Privacy Policy

Important notice

This English version of the Privacy Policy is provided for information purposes only.

The legally binding version is the German-language Privacy Policy.

In the event of discrepancies or differences in interpretation, the German version shall prevail.

We take the protection of your personal data seriously. Personal data is processed in accordance with applicable data protection legislation, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

This Privacy Policy explains which personal data we process when you visit our website, place orders or use our services, for what purposes such processing takes place and what rights you have.

1. Name and Contact Details of the Controller

This Privacy Policy applies to data processing by:

Controller:

Jan Giselher Orb
J.G. Orb GbR
Am Markt 9–13
67593 Westhofen
Germany

Phone: +49 6244 828

Email: kontakt[at]weingut-orb.de

Website: weingut-orb.de

For data protection matters, you may contact us using the details above.

2. Collection and Processing of Personal Data

2.1 Visiting the Website

When you access our website, technically necessary information is processed, in particular:

IP address
Date and time of access
Pages and files accessed
Referrer URL
Browser, operating system and device settings
Technical connection data

Processing is carried out to provide and secure the website, analyse errors and ensure stable operation.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online services.

Data is stored only for as long as necessary for these purposes. Longer storage takes place exclusively where necessary to prevent or investigate security-related incidents.

2.2 Use of Our Online Shop and Order Processing

When you place an order, we process the data necessary to initiate, perform and fulfil the contract, in particular:

First and last name
Billing and delivery address
Email address and, where applicable, telephone number
Products ordered and order information
Payment method and payment status
Invoice, shipping and delivery information
Where applicable, information required for age verification

Processing is carried out to handle orders, process payments, deliver goods, respond to enquiries and warranty claims, and comply with legal obligations.

The legal bases are Art. 6(1)(b) GDPR for the performance of a contract and Art. 6(1)(c) GDPR for compliance with legal obligations, in particular retention obligations under tax and commercial law.

Payments are processed through the respective payment service providers selected. We receive the information necessary to allocate and process payments, but do not receive complete credit card details.

2.3 Customer Accounts

When you register a customer account, we process the contact details you provide and the information necessary to manage your account. This may include your order history, saved addresses, account settings and, where applicable, information relating to the loyalty programme.

Processing is carried out to provide and manage the customer account pursuant to Art. 6(1)(b) GDPR.

The customer account may be deleted upon request, provided that no statutory retention obligations or other legitimate grounds prevent deletion.

2.4 Newsletter

If you subscribe to our newsletter, we use your email address to inform you about our wines, news, events and offers.

Subscription is generally carried out using the double opt-in procedure. Your subscription and its confirmation, including the data necessary to demonstrate proof of consent, are documented.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link in our emails or by sending a message to kontakt[at]weingut-orb.de.

Data necessary to demonstrate proof of consent may continue to be stored in accordance with legal requirements.

2.5 Automated Customer Emails

As part of order processing, we send automated emails, in particular order confirmations, payment and shipping information and, where applicable, invoices and other contract-related communications.

The legal bases are Art. 6(1)(b) and (c) GDPR.

In addition, we may send automated promotional communications, such as review requests, reminders about incomplete orders, repeat-purchase reminders or information about offers and our loyalty programme.

For these purposes, we process in particular contact details, order and shopping cart information and, where applicable, the dates of previous orders.

Promotional emails are sent only where consent has been given or the statutory requirements for marketing to existing customers under Section 7(3) of the German Act Against Unfair Competition (UWG) are met.

The legal basis is Art. 6(1)(a) GDPR where consent has been given, or Art. 6(1)(f) GDPR where marketing to existing customers is legally permitted.

You may object to the use of your data for direct marketing at any time. Every promotional email includes an appropriate unsubscribe option.

2.6 Loyalty Programme

Registered customers may earn and redeem benefits through our voluntary loyalty programme (“Stars” or “Loyalty Points”).

For this purpose, we process in particular:

Customer number and contact details
Participation and account information
Orders relevant to the award of points
Points credited and points balances
Redemptions and necessary adjustments

Processing is carried out for the operation and management of the loyalty programme pursuant to Art. 6(1)(b) GDPR.

Where statutory retention obligations apply, further processing is carried out pursuant to Art. 6(1)(c) GDPR.

Any additional use of the data for promotional purposes takes place exclusively in accordance with the applicable legal requirements.

