Privacy Policy

The protection of personal data is an important concern for us, STOCK SPIRITS GmbH, Gaußstraße 73, 22765 Hamburg, Germany (hereinafter “Stock Spirits” or “we”). We process your personal data only in accordance with the statutory provisions, in particular Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter “GDPR”) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, hereinafter “BDSG”).

In accordance with Art. 13 and 14 GDPR, this Privacy Policy informs you about the processing of your personal data and about your rights as a data subject in connection with your visit to our website and to our social media presences.

This Privacy Policy also informs you about the protection of your privacy on the terminal equipment you use within the meaning of Section 25 of the German Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, hereinafter “TDDDG”).

The controller responsible for the data processing described in this Privacy Policy is STOCK SPIRITS GmbH, Gaußstraße 73, 22765 Hamburg, Germany. You can contact us by e-mail at office@stockspirits.com.

You can reach our external Data Protection Officer, Melissa Reinbeck, MÖHRLE HAPP LUTHER Rechtsanwaltsgesellschaft mbH, Brandstwiete 3, 20457 Hamburg, Germany, at the e-mail address stockspirits@mhl.de.

When you visit our website, your internet browser automatically sends internet connection data as well as certain telemedia and usage data stored in the internet browser of your device to our servers, where they are processed by us.

When you visit our website, we process the internet connection data that your internet browser automatically transmits to our server. These data comprise your IP address and further usage data (e.g. date and time of access, name of the page accessed, volume of data transferred and the requesting provider). We need this information to enable you to visit our website, for example by adapting the website to the technical requirements of your device. This internet connection data may also constitute personal data. The legal basis for this data processing is our legitimate interest in ensuring the security and usability of our website, Art. 6(1)(f) GDPR.

This website uses cookies. Cookies are small text files that are assigned to the browser you use and stored on the hard drive of the device you use. Cookies cannot run programs or transmit viruses.
When you visit our website for the first time, we display a so-called cookie consent banner to inform you about the tracking technologies we use and to give you the choice of which optional cookies you wish to consent to. You can change your selection at any time in the cookie consent banner on our website (see Section 3.3. for details).
In particular, this website uses technically necessary cookies. They serve to enable you to use our website and to take into account your decision regarding the use of further cookies. They also ensure the security of the website. Without these cookies, certain services cannot be provided. In these cases, access to your device is based on Section 25(2) No. 2 TDDDG. Insofar as this information relates to an identifiable person and is further processed by us, the legal basis for this data processing is our legitimate interest in providing our website and ensuring data security, Art. 6(1)(f) GDPR. If you are already registered on our website and the data processing serves the performance of a contract, the legal basis is Art. 6(1)(b) GDPR.
In addition, we use cookies that are not technically necessary, such as performance cookies, functional cookies and marketing cookies.
Performance cookies allow us to collect statistical information about the use of our website. This enables us, for example, to determine the number of visitors and the effect of certain pages of our website, to optimise our content and to generate overall statistics, e.g. on the number of page views, which areas of the website are viewed most frequently, as well as information on locations and the average length of stay on the website. This allows us to improve the quality of our website and its content. The data generated in this way are used to increase performance and to optimise the website.
Functional cookies allow us to store information about your visit to our website, in particular language settings, time zone or enhanced content.
By using marketing cookies, we can display advertising for our products and services on third-party websites based on your user profile and preferences. These cookies also store data on how many visitors have seen or clicked on our advertising. This allows us, for example, to optimise advertising campaigns.
We only use cookies that are not technically necessary with your consent. By clicking on the relevant button (e.g. “Accept all” or “Accept selection”) in the cookie consent banner or the privacy preference centre, you consent both to the storage of and access to information in these optional cookies (Section 25(1) TDDDG) via our respective website and to the further processing of any personal data read out (Art. 6(1)(a) GDPR).
Further information on the file names, storage period, provider and category of each cookie can be found in the cookie settings of the cookie consent banner.

