Privacy Policy
1. Privacy at a Glance
General Information
The following information provides a simple overview of what happens to your personal data when you visit this online shop or make a purchase. Personal data is any data with which you can be personally identified. Detailed information on the subject of data protection can be found in the privacy policy listed below this text.
Who is responsible?
The party responsible for data processing in this online shop is Ketterberg. Full contact details can be found in section 3 under “Information on the responsible party".
What data is collected?
When visiting and using this shop, the following data is essentially processed:
Data that you actively provide (e.g., during an order, newsletter registration, in the AI sommelier chat),
Data that arises in the context of contract processing (e.g., order history),
Technical data that is automatically collected when visiting the website (e.g., IP address, browser type).
Why is your data processed?
Data processing takes place in particular for the purpose of contract execution (order, shipping, payment), for providing the online shop, for fulfilling legal obligations (e.g., accounting, taxes, youth protection), as well as on the basis of your consent (e.g., for the newsletter).
What rights do you have?
You have the right at any time to obtain information free of charge regarding your stored data, its origin, recipients, and the purpose of its collection, as well as the right to rectification, erasure, and restriction of processing, to data portability, and to object to processing and lodge a complaint with a supervisory authority. Details can be found in section 3.
Who processes your data technically?
This online shop is operated via the platform of Vinolin UG (haftungsbeschränkt). Vinolin processes a portion of your data as a data processor on behalf of the aforementioned responsible party. For certain functions (in particular the central login service and the AI sommelier, which are under the sole responsibility of Vinolin), Vinolin is the responsible party itself; details regarding this can be found in sections 5, 6, and 7.
2. Hosting and Technical Provision
The online shop is operated on the SaaS platform “Vinolin Suite” of Vinolin UG (haftungsbeschränkt), Bildungscampus 11, 74076 Heilbronn. Vinolin processes the personal data generated in this shop as a data processor on behalf of the shop operator. A contract for data processing in accordance with Art. 28 GDPR has been concluded with Vinolin.
Vinolin uses the following sub-processors for the technical provision of the platform:
Vercel Inc. (USA, with global CDN) — Web hosting and delivery of static content
Neon Inc. (USA, data processing in Frankfurt am Main) — Database hosting
Inngest, Inc. (USA) — Background job processing
Amazon Web Services EMEA SARL (Luxembourg, data processing in Frankfurt am Main) — Sending transactional emails (e.g., order confirmations)
Google Ireland Ltd. (Ireland, data processing in Frankfurt am Main) — AI functions for the sommelier (cf. section 7)
For sub-processors based outside the EU, EU standard contractual clauses (SCCs) are used in accordance with Art. 46 (2) (c) GDPR; in some cases, there is an additional self-certification under the EU-U.S. Data Privacy Framework.
Processing is carried out for the performance of a contract with our customers (Art. 6 (1) (b) GDPR) as well as on the basis of our legitimate interest in the secure, fast, and efficient provision of the online shop by professional providers (Art. 6 (1) (f) GDPR).
3. General Information and Mandatory Information
Data Protection
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
We would like to point out that data transmission over the Internet (e.g., in communication by email) may have security gaps. Complete protection of data against access by third parties is not possible.
Information on the Responsible Party
The responsible party for data processing in this online shop is:
Vinolin UG (haftungsbeschränkt)
Phone: +49 7131 6161738
Email: info@vinolin.com
HRB 803539
VAT ID: DE356208438
Data Protection Officer
We have not appointed a data protection officer as we are not required to do so. For questions regarding data protection, please contact the contact details provided under “Information on the responsible party".
Storage Duration
Unless a more specific storage period is mentioned within this privacy policy, your personal data will remain with us until the purpose for data processing ceases to exist. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, provided we have no other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods pursuant to § 257 HGB / § 147 AO; as a rule, ten years); in the latter case, deletion occurs after these reasons no longer apply.
General Information on the Legal Bases for Data Processing
Provided you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 (1) (b) GDPR. Furthermore, we process your data if this is required for the fulfillment of a legal obligation on the basis of Art. 6 (1) (c) GDPR. Data processing may also occur on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The relevant legal bases for each individual case are provided in the following paragraphs of this privacy policy.
Recipients of Personal Data
Within the framework of our business activities, we work with various external entities. In this context, it is sometimes necessary to transmit personal data to these external entities. We only pass on personal data to external entities if this is necessary for the fulfillment of a contract, if we are legally obligated to do so, if we have a legitimate interest in the transfer pursuant to Art. 6 (1) (f) GDPR, or if another legal basis allows the data transfer. When using data processors, we only pass on personal data on the basis of a valid contract for data processing.
