for contracts, it depends on performance and applicable commercial and tax retention requirements. Information about cookies and individual services appears in the relevant sections.

Access, rectification, erasure and portability

Subject to the applicable legal conditions, Articles 15–20 GDPR give you rights of access, rectification, erasure, restriction of processing and data portability. To exercise these rights, contact joerg@antiquewinesandspirits.com. We do not ourselves make solely automated decisions producing legal or similarly significant effects under Article 22 GDPR.

Withdrawing consent

You can withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing before it was withdrawn. For website services, use the cookie settings button at the top of this page; for newsletters, use the unsubscribe link or email joerg@antiquewinesandspirits.com.

Right to object

Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation, with effect for the future. We will stop the processing unless we can demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. You can object to processing for direct marketing at any time without giving a reason.

Complaints to a supervisory authority

Under Article 77 GDPR, you may complain to a supervisory authority, particularly in the country where you live or work, or where you believe an infringement occurred. Our competent authority is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information, PO Box 20 04 44, 40102 Düsseldorf, Germany, telephone +49 211 384240, email: poststelle@ldi.nrw.de.

You can also contact the supervisory authority by fax at +49 211 38424999.

Recipients and international transfers

Recipients include the hosting, IT, analytics, newsletter and payment providers named here and, where necessary, authorities and other parties involved in performing contracts. Transfers outside the European Economic Area are subject to Articles 44 et seq. GDPR. Where applicable, we rely on European Commission adequacy decisions or Standard Contractual Clauses. The EU-US Data Privacy Framework applies only to certified recipients and is distinct from the former Privacy Shield. You may ask us for information about the safeguards applicable to a particular transfer.

Transmission security

Our public website uses HTTPS to protect data in transit. Complete security for all internet communications cannot be guaranteed, particularly for unencrypted email.

Server logs

You can visit our website without actively providing information about yourself. However, each visit automatically transmits usage data from your browser to us or our hosting/IT provider. Server logs may contain the page requested, date and time, IP address, data volume, requesting provider, browser and operating system. Processing is based on Article 6(1)(f) GDPR and our overriding legitimate interest in secure and reliable operation and improving our services. Logs are retained only as needed for operation, troubleshooting or investigating security incidents.

Enquiries initiated by email

If you contact us by email, we collect personal data (name, email address and message) only to the extent you provide it, to handle and answer your enquiry. Where it concerns steps before a contract, such as advice or a quotation, or an existing contract, processing is based on Article 6(1)(b) GDPR. Otherwise, we rely on Article 6(1)(f) GDPR and our legitimate interest in responding to enquiries. You may object on grounds relating to your particular situation.

We use your email address to handle your enquiry. Data is subsequently deleted subject to statutory retention obligations unless you have agreed to further processing. Messages are processed through our email infrastructure. Sending an enquiry does not subscribe you to a newsletter.

Using the contact form

When you use the contact form, we collect the name, email address and message you provide to contact you. Article 6(1)(b) GDPR applies to contractual and pre-contractual enquiries; other enquiries are handled under Article 6(1)(f) GDPR and our legitimate interest in responding. In the latter case, you may object on grounds relating to your particular situation. Data is deleted after the enquiry is resolved, subject to statutory retention obligations and any other continuing legal basis. We use reCAPTCHA to protect forms; see “Analytics and embedded services” for details.

Cookies and essential functions

Cookies are small text files stored by your browser on your device. They may last for a session or until a specified expiry date. Our website uses essential session information, for example to process forms, and a cookie to remember your selected language. Language and session cookies are generally limited to the session. Statistical services may use additional cookies, as described separately in this policy.

Section 25(2) TDDDG applies to strictly necessary storage or access on your device. Subsequent personal data processing is based on Article 6(1)(b) or (f) GDPR, depending on the purpose. Non-essential storage or access requires consent under Section 25(1) TDDDG; associated personal data processing is then based on Article 6(1)(a) GDPR.

You can manage or delete cookies in your browser. Blocking all cookies may impair functionality; deleting them may require you to choose your settings again. Instructions are available for Chrome, Microsoft Edge, Firefox and Safari. You can change consent choices through this website’s cookie settings.

Matomo Cloud

We use Matomo Cloud, provided by InnoCraft Limited, 7 Waterloo Quay, PO Box 625, 6140 Wellington, New Zealand, through teambitfuture.matomo.cloud and cdn.matomo.cloud. Data includes page views, clicks, referring pages, timestamps, browser/device information, IP addresses and, where applicable, cookie identifiers, to analyse website use and improve our services.

Cookie-based analytics requires your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw it in the cookie settings. Matomo’s default cookies include _pk_id (13 months) and _pk_ses (30 minutes). These are cookie lifetimes, not a statement that all analytics data is retained for the same periods. InnoCraft describes storage of cloud instances and backups in Europe; New Zealand benefits from an EU adequacy decision. See Matomo Cloud privacy information, its processing terms and cookie information.

Google Analytics: legacy integration

The website also contains a legacy Google Universal Analytics integration through www.google-analytics.com. Google has discontinued Universal Analytics processing. Loading the embedded library may nevertheless connect to Google and transmit your IP address and technical request information. This does not describe active GA4 analytics. Analytics access requiring consent is subject to Section 25(1) TDDDG and Article 6(1)(a) GDPR. See Google’s Universal Analytics sunset information and its privacy information.