You may withdraw the consent you have given in the cookie consent banner at any time with effect for the future (Art. 7(3) GDPR). To do so, click on the slider next to the selected cookies in the cookie consent banner on our website. You can access the cookie consent banner by clicking on the lock icon at the bottom right of the website.

We use the web analytics service Google Analytics provided by Google Ireland, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”) to collect, gather and evaluate data about your behaviour on our website. This includes, among other things, data on the website from which you accessed our website, which subpages you accessed, and how often and for how long you viewed a subpage. Your device’s IP address is truncated and anonymised by Google if our website is accessed from a Member State of the European Union or from another Contracting State to the Agreement on the European Economic Area.

We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR. Further information and Google’s applicable privacy provisions can be found at the following links:

https://policies.google.com/privacy?hl=policies&gl=de and https://marketingplatform.google.com/about/analytics/terms/de/.

Within Google, your personal data may be transferred to the parent organisation Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The European Commission has recognised the level of data protection for certain companies in the USA in an adequacy decision (the so-called EU-U.S. Data Privacy Framework). Google LLC has self-certified under this framework and has thereby committed to comply with it. As a result of this self-certification, the transfer of personal data to the USA is permitted on the basis of the so-called EU-U.S. Data Privacy Framework.

The processing of personal data enables us to analyse the browsing behaviour of visitors to our website. By evaluating the data obtained, we are able to compile and optimise information on the use of the individual areas and offers. The legal basis for the processing is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR, which you give when accessing our website by making your selection in our cookie banner.

If you have consented to the use of Google Analytics, you may withdraw your consent at any time and without giving reasons via the cookie consent banner. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). Google Tag Manager is a tag management system that allows us to manage tracking and analytics scripts (so-called tags) via a central interface and to integrate them into our website. When you access our website, Google Tag Manager automatically establishes a connection to Google servers, during which your IP address is transmitted. In addition, Google Tag Manager executes a JavaScript code snippet through which information is stored in your browser.

Within Google, your personal data may be transferred to the parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The European Commission has recognised the level of data protection for certain companies in the USA in an adequacy decision (the so-called EU-U.S. Data Privacy Framework). Google LLC has self-certified under this framework and has thereby committed to comply with it. As a result of this self-certification, the transfer of personal data to the USA is permitted on the basis of the so-called EU-U.S. Data Privacy Framework.

The legal basis for accessing your device and the associated storage of information is your consent pursuant to Section 25(1) TDDDG. The legal basis for the subsequent processing of your IP address is your consent pursuant to Art. 6(1)(a) GDPR. Google Tag Manager is therefore only loaded after you have given your consent via the cookie consent banner. You may withdraw your consent at any time without giving reasons with effect for the future by adjusting your settings in the cookie consent banner on our website. The withdrawal does not affect the lawfulness of the processing carried out before the withdrawal.

Further information on Google Tag Manager can be found at: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.

On our website we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter: “Meta”). The Meta Pixel enables us to analyse the behaviour of visitors to our website and to measure the effectiveness of our advertising on Facebook and Instagram. Usage data such as page views, click paths and interactions are collected and transmitted to Meta.

Your personal data may be transferred by Meta to its parent company Meta Platforms Inc., 1 Meta Way, Menlo Park, CA 94025, USA. The European Commission has recognised the level of data protection for certain companies in the USA in an adequacy decision (the so-called EU-U.S. Data Privacy Framework). Meta Platforms Inc. has self-certified under this framework and has thereby committed to comply with it. As a result of this self-certification, the transfer of personal data to the USA is permitted on the basis of the so-called EU-U.S. Data Privacy Framework.

The legal basis for the processing is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR, which you give when accessing our website by making your selection in our cookie banner. You may withdraw your consent at any time and without giving reasons via the cookie consent banner. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Further information can be found in Meta’s privacy policy: https://www.facebook.com/privacy/policy.

