Privacy policy

1. Controller

The controller responsible for processing personal data in this online shop is Mecanova UG (haftungsbeschränkt), Erismannstraße 4b, 79206 Breisach am Rhein. You can reach us by email at info@mecanova.de and by phone at +49 151 57757317.

2. Overview and legal bases

We process personal data only insofar as this is necessary to operate the shop, process your order, answer your enquiries or comply with legal obligations, or where you have given your consent.

The legal bases are Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests). Storing information on your device and accessing it is additionally governed by Section 25 of the German TDDDG.

We do not use any analytics or advertising tools on our website and do not create usage profiles.

3. Hosting and server log files

Our website is provided by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. With every request Netlify processes technically necessary data: your IP address, date and time of the request, the page requested, the previously visited page (referrer), the amount of data transferred and information about your browser and operating system. The forms on this website (contact, online withdrawal) also run on Netlify servers.

The purpose is to deliver the website and keep it secure, for example to fend off attacks. The legal basis is our legitimate interest in a secure and functioning online offering (Art. 6(1)(f) GDPR). Netlify processes the data on our behalf under a data processing agreement (Art. 28 GDPR) and keeps log data only for as long as necessary for these purposes.

Netlify also processes data in the USA. Netlify, Inc. is certified under the EU-US Data Privacy Framework; transfers to certified companies are covered by an adequacy decision of the European Commission (Art. 45 GDPR). In addition, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR).

The connection to our website is encrypted with TLS.

4. Storage in your browser

Our website does not set any cookies itself. Some functions store information in your browser's local storage (localStorage). This information stays on your device and is not transferred to us:

Age confirmation (mecanova-age-confirmed): that you confirmed you are at least 18 years old, so we do not ask again on every visit.

Cart (mecanova-cart-v2): the bottles in your cart and any gift options, for example the text of a greeting card or a preferred date.

Wishlist (mecanova-wishlist): the bottles you have saved.

Colour scheme (mecanova-theme): whether you chose the light or dark display.

Maps (mecanova-map-consent): whether you agreed to load the maps, see section 11.

Drink builder (mecanova-bar-discovered, mecanova-bar-achievements): which recipes you discovered in the drink builder, if you use it.

These entries are strictly necessary to provide the functions you have expressly requested (Section 25(2) no. 2 TDDDG). Where personal data is concerned, the legal basis is Art. 6(1)(b) and (f) GDPR. You can delete the entries at any time in your browser settings; cart and wishlist will then be empty.

5. Shop system and product images (Shopify)

Our online shop uses the shop system of Shopify. The provider for Europe is Shopify International Ltd., c/o Intertrust Ireland, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes data on our behalf under a data processing agreement (Art. 28 GDPR), unless section 7 states otherwise.

Our server retrieves product data such as names, prices and stock from Shopify; no data about you is transferred in the process. Your browser, however, loads the product images directly from Shopify servers (cdn.shopify.com). Shopify receives your IP address and information about your browser. The legal basis is our legitimate interest in displaying our range quickly and reliably (Art. 6(1)(f) GDPR).

Shopify transfers data to Shopify Inc. in Canada and to other companies of the Shopify group. For Canada there is an adequacy decision of the European Commission (Art. 45 GDPR). Shopify bases transfers within the Shopify group on binding corporate rules (Art. 47 GDPR) and transfers to third parties on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

6. Order and checkout

When you click “Checkout”, our server creates a cart at Shopify with the bottles you selected, your gift options and your language, and forwards you to the Shopify checkout. We pass your IP address to Shopify so that Shopify can match the request to your purchase and detect abuse.

In the checkout you enter your contact details (name, email address, optionally phone number), your delivery and billing address and your payment details. We and Shopify process this data to conclude and perform the contract of sale, send you order and shipping confirmations and issue invoices. The legal basis is Art. 6(1)(b) GDPR, and for keeping invoices and accounting records Art. 6(1)(c) GDPR.

The details required for the contract are a prerequisite for an order. Without them we cannot conclude the contract.

The checkout runs on Shopify servers. There Shopify sets technically necessary cookies, for example for the cart, the session and fraud prevention (Section 25(2) no. 2 TDDDG). Shopify sets further cookies and similar technologies only if you have consented in the checkout's cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change your choice there at any time.