Google reCAPTCHA for form protection

Contact, newsletter and order enquiry forms use Google reCAPTCHA to detect automated submissions, spam and abuse. Opening protected forms establishes connections to Google and its delivery services. Processing may include IP addresses, browser/device information, page and interaction data and a verification identifier. Our server sends the verification response to Google. reCAPTCHA may use the _GRECAPTCHA cookie.

Processing necessary to prevent abuse is based on Article 6(1)(f) GDPR and our legitimate interest in protecting the website and communications. Device storage or access that is not strictly necessary requires consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. Google states that, since 2 April 2026, reCAPTCHA customer data is processed on behalf of website operators. See the reCAPTCHA data processing information and Google Cloud Data Processing Addendum. Processing in the USA and other countries is possible. You may contact us by email instead.

Google Fonts and font files

We use Poppins and Playfair Display through Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Loading external fonts transmits your IP address, the font requested and technical request information to Google. This optional third-party integration requires consent under Article 6(1)(a) GDPR; Section 25(1) TDDDG also applies where information is stored or accessed on your device. These fonts provide consistent presentation. Other fonts are delivered locally or through the Cloudflare Pages service described above.

Google identifies Google Ireland Limited for the EEA and Google LLC in the USA among its international processing entities. See Google Fonts privacy information, Google’s privacy policy and its international transfer information.

External links and social networks

Our Instagram and Facebook links are ordinary links, rather than embedded feeds or Like plug-ins. We also link to provider, magazine and information websites. You visit these services when you open a link; their providers’ privacy information then applies, such as Meta’s privacy policy for Instagram and Facebook. These links are distinct from the automatically embedded resources described above.

Enquiries, orders and contract data

We process the contact, communication and contract data you provide with enquiries and orders to prepare quotations, perform contracts and allocate payments. The legal basis is Article 6(1)(b) GDPR. Statutory documentation and retention duties are based on Article 6(1)(c) GDPR. Data is shared where necessary for performance, particularly with payment and, where applicable, delivery providers. This does not involve sharing data for third parties’ advertising.

Card payments through Truevo

For card payments, we use Truevo Payments Ltd, Malta. To create a payment session, our application sends the order reference, payment description, amount and currency, together with technical merchant and return information, to pay.truevo.com. You then enter card details on Truevo’s hosted payment page. Our application does not receive full card details through that form.

Processing necessary for payment is based on Article 6(1)(b) GDPR. The payment provider’s legal duties, such as fraud and money-laundering prevention, may be based on Article 6(1)(c) GDPR. Truevo processes payment data under its own legal obligations. See Truevo’s privacy information for recipients, transfers and retention.

PayPal and bank transfer

If you choose PayPal, you are redirected to PayPal. PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, receives the information needed for payment, such as amount, currency and order reference, and processes further payment, device and, where applicable, account data as an independent controller. Processing to make the payment is based on Article 6(1)(b) GDPR. See PayPal’s privacy statement. For bank transfers, we process the bank and payment information needed to allocate the payment; banks process data under their own statutory obligations.

Using your email address for newsletters

With your express consent, we use your email address to send newsletters containing information and offers. We process your email address and any first and last names you optionally provide. The legal basis is Article 6(1)(a) GDPR. Subscriptions are stored in our application; newsletter delivery is handled outside the application through Mailchimp.

You may withdraw consent at any time without affecting the lawfulness of earlier processing. Use the unsubscribe link or contact joerg@antiquewinesandspirits.com. Your address will then be removed from the active mailing list. To prevent further mailings, we may retain a necessary suppression record under Article 6(1)(f) GDPR. Our legitimate interest, and yours, is to continue respecting your unsubscribe request. You may object on grounds relating to your particular situation.

Delivery and statistical analysis through Mailchimp

We use Mailchimp, The Rocket Science Group LLC, USA to send newsletters and share email addresses and, where provided, first and last names with it as our processor. Tracking pixels and tagged links allow the system to measure opens and clicks, including IP addresses, browser/device information and timestamps. Where we use such personal analytics, your consent under Article 6(1)(a) GDPR is also required; device access requiring consent is additionally subject to Section 25(1) TDDDG. You can withdraw consent by unsubscribing or contacting us.

Data is processed notably in the USA. Mailchimp currently states that The Rocket Science Group LLC is covered by Intuit’s EU-US Data Privacy Framework certification. Mailchimp also provides Standard Contractual Clauses. Transfers are governed by Article 45 or 46 GDPR, rather than the former Privacy Shield. See Mailchimp’s European data transfer information, its Data Processing Addendum and Intuit’s privacy statement.

The address of the Mailchimp provider is: The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.

The usage data collected may be combined into a usage profile under a pseudonym. We use the collected data solely for statistical analysis and to improve our newsletter campaigns, not to identify you personally.

Giving, recording and withdrawing consent

We use CCM19, provided by Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany. Our integration is loaded through cloud.ccm19.de. It records and stores decisions about cookies and embedded services and applies them on later visits.

Processing includes technical access data, an identifier, selected services or categories, consent status, and the time and version of your decision. Cookies or local browser storage may be used. Processing to meet consent and accountability obligations is based on Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR; necessary storage or access is covered by Section 25(2) TDDDG. Technical delivery and security are additionally based on Article 6(1)(f) GDPR.

Decisions are retained to recognise your choices and provide necessary evidence; retention depends on the consent configuration and applicable accountability requirements. You can reject optional consent, change it later or withdraw it using the cookie button at the top of this page. Deleting browser data or switching browsers may require you to choose again. See CCM19’s privacy information.

Consent data is retained for one year and one month and then deleted. This consent data is not passed on to any other third parties.