On our website we use the Snapchat Pixel provided by Snap Group Limited, 77 Shaftesbury Avenue, London W1D 5DU, United Kingdom (hereinafter: “Snap”). The Snapchat Pixel enables us to analyse the behaviour of visitors to our website and to measure the effectiveness of our advertising on Snapchat. Usage data such as page views, click paths and interactions are collected and transmitted to Snap.

In connection with the use of the Snapchat Pixel, your personal data may be transferred to Snap Inc., 3000 31st Street, Santa Monica, CA 90405, USA. The European Commission has recognised the level of data protection for certain companies in the USA in an adequacy decision (the so-called EU-U.S. Data Privacy Framework). Snap Inc. has self-certified under this framework and has thereby committed to comply with it. As a result of this self-certification, the transfer of personal data to the USA is permitted on the basis of the so-called EU-U.S. Data Privacy Framework.

The legal basis for the processing is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR, which you give when accessing our website by making your selection in our cookie banner. You may withdraw your consent at any time and without giving reasons via the cookie consent banner. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Further information can be found in Snap’s privacy policy: https://snap.com/de-DE/privacy/privacy-policy.

On our website we use the TikTok Pixel provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (hereinafter: “TikTok”). The TikTok Pixel enables us to analyse the behaviour of visitors to our website and to measure the effectiveness of our advertising on TikTok. Usage data such as page views, click paths and interactions are collected and transmitted to TikTok.

With regard to the collection and transmission of developer and/or event data, as well as measurement and insight reporting (in each case relating to event data) in connection with the TikTok Pixel, we are joint controllers within the meaning of Art. 26 GDPR together with TikTok and TikTok Information Technologies UK Limited, United Kingdom (hereinafter: “TikTok UK”). For all further purposes – in particular the creation of target audiences and ad targeting, the improvement, optimisation and personalisation of advertisements, as well as security, fraud prevention and development purposes – TikTok and TikTok UK process the data as independent controllers. The respective responsibilities are set out in the Jurisdiction Specific Terms (Part B: European Economic Area (EEA), Switzerland and the United Kingdom (UK)) provided by TikTok, available at: https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms.

It has been agreed between us and TikTok (UK) that TikTok (UK) will handle the exercise of your rights under Art. 15 to 20 GDPR with regard to the data stored by TikTok (UK) or processed by TikTok (UK). Should you nevertheless assert your rights regarding the joint processing against us, or should we be contacted by a supervisory authority in this respect, we will forward this to TikTok (UK) without undue delay.

The legal basis for the processing is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR, which you give when accessing our website by making your selection in our cookie banner. You may withdraw your consent at any time and without giving reasons via the cookie consent banner. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Further information can be found in TikTok’s privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de.

Our website is operated by our service provider LOOP New Media GmbH, Siezenheimer Straße 39C, 5020 Salzburg, Austria (hereinafter: “LOOP”). LOOP processes your personal data on our behalf, i.e. exclusively in accordance with our instructions. We have concluded a corresponding data processing agreement with LOOP pursuant to Art. 28 GDPR. Further information on LOOP’s compliance with the provisions of the GDPR can be found here: https://www.agentur-loop.com/privacy-policy.

We process personal data of contact persons of our business partners — including in particular distributors, sales agents and other contractual partners — for the purpose of initiating, performing and handling contractual relationships. In doing so, we process in particular names, business contact details (e-mail address, telephone number, business address), company affiliation and position, bank details and contract-related data (e.g. order quantities, delivery terms, payment terms).

The legal basis for the processing is the establishment, performance and termination of the contractual relationship pursuant to Art. 6(1)(b) GDPR. In addition, we process your personal data on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest consists in properly managing our business relationships, asserting our own claims in or out of court and defending ourselves against unjustified claims. Processing may also take place to comply with statutory retention obligations pursuant to Art. 6(1)(c) GDPR.

Your personal data will be stored for the duration of the existing business relationship and subsequently retained for the period required to comply with statutory retention obligations.

If you contact us by other means (e.g. by e-mail or telephone), we process the personal data required to respond to your enquiries. Depending on the method of contact you choose, these may include your e-mail address, telephone number, your full name and, where applicable, other personal data that you provide to us in connection with your enquiry.

Where the processing of your data serves the performance of a contract or takes place in the context of initiating a contractual relationship, the legal basis for the processing of these personal data is Art. 6(1)(b) GDPR. In addition, we have a legitimate interest in processing your data, as we would otherwise be unable to handle or respond to your enquiry (Art. 6(1)(f) GDPR).

Our website allows you to subscribe to a free e-mail newsletter sent on a regular basis. Through this newsletter, we inform you about our offers and news about our products and services.

To subscribe to our e-mail newsletter, we collect your e-mail address and, where applicable, your first name and surname. We use a double opt-in procedure for subscription. This means that we will only send you e-mail newsletters once you have confirmed your identity via a link that you receive from us by e-mail following your subscription.

We log your subscription and the confirmation of your identity. In doing so, the IP address of your device, your e-mail address and the time of confirmation are stored. This allows us to ensure that you yourself, as the user of the e-mail address provided, have subscribed to our e-mail newsletter service.

The processing of your personal data serves, first, to send the link through which you confirm your identity and, subsequently, to send the e-mail newsletter. The legal basis for the processing is your consent pursuant to Art. 6(1)(a) GDPR.

You may withdraw your consent at any time and without giving reasons. To do so, you can send an e-mail to stockspirits@mhl.de or unsubscribe via the link provided in the newsletter. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The logging of your subscription and the processing of the IP address and the time of subscription prior to confirmation of your identity are based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest consists in enabling you, as a visitor to our website, to subscribe, in being able to demonstrate your subscription and, where necessary, in being able to investigate any possible misuse of your personal data.

On grounds relating to your particular situation, you may object at any time to the processing of data concerning you pursuant to Art. 21 GDPR. If you object, we will no longer process your personal data.

In the event of your withdrawal or objection, we will delete the data we have processed up to that point. This does not apply to data we need in order to demonstrate that you gave us your consent in the past and that we made lawful use of that consent. The processing of such data is then limited to this documentation and evidentiary purpose. Such data are stored on the basis of Art. 6(1)(c) GDPR in conjunction with Art. 5(1)(a), Art. 5(2) and Art. 7(1) GDPR, as well as Art. 6(1)(f) GDPR, for the duration of the applicable standard limitation periods under administrative offence law and civil law or of any separate statutory retention periods (e.g. pursuant to Section 7a of the German Act against Unfair Competition (UWG)).

We operate our own profiles and presences on social media as an additional source of information about our services and news from our company. You can also contact us directly via these social media channels.

On our website we use social media links to these presences. When you visit our website, no personal data are initially transmitted to the providers. This only happens when you click on the link to the respective provider. The provider then receives the information that you have visited our website with your device.

Insofar as personal data are collected by means of our social media links or our presences and forwarded to the respective provider, we are jointly responsible with the respective service provider for these processing operations. The provider of the respective service, however, is solely responsible for any further processing operations. We operate presences on the following social media platforms:

• Facebook and Instagram, provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

If you interact with us via these platforms (e.g. through comments, messages, likes or other activities), your personal data will be processed in accordance with the terms of use and privacy provisions of the respective platform. This applies in particular to publicly visible data in the context of your interaction and, where applicable, to further data that you transmit to us when contacting us or using platform features.

In connection with our social media presences, we receive from the platforms partly anonymised statistical analyses (“Insights”) on page views, post reach, interactions and demographic characteristics. These data help us to analyse and optimise our offering. The processing of your personal data serves our legitimate interests in public relations, promoting communication and analysing usage, Art. 6(1)(f) GDPR.

Please note that, in individual cases, interactions on our social media presences may give rise to joint controllership pursuant to Art. 26 GDPR between us and Meta Platforms, in particular in connection with Facebook and Instagram Page Insights.