2.7 Contacting Us

If you contact us by email, telephone or contact form, we process the information you provide in order to handle your enquiry.

The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract or its initiation. For other enquiries, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in processing and responding to your enquiry.

The data is deleted as soon as it is no longer necessary to process your enquiry and no statutory retention obligations or other legitimate grounds for further storage apply.

2.8 Withdrawals, Returns and Complaints

When you exercise your statutory right of withdrawal, in particular through our electronic withdrawal function, we process the information necessary to identify and handle your request, including your name, email address, order reference, content of the declaration and the date and time of receipt.

The data is used to process and document the withdrawal and to carry out any necessary refunds.

The legal bases are Art. 6(1)(b) and (c) GDPR. Where necessary, further processing takes place for the establishment, exercise or defence of legal claims pursuant to Art. 6(1)(f) GDPR.

3. Disclosure of Personal Data

Personal data is disclosed only where necessary for the performance of a contract, the provision of our services, compliance with legal obligations or on another lawful basis.

Recipients may include in particular:

Payment service providers
Shipping and logistics companies
Website and online shop infrastructure providers
Email delivery and customer communication service providers
Technical service providers and data processors
Tax advisers and accounting service providers
Public authorities in accordance with legal obligations

Where service providers process personal data on our behalf, this is carried out on the basis of appropriate agreements pursuant to Art. 28 GDPR.

3.1 PayPal

We offer PayPal as a payment method.

The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.

When PayPal is used, order and transaction data necessary for payment processing is transmitted to PayPal.

The legal basis is Art. 6(1)(b) GDPR.

Further information is available in PayPal's Privacy Policy.

3.2 SumUp

We use SumUp payment services for card payments.

Transaction data and, where applicable, contact details necessary to process and allocate payments are processed. Payment information may be processed by SumUp under its own responsibility under data protection law.

The legal basis for the transfer of data for payment processing is Art. 6(1)(b) GDPR.

Further information is available in SumUp's Privacy Policy.

3.3 Shipping Service Providers

To deliver our goods, we transmit the necessary shipping information to the shipping and logistics service providers commissioned, in particular the recipient's name, delivery address and, where applicable, necessary contact details.

The legal basis is Art. 6(1)(b) GDPR.

3.4 PayPal Agentic Commerce Services

Where our products are offered through AI-assisted shopping functions provided by PayPal, product information such as descriptions, prices and availability may be processed, as well as transaction data necessary to complete a purchase.

The processing of personal order data is carried out for the performance of the respective purchase contract pursuant to Art. 6(1)(b) GDPR. Data processing within PayPal's systems is additionally governed by PayPal's privacy information.

4. Cookies and Consent Management

Our website uses cookies and similar technologies to provide technical functions and, with your consent, to analyse website usage or carry out marketing activities.

4.1 Strictly Necessary Cookies

Strictly necessary cookies and similar technologies are used where required to provide website functions expressly requested by users, in particular security, shopping cart functionality, payment processing and session settings.

The legal basis for storing or accessing information on a user's device is Section 25(2) TDDDG. The associated processing of personal data is carried out in accordance with Art. 6(1)(b), (c) or (f) GDPR.

4.2 Technologies Requiring Consent

Cookies and similar technologies used for analytics, statistics and marketing purposes are deployed only with your prior consent where such consent is required by law.

The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

You may change or withdraw your consent at any time with effect for the future through the cookie settings on our website.

4.3 Usercentrics

We use the consent management platform provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, to manage and document your consent decisions.

In particular, consent decisions, technical identifiers and necessary documentation data are processed.

Processing is carried out to ensure the legally compliant management and documentation of consent.

The legal bases are Art. 6(1)(c) and (f) GDPR and, where applicable, Section 25(2) TDDDG.

Services requiring consent are blocked until the corresponding consent has been given.

Information about individual technologies, their providers, processing purposes and retention periods can be found in the cookie settings on our website.

5. Services Used and Third-Party Providers

5.1 Wix Core Services and Hosting

Our website and online shop are operated through the platform of Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel.

Wix provides, in particular, hosting, website infrastructure, online shop functions, customer management and technical security functions.

Personal data such as IP addresses, technical usage data, contact details and order information may be processed.

Depending on the processing activity, the legal bases are Art. 6(1)(b) and (f) GDPR and, where processing is legally required, Art. 6(1)(c) GDPR.