7. Shopify Network Intelligence

We use the Shopify Network Intelligence feature. Shopify uses data from your interactions with our shop, with other merchants and with Shopify under its own responsibility to provide and improve its own services, for example for fraud prevention. Shopify uses your data for personalised advertising based on your activities only with your consent. To that extent Shopify is itself the controller.

Shopify obtains the consent via the cookie banner in the checkout (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). For fraud prevention Shopify relies on its legitimate interest (Art. 6(1)(f) GDPR). Data may be transferred to Shopify and to third parties in other countries, in particular Canada and the USA.

You can withdraw your consent and object to the processing at any time via the cookie banner in the checkout or in Shopify's privacy portal: https://privacy.shopify.com

More information is in Shopify's privacy policy for buyers: https://www.shopify.com/legal/privacy/consumers

8. Payment

We process payments via Shopify Payments. You enter your payment details, for example card number, expiry date and security code, directly in the Shopify checkout; we do not receive them in full. Shopify passes the data needed for the payment to the payment service provider through which Shopify Payments is processed in Germany, Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, and to the card schemes and banks involved. The legal basis is Art. 6(1)(b) GDPR, and for fraud prevention additionally Art. 6(1)(f) GDPR.

If you pay with Apple Pay or Google Pay, Apple or Google additionally process your data under their own responsibility according to their privacy policies: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

9. Shipping

For delivery we pass your name and delivery address to our carrier DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany). On handover the courier checks against an identity document whether the person accepting the parcel is at least 18 years old. We pass your email address or phone number to DHL only if you have agreed to this for delivery notifications.

The legal basis is Art. 6(1)(b) GDPR, and for the age check additionally Art. 6(1)(c) GDPR in conjunction with Section 9 of the German Youth Protection Act.

10. Contact and online withdrawal

If you contact us by email, by phone or via the contact form, we process your details (name, email address, optionally phone number and your message) to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to an order, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

If you withdraw from a contract using our “Withdraw from contract” function, we process your name, your order number, your email address, the items withdrawn, any message and the date and time of receipt. We need this data to process your withdrawal and to send you the acknowledgement of receipt required by law (Art. 6(1)(c) GDPR in conjunction with Section 356a German Civil Code).

If you choose “Notify me” for a sold-out bottle, we process your email address and the bottle you chose in order to let you know once when it is available again. The legal basis is your request (Art. 6(1)(b) GDPR). We do not use it to send you advertising.

We send messages from the contact form, the availability notification and the withdrawal function as well as the acknowledgements of receipt via the email service Resend (Resend, Inc., USA). Our mailboxes are operated by Microsoft as part of Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Both process the data on our behalf (Art. 28 GDPR). Resend stores data in the USA, and Microsoft may also process data in the USA; both companies are certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the European Commission's standard contractual clauses apply in addition (Art. 46(2)(c) GDPR).

We delete enquiries once they have been dealt with and no statutory retention obligations apply. If they relate to an order, which is always the case for a withdrawal, we keep them together with the order records.

11. Maps (Mapbox)

On some pages we show interactive maps, for example the location of our houses in Mexico. The maps come from Mapbox, Inc. (USA). They are only loaded once you choose “Load map”. Before that our website does not connect to Mapbox.

When the map loads, your browser transmits data to Mapbox: your IP address, information about your browser and device, the map sections requested and usage events such as loading a map. For this the map software creates a random identifier in your browser's local storage that is renewed every 24 hours (entries starting with mapbox.eventData). According to Mapbox, the IP address is deleted after 30 days.

The purpose is to display the maps. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We store your decision in your browser's local storage (mecanova-map-consent) so that we do not ask again on every page.

Mapbox also processes data in the USA. Mapbox, Inc. is certified under the EU-US Data Privacy Framework; transfers to certified companies are covered by an adequacy decision of the European Commission (Art. 45 GDPR).

You can withdraw your consent at any time with effect for the future using the button below. After that no maps will be loaded, and we remove the Mapbox entries from your browser.

12. Storage period

We store personal data only for as long as necessary for the respective purpose. We keep order and invoice data because of commercial and tax law obligations: invoices and accounting records for eight years, commercial and business letters for six years, books and annual financial statements for ten years (Section 257 German Commercial Code, Section 147 German Fiscal Code). The period starts at the end of the calendar year in which the record was created.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). A message to info@mecanova.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

14. Right to object

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

We do not use your data for direct marketing.

15. No automated decisions

We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR.

16. Changes

We update this privacy policy when our shop or the legal situation changes. The version published here applies.