Revocation of Your Consent to Data Processing
Many data processing operations are only possible with your express consent. You can revoke your consent at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
Right to Object (Art. 21 GDPR)
If data processing is based on Art. 6 (1) (e) or (f) GDPR, you have the right to object at any time to the processing of your personal data for reasons arising from your particular situation; this also applies to profiling based on these provisions. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms or if the processing serves to assert, exercise, or defend legal claims.
If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. If you object, your personal data will subsequently no longer be used for the purpose of direct marketing.
Right to Lodge a Complaint with the Competent Supervisory Authority
In the event of violations of the GDPR, the data subjects have a right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedy. The State Commissioner for Data Protection and Freedom of Information, Königstraße 10a, 70173 Stuttgart.
Right to Data Portability
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to yourself or to a third party in a standard, machine-readable format. Insofar as you request the direct transfer of the data to another controller, this will only take place to the extent that it is technically feasible.
Information, Rectification, and Erasure
Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of the data processing and, if applicable, a right to rectification or erasure of this data.
Right to Restriction of Processing
You have the right to demand the restriction of the processing of your personal data. You can contact us at any time for this purpose.
SSL or TLS Encryption
For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.
Objection to Promotional Emails
The use of contact data published within the scope of the legal notice obligation for the transmission of unsolicited advertising and information materials is hereby rejected. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of promotional information, such as spam emails.
4. Data Collection When Visiting This Shop
4.1 Cookies
We use exclusively technically necessary cookies in this online shop. These cookies are required for the shop to function — in particular for:
managing your login session (if you have logged in via the Vinolin login),
managing your shopping cart,
the secure processing of the order and payment process,
a technical identification of your session in the AI sommelier chat (Conversation ID).
These cookies are set on the basis of § 25 (2) no. 2 TDDDG without consent, as they are absolutely necessary for the provision of the services expressly requested by you. The legal basis for the associated data processing is Art. 6 (1) (b) GDPR (contract fulfillment) or Art. 6 (1) (f) GDPR (legitimate interest in secure and functional operation).
We do not use cookies for tracking, analysis, or marketing. We therefore dispense with a cookie banner.
You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases or exclude them in general. If technically necessary cookies are deactivated, the functionality of this shop is restricted.
4.2 Server Log Files
When you access this online shop, information is automatically recorded in so-called server log files, which your browser automatically transmits, via the infrastructure of our platform provider Vinolin (cf. section 2). These are: Browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request, IP address.
This data is not combined with other data sources. The collection of this data is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free provision of this shop and the security of our systems. The logs are generally deleted automatically after 30 days.
5. End-Customer Account and Login (account.vinolin.com)
5.1 Central Login Service
For logging into this shop, we use the central login service of Vinolin UG (haftungsbeschränkt) at the domain account.vinolin.com. This service allows you to shop in all Vinolin shops with a single account without having to create a separate account in each shop.
Responsible for the processing of your account data in the context of this login service is Vinolin UG (haftungsbeschränkt), Bildungscampus 11, 74076 Heilbronn. The privacy policy applicable to this can be found at https://vinolin.com/datenschutz.
5.2 What data is processed?
When registering and logging in via the Vinolin account, the following data is processed in particular:
First name, last name (optional: gender and profile picture)
Email address and email verification status
Phone number (optional)
Date of birth (as part of the age indication)
Password hash, session token, OAuth tokens
IP address and user agent at the time of login
5.3 When is your data passed on to us?
Only as soon as you make a purchase in our shop or subscribe to our newsletter will the data necessary for these purposes be transmitted by Vinolin to us as the shop operator. From this point on, we are responsible for the processing of the data associated with the order or the newsletter (cf. sections 6 and 8).
6. Order Processing in the Shop
6.1 What data is processed during an order?
As part of an order, we process the data required for contract fulfillment. This data is collected partly directly from you and partly provided via the Vinolin account or via the payment service provider:
Master and contact data (via Vinolin account):
First and last name, email address, potentially phone number
Date of birth (for age verification in accordance with youth protection)
Address and payment data (via the payment service provider Stripe, cf. section 6.3):
Delivery and billing address
Payment data (e.g., credit card token; complete card data is not stored by us)
Order data:
Order number, order items, quantities, prices
Order status, shipping status
Invoice documents
6.2 Legal basis and storage duration
The processing of order data takes place on the basis of Art. 6 (1) (b) GDPR (contract fulfillment). Order data that is relevant for accounting (in particular invoices) will be stored for ten (10) years in accordance with § 257 HGB / § 147 AO. The legal basis for this is Art. 6 (1) (c) GDPR (legal obligation).