Further information is available in Wix's Privacy Policy.

5.2 Wix Analytics

We use Wix analytics functions to statistically evaluate the use of our website, insofar as these functions are enabled.

This may involve processing information about page views, user behaviour, technical device information and interactions with our online services.

Where consent is required, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

5.3 Meta Pixel

Where enabled, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

This enables us to measure and evaluate advertising activities and attribute certain interactions with our website to advertisements on Facebook or Instagram.

Usage, device and interaction data, among other information, may be transmitted to Meta.

The Meta Pixel is used only after the relevant consent has been given pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Further information is available in Meta's Privacy Policy.

5.4 Embedded Instagram Content

Content from Instagram may be embedded on our website.

When such content is loaded, technical connection data, in particular IP addresses and browser information, may be transmitted to Meta.

Where consent is required, such content is loaded only after the relevant consent has been given.

The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, insofar as information on the user's device is accessed.

5.5 Gravatar

Where this function is enabled, we use Gravatar, provided by Automattic Inc., USA, to display user profile images.

An identifier derived from the user's email address may be transmitted to Gravatar.

Where legally required, processing takes place on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

5.6 Google Site Verification

We may use Google Site Verification to technically verify our website with Google services.

Verification serves to demonstrate our authorisation to manage the website. This service is not used to analyse visitor behaviour.

Where personal data is processed in connection with verification, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure administration of our website.

6. Data Retention and Deletion

Personal data is stored only for as long as necessary for the respective processing purposes or where statutory retention obligations apply.

The statutory retention periods include in particular:

10 years for accounting books, records and annual financial statements
8 years for accounting documents, in particular invoices
6 years for commercial and business correspondence

These periods generally begin at the end of the respective calendar year. Special statutory provisions and extensions remain unaffected.

After the applicable retention periods have expired, personal data is deleted unless other statutory or legitimate grounds justify further storage.

Data required exclusively for a specific processing purpose is deleted once that purpose no longer applies, provided that no other legal basis permits further storage.

7. Transfers of Data to Third Countries

When using our website, personal data may also be processed by technical service providers outside the European Union or the European Economic Area.

This applies in particular to Wix and, where applicable, international payment, analytics and marketing service providers integrated into our website.

The European Commission has adopted an adequacy decision for Israel pursuant to Art. 45 GDPR.

Where personal data is transferred to other third countries, such transfers are based on an adequacy decision, for example the EU–US Data Privacy Framework for appropriately certified recipients, or on appropriate safeguards pursuant to Art. 46 GDPR, in particular the European Commission's Standard Contractual Clauses.

Where necessary, supplementary protective measures are implemented.

Further information about the transfer mechanisms used and available safeguards can be obtained upon request at kontakt[at]weingut-orb.de.

8. Your Rights

Subject to the applicable statutory requirements, you have the following rights:

Right of access to your personal data pursuant to Art. 15 GDPR
Right to rectification of inaccurate data pursuant to Art. 16 GDPR
Right to erasure of personal data pursuant to Art. 17 GDPR
Right to restriction of processing pursuant to Art. 18 GDPR
Right to data portability pursuant to Art. 20 GDPR
Right to object to certain processing activities pursuant to Art. 21 GDPR
Right to withdraw consent pursuant to Art. 7(3) GDPR
Right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The competent data protection supervisory authority for our company is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz

Hintere Bleiche 34
55116 Mainz
Germany

9. Right to Object

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you may object to such processing pursuant to Art. 21(1) GDPR on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object at any time without giving reasons pursuant to Art. 21(2) GDPR. In this case, your data will no longer be processed for these marketing purposes.

To exercise your right to object, simply send an email to kontakt[at]weingut-orb.de.

10. Data Security and Further Information

We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access or unlawful disclosure.

Data transmitted through our website is encrypted using TLS.

Where personal data is required to process an order, providing such data is necessary for the conclusion or performance of the contract. Without this information, it may not be possible to process an order.

Providing data for voluntary services, such as newsletters or the loyalty programme, is generally optional. However, the respective service cannot be used without the information required for it.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. Automated processes relating to orders, customer communications and the loyalty programme remain unaffected by this statement.

11. Updates and Changes to This Privacy Policy

This Privacy Policy was last updated in October 2026.

Updates may become necessary due to technical developments, changes to our services or new legal requirements.

The current version is available at: