Privacy Policy

Data controller:
ÖMA Beer GmbH, Ökologische Molkereien Allgäu, Am Mühlbach

2
, D-88161 Lindenberg / Allgäu,
Tel.: +49 (0) 8381 8890 100
, Email: info@oema.de

External Data Protection Officer:
DDSK GmbH
, Michael Heitele
, Tel.: +49 (0)7542 949 21-01
, Email: datenschutz@oema.de

Our website can be visited without users actively providing any personal details. However, each time the website is accessed, we automatically store access data (server log files) such as the name of the internet service provider, the operating system used, the website from which the user visits us, the date and duration of the visit, or the name of the file requested; and, for security reasons—for example, to detect attacks on our website—the IP address of the device used for a period of 7 days. This data is analysed solely for the purpose of improving our service and does not allow any conclusions to be drawn about the identity of the user. This data is not merged with other data sources.
We process and use the data for the following purposes: providing the website, improving our websites, and preventing and detecting errors, malfunctions and misuse of the website.

Legal basis:
legitimate interest, in accordance with Article 6(1)(f) of the GDPR
. Legitimate interests:
ensuring the functionality and error-free and secure operation of the website, and adapting this website to users’ requirements.

To make visiting our website an enjoyable experience and to enable the use of certain functions, we use so-called cookies on our website. The use of cookies serves our legitimate interest in making your visit to our website as pleasant as possible and is based on Article 6(1)(f) of the GDPR. Cookies are a standard web technology used to store and retrieve login and other usage information for all users of the website. Cookies are small text files that are stored on the user’s device. They enable us, among other things, to save user settings so that our website can be displayed in a format tailored to the user’s device. Some cookies are deleted at the end of the browsing session (session cookies).
You can configure your browser to be notified when cookies are set and to decide on a case-by-case basis whether to accept them, or to block cookies in specific cases or generally. You can also delete cookies retroactively to remove data the site has stored on your device. Disabling cookies (opting out) may result in some restrictions on the functionality of our website.

Categories of data subjects: website
visitors, users of online services

. Opt-out: Internet Explorer:
https://support.microsoft.com/de-de/help/17442
Firefox:
https://support.mozilla.org/de/kb/wie-verhindere-ich-dass-websites-mich-verfolgen
Google Chrome:
https://support.google.com/chrome/answer/95647?hl=en
Safari
: https://support.apple.com/en-us/HT201265

Legal basis:
Consent (Article 6(1)(a) of the GDPR); legitimate interests (Article 6(1)(f) of the GDPR)
. The relevant legal basis is specified for each tool.

Our legitimate interests include
storing opt-in preferences, displaying the website, ensuring its functionality, maintaining user status across the entire site, recognising users on subsequent visits, and delivering a user-friendly online experience.

Our online service is hosted by an external service provider. Personal data relating to visitors to our online service, in particular so-called log files, is stored on our service provider’s servers. This may also include data generated or collected during the active use of our online service. By using a specialised service provider, we are able to provide our online service securely and efficiently. The hosting provider we use does not process the data for its own purposes.

Categories of data subjects:
Website visitors

Categories of data:
User data (e.g., web pages visited, interest in content, access times), meta and communication data (e.g., device information, IP addresses)

Purposes of processing:
To deliver and optimise our online services

. Legal basis:
Legitimate interests (Article 6(1)(f) of the GDPR)

. Legitimate interests:
Ensuring proper presentation and optimisation of the website, faster access, avoidance of downtime, and high scalability.

Our website incorporates functions and elements sourced from third-party providers. These include, for example, videos, images, buttons, fonts, map services (Maps) or posts (hereinafter referred to as ‘content’). When website visitors access this third-party content (e.g. by clicking, ‘Play’, etc.), information and data are collected and linked to the website visitor’s device via cookies or other technologies (e.g. pixels, JavaScript commands or WebAssembly), and transmitted to the server of the relevant third-party provider. Without this processing,
it is not possible to load and display this third-party content.
To protect your personal data, we have implemented safeguards that prevent its automatic transmission to the third-party provider. Data is only sent when you actively click the buttons or interact with the third-party content.

Data categories: Usage data
(e.g. webpages visited, interests, time of access), meta and communication data (e.g. device information, anonymised IP address)
Purposes of processing:          
Sharing posts and content, improving the website’s presentation, adapting content and layout to visitors’ devices. Legal
basis: legitimate
interests (Article 6(1)(f) of the GDPR)

.

We maintain an online presence on social media platforms and career sites in order to exchange information with registered users and make it easy to get in touch.
In some cases, user data from social media platforms is used to conduct market research and, consequently, for advertising purposes. User profiles may be created based on users’ behaviour – such as the interests they specify – and used to tailor adverts to the interests of target groups. To this end, cookies are regularly stored on users’ devices, in some cases regardless of whether they are registered users of the social network.
In connection with the use of social media, we also use the associated messaging services to communicate easily with users. Please note that the security of individual services may depend on the user’s account settings. Even in the case of end-to-end encryption, the service provider may be able to determine whether and when users are communicating with us and, where applicable, collect location data.
Depending on where the social network is operated, user data may be processed outside the European Union or the European Economic Area, which may entail risks for users, such as making it more difficult to enforce their rights.

On our website, users can subscribe to our newsletter or other notifications via various channels (hereinafter referred to as “newsletters”). In accordance with legal provisions, we only send newsletters to recipients who have consented to receiving them. We use a trusted service provider to send out our newsletter.
To subscribe, you must provide an email address; we may also collect additional data, such as your name, to personalise future messages.
Our newsletter is only sent once the so-called double opt-in procedure has been completed. If visitors to our website choose to subscribe to our newsletter, they will receive a confirmation email, which serves to prevent the misuse of false email addresses and to ensure that the triggers the dispatch of the newsletter. You may cancel your subscription to our newsletter at any time with future effect. An unsubscribe link (opt-out link) is included at the end of every newsletter.
Furthermore, we are obliged to provide evidence that our subscribers actually wished to receive the newsletter. To this end, we collect and store the IP address as well as the time of subscription and unsubscription.
Our newsletters are designed in such a way that we can gain insights into improvements, target groups or the reading behaviour of our subscribers. This is made possible by a so-called web beacon or tracking pixel, which responds to interactions with the newsletter—for example, whether links are clicked, whether the newsletter is opened at all, or at what time the newsletter is read. For technical reasons, we are able to link this information to individual subscribers.

Categories of data subjects:
newsletter subscribers

Categories of data:
Master data (e.g., name, address), contact details (e.g., email address, telephone number), meta and communication data (e.g., device information, IP address), usage data (e.g., interests, access times)

Purposes of processing:
Marketing, customer retention and new customer acquisition, analysis and evaluation of the campaign’s

success. Legal basis:
Consent (Article 6(1)(a) of the GDPR).

On our website, you can contact us directly or find information about other ways to get in touch.
When you contact us, we process the data of the enquirer to the extent necessary to respond to or process the enquiry. The data processed may vary depending on the method used to contact us.

Categories of data subjects

:
Enquirers Categories of data: Master
data (e.g. name, address), contact details (e.g. email address, telephone number), content data (e.g. text entries, photographs, videos), usage data (e.g. interests, access times), meta and communication data (e.g. device information, IP address).

Purpose of processing:
Handling inquiries

. Legal bases:
Consent (Art. 6(1)(a) GDPR) and performance of a contract or steps prior to entering into a contract (Art. 6(1)(b) GDPR).

We provide our customers with an order list to purchase our products. To this end, we collect the contact details of the customer’s representative required for the initiation and fulfilment of the contract.
Where necessary, we share this information with third-party service providers who help us fulfil orders, or when we are legally required to do so.

Categories of data subjects: Our customers’


contact persons Categories of data: Master
data (e.g. name, address), contact details (e.g. email address, telephone number), metadata and communication data (e.g. timestamps, IP addresses),

Purposes of processing:
Initiation and performance

of a contract. Legal bases:
Legitimate interests (Article 6(1)(f) of the GDPR)
. Legitimate interests: Simplification of work processes, communication in the context of order processing, resource-efficient fulfilment.

On our website, visitors can register for digital events. The information we collect, which is necessary for the initiation and fulfilment of a contract, is marked as mandatory. The provision of any additional data is voluntary.
Depending on the nature and scope of the event, we may involve external partners during registration or during the event itself; these partners may take over further organisational tasks (e.g. compiling participant lists, sending invoices or items forming part of the promotion) or run the events themselves.
Where we engage external partners, they will receive the registration data, as necessary, for further processing or for the fulfilment of the contract with the data subjects. Personal data will be deleted once the event has ended or once the contractual obligations have been fulfilled.

The partners involved in connection with the events are:
Recipient: Peter Riegel Weinimport GmbH, Steinäcker 12, 78359 Orsingen-Nenzingen
Recipient: Neumarkter Lammsbräu, Gebr. Ehrnsperger KG, Amberger Str. 1, 92318 Neumarkt

Categories of data subjects: Participants, prospective customers
Data categories: Master data (e.g., name, address), contact details (e.g., email address, telephone number), transaction data (invoices, payment history), contractual data (e.g., subject matter of the contract, term)
Purposes of processing: Pre-contractual arrangements and performance
of the contract. Legal bases: Pre-contractual arrangements and performance of the contract (Article 6(1)(b) of the GDPR), consent (Article 6(1)(a) of the GDPR).

We do not transfer any personal data of visitors to our online services.
We may need to share personal data to fulfil contracts or meet legal obligations; if the required information is not provided, we may not be able to complete the contract.
No data is transferred to a third country.

We retain visitor data for as long as necessary to deliver our services or as required by European directives and regulations, or by other laws and regulations to which we are subject. In all other cases, we delete personal data once the purpose for which it was collected has been fulfilled, with the exception of data that we are required to retain to comply with legal obligations (for example, due to retention periods under tax and commercial law, we are obliged to retain documents such as contracts and invoices for a certain period).

ÖMA Beer GmbH does not use automated decision-making or profiling.

Our data-processing activities are primarily governed by the GDPR, supplemented