6.3 Payment processing via Stripe
Payment processing in this shop is handled by the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You can pay via Stripe using, among others, credit card, Apple Pay, Google Pay, or Wero.
Stripe is an independent controller within the meaning of Art. 4 No. 7 GDPR in the context of payment processing. You enter your payment data (in particular card and bank details, delivery and billing address) directly with Stripe. Stripe processes this data under its own responsibility for payment processing as well as for the fulfillment of legal obligations (in particular in the area of anti-money laundering).
We only transmit your email address to Stripe in order to enable Stripe to identify your order. We receive status information about the payment as well as the delivery address required for shipping back from Stripe.
Further information can be found in Stripe's privacy policy at https://stripe.com/de/privacy.
6.4 Payment processing via PayPal
If you choose to pay with PayPal, payment processing is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, Luxembourg.
PayPal is an independent controller in the context of payment processing. You enter your payment data directly with PayPal. PayPal processes this data under its own responsibility. Further information can be found in PayPal's privacy policy at https://www.paypal.com/de/legalhub/privacy-full.
6.5 Shipping of goods
We handle shipping ourselves via a shipping service provider commissioned by us (DHL). For this purpose, we transmit your delivery and, if applicable, contact data (email address, phone number) to the shipping service provider. The legal basis is Art. 6 (1) (b) GDPR.
6.6 Sending of order confirmations and status emails
As part of the order processing, you will receive automated emails (order confirmation, shipping confirmation, status information). The technical dispatch takes place via the infrastructure of our platform provider Vinolin and is handled via the sub-processor Amazon Web Services EMEA SARL (cf. section 2).
7. AI Sommelier
In this shop, an AI-powered sommelier is available to recommend suitable wines from our range based on your taste preferences.
7.1 Anonymous use
You can also use the AI sommelier without logging in. Before using it for the first time, you must agree to the processing of your inputs. In the case of anonymous use, the conversation history is saved; an IP address is not recorded, so it is not possible to recognize your person across multiple sessions.
7.2 Use with a logged-in account
If you are logged in via your Vinolin account, your name is also transmitted in order to provide you with more personalized advice. In the future, a shop-wide taste profile managed via the Vinolin account may also be included, provided you have agreed to the creation and use of such a profile.
7.3 Controller
The Ketterberg, as the shop operator, is responsible for providing the AI sommelier within the framework of this shop. Vinolin processes the data generated in the sommelier dialogue as a data processor on behalf of the shop operator (cf. section 2). The processing of the shop-wide taste profile is carried out by Vinolin under its own responsibility; details and the option for consent or revocation can be found in Vinolin's privacy policy.
7.4 AI processing via Google Vertex AI
To generate the AI responses, your inputs and, if applicable, your name are transmitted to Google Ireland Ltd. (Google Vertex AI). Processing takes place in a data center in Frankfurt am Main (Germany). According to Google, the transmitted data is processed exclusively for the generation of the respective response, is not stored permanently, and is not used for training purposes.
7.5 Legal basis and storage duration
Processing is based on your consent pursuant to Art. 6 (1) (a) GDPR, which you give before starting the chat. You can revoke your consent at any time with effect for the future.
8. Newsletter
8.1 Registration with double opt-in
You can subscribe to our newsletter on the website of this shop. Registration takes place via the double opt-in procedure: After entering your email address, you will receive a confirmation email with a confirmation link. You will only be added to our distribution list after clicking the link.
8.2 What data is processed?
As part of the newsletter subscription, we process:
Your email address
Confirmation status (Pending / Verified / Unsubscribed)
Confirmation and unsubscribe tokens
Timestamp of registration and confirmation
8.3 Dispatch and technical provision
We handle the technical dispatch of the newsletters via the infrastructure of our platform provider Vinolin. For this purpose, Amazon Web Services EMEA SARL (cf. section 2) is used as a sub-processor. We remain the controller in this regard; Vinolin and AWS are exclusively involved as data processors.
8.4 Legal basis and revocation
Processing is based on your consent pursuant to Art. 6 (1) (a) GDPR. You can revoke your consent at any time by clicking the unsubscribe link in every newsletter or by sending us a corresponding notification to {{EMAIL}}. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
After revocation, your data will be removed from the active newsletter distribution list. We may keep proof of your consent and revocation in order to fulfill our burden of proof (Art. 6 (1) (f) GDPR — legitimate interest in provability).
9. Currency of this privacy policy
We reserve the right to adapt this privacy policy in the event of significant changes. The current version is available on our website.
Status: May 2026