The platform providers also process your personal data outside the European Union, in particular in the USA. For Meta, an adequate level of data protection is ensured through self-certification under the EU-U.S. Data Privacy Framework and the use of Standard Contractual Clauses.

Comments, messages or public posts on our profiles generally remain stored until you delete them. Any further processing and the storage period of your other personal data are determined solely by the respective platform operator. Recipients of your data are our employees responsible for social media communication as well as the operators of the respective platform.

Data subjects may exercise their rights of access, rectification, erasure, restriction of processing or objection both against us and directly against the platform provider. As only the respective provider has full access to the user data, we recommend that you primarily exercise your rights directly with the provider. We also offer you support in enforcing your rights.

Information on the purpose and scope of data collection, the processing and use of your personal data and your rights in this respect can be found in the privacy policies of the respective providers:

• Instagram: https://privacycenter.instagram.com/policy

• Facebook: https://www.facebook.com/privacy/policy

In addition, on individual product pages of our website we include a link to offers of our products at Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg (hereinafter: “Amazon”), in order to provide you with information on the availability of our products. When you click on the link, you will be redirected to the Amazon website. Until then, no personal data are transmitted to Amazon. Amazon is solely responsible for data processing on the Amazon website; the relevant privacy notice can be found at

https://www.amazon.de/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ.

As a data subject of the data processing carried out by our company, you are entitled to data protection rights subject to the respective statutory requirements.

• Pursuant to Art. 7(3) sentence 1 GDPR, you have the right to withdraw any consent you have given for the processing of your data at any time, without giving reasons and with effect for the future.
• Pursuant to Art. 15(1) GDPR, you have the right to obtain, upon request, access to the personal data we hold about you.
• In addition, you have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR) with regard to your personal data.
• For data processing based on our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object pursuant to Art. 21 GDPR. If you object to the data processing, it will cease in future, unless we can demonstrate compelling legitimate grounds for further processing which override your interest in the objection.
• If you have provided the processed data yourself, you have the right to data portability pursuant to Art. 20 GDPR.
• You also have the right to lodge a complaint with a competent data protection supervisory authority.

In the aforementioned cases, if you have any questions or wish to lodge a complaint, please contact us by e-mail at stockspirits@mhl.de.

We delete your personal data as soon as their processing is no longer necessary for the purposes explained in this Privacy Policy, where, in the event of your objection pursuant to Art. 21(1) GDPR, no compelling legitimate grounds of our company prevent erasure, or where, in the event of withdrawal of consent, there is no other legal basis for the processing.

Within our company, only those persons who need access to your personal data to fulfil our statutory obligations are granted such access.

We also have certain internal company processes and services carried out by carefully selected service providers engaged in compliance with data protection law. These are, in particular, companies in the field of IT services, which process your data on our instructions on the basis of data processing agreements pursuant to Art. 28 GDPR. We only disclose your data to other third parties if we are legally obliged to do so or if there is another legal basis for doing so.

We may transfer your personal data to recipients in countries outside the European Union (hereinafter “EU”) and the European Economic Area. If the level of data protection there does not correspond to the level of data protection within the EU, or if the recipient of the data does not fall within the scope of an adequacy decision of the European Commission, we ensure appropriate safeguards within the meaning of Art. 46 GDPR. These may include the conclusion of Standard Contractual Clauses of the European Commission and, where necessary, additional measures to ensure an adequate level of data protection. In individual cases, we make the transfer to third countries conditional upon your consent to such data transfer pursuant to Art. 49(1)(a) GDPR.

No automated decision-making, including profiling, takes place (Art. 22 GDPR).

In order to use our website and our services, you must provide the data referred to in Sections 3.1 and 4. Without this data, we are unable to enable you to use our website and/or our specific services.

New legal requirements, business decisions or technical developments may require changes to our Privacy Policy. The Privacy Policy will then be amended accordingly. You can always find the current version at https://www.sierratequila.com/en/privacy-policy/.

Last updated: October 2026