PRIVACY POLICY

Data Controller

Owner / Operator: M.E. Boumahdi
Address: Nelkenweg 2
9141 Gösselsdorf
Austria
E-mail: admin@luxusgmbh.com

Data We Collect

When you visit this website, our web server automatically records the following in its log files: your IP address, browser type and version, operating system, referring URL, the date and time of access, and the pages requested. If you submit the producer application form, we also receive the name, winery name, e-mail address, region, website and message you enter. If you use the \"report wrong information\" form on a wine page, we receive your e-mail address, the text of your report, the page it concerns and the language you are reading it in; we also keep a one-way hash of your IP address, used solely to limit repeated submissions and from which the address cannot be recovered. We do not use any analytics or visitor-tracking service on this website, and we do not build profiles of visitors.

Purpose & Legal Basis

Data	Purpose	Legal basis
Server log files	Operating the site, diagnosing faults, and security	Art. 6(1)(f) GDPR — legitimate interests
Producer application form	Answering your enquiry and assessing a possible listing	Art. 6(1)(b) GDPR — pre-contractual measures
Error report form	Checking and correcting a listing, and replying to you	Art. 6(1)(f) GDPR — legitimate interests (accuracy of the catalogue)
Local browser storage	Remembering that you dismissed a notice, so it is not shown again	Art. 6(1)(f) GDPR — legitimate interests
Advertising cookies and identifiers	Serving, capping and measuring advertising	Art. 6(1)(f) GDPR — legitimate interests (non-personalised)
Advertising personalisation	Selecting ads based on your prior browsing	Art. 6(1)(a) GDPR — your consent

Data Retention

Server log files are rotated daily and kept for 14 days, then deleted automatically. Data from the producer application form is kept for as long as needed to handle your enquiry, and for up to 3 years thereafter in line with Austrian limitation periods. You may ask us to delete it sooner at any time. Error reports are kept for as long as it takes to check and correct the entry, and for no more than 12 months, then deleted. Retention of advertising data is controlled by Google and described in its own privacy policy.

Hosting & Infrastructure

This website is hosted on a virtual private server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes data as a data processor on our behalf under a Data Processing Agreement (Art. 28 GDPR). Data is stored exclusively within the EU/EEA.

Cookies and local storage

This website sets no cookies of its own on its public pages. Your language choice is carried in the page address rather than stored, and session cookies are used only in the password-protected administration and producer areas. Two items are written to your browser's local storage — one recording that you dismissed the age and responsibility notice, one that you minimised the app suggestion — so that they are not shown to you repeatedly. Both stay in your browser, are never transmitted to us, and can be removed by clearing your browser data. Cookies and similar identifiers may in addition be set by Google when advertising is displayed; see "Advertising" below.

Third parties who receive data

Fonts, stylesheets, scripts and flag icons are all served from our own server, so no third party is contacted for them. Two things on this site are still loaded from elsewhere, and because your browser fetches them directly, the operator of that server necessarily receives your IP address and technical request details. We have no access to that data. The recipients are:

Hetzner Online GmbH (Germany): Hosting of this website; acts as our processor under Art. 28 GDPR. Data stays in the EU.
Google Ireland Ltd. / Google LLC: Advertising (Google AdSense). The AdSense script is requested on every page, so Google receives your IP address and page URL even before any ad is shown. Data may be transferred outside the EU under the EU–US Data Privacy Framework and Standard Contractual Clauses.
Wine producers' own websites, and image services including Vivino: Bottle and winery photographs are displayed directly from the source they were published on — in most cases the producer's own website, sometimes an image service or website-builder CDN. Around 520 different servers are involved across the catalogue, and the one holding a given photograph receives your IP address when that page loads. We do not control those servers and they may be located outside the EU.

Advertising

This website is funded in part by advertising served by Google AdSense, operated by Google Ireland Ltd. Third-party vendors, including Google, use cookies and similar identifiers to serve advertising, to limit how often you see a given ad, and to measure it. Where you have given consent, those identifiers are also used to personalise advertising based on your previous visits to this and other websites. If you are in the EEA, the United Kingdom or Switzerland, we ask for that consent through Google's certified consent message before any advertising identifier is used for personalisation, and you can change or withdraw your choice at any time through the same message. Where consent is refused or withdrawn, only non-personalised advertising is shown. You can also review or switch off ad personalisation across Google services at adssettings.google.com, opt out of personalised advertising from participating vendors at youronlinechoices.eu or aboutads.info, and read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites. Pages of premium producers carry no advertising at all.

Minors

This website is about wine and is intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, please contact us and we will delete it.

Your Rights

Under the GDPR you have the following rights regarding your personal data. To exercise any of these rights, please contact us at the address below.

—Right of access — you may request a copy of the personal data we hold about you (Art. 15 GDPR).
—Right to rectification — you may request correction of inaccurate or incomplete data (Art. 16 GDPR).
—Right to erasure — you may request deletion of your personal data where there is no overriding legal basis for retention (Art. 17 GDPR).
—Right to restriction — you may request that processing of your data be temporarily restricted (Art. 18 GDPR).
—Right to data portability — you may request your data in a structured, machine-readable format (Art. 20 GDPR).
—Right to object — you may object to processing based on legitimate interests at any time (Art. 21 GDPR).
—Right to withdraw consent — where processing rests on your consent, you may withdraw it at any time, without affecting the lawfulness of what was done before (Art. 7(3) GDPR).

Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority:

Authority: Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Address: Barichgasse 40–42, 1030 Wien, Austria
E-mail: dsb@dsb.gv.at
Web: https://www.dsb.gv.at

Contact for Data Protection Enquiries

E-mail: admin@luxusgmbh.com

Delete Account

You can request the deletion of your account and all associated personal data at any time. Send an email to admin@luxusgmbh.com with the subject «Delete account». All your personal data will be deleted within 30 days.

Changes to This Policy

We reserve the right to update this Privacy Policy to reflect changes in law or our data processing practices. The current version is always available on this page. We recommend checking this page periodically.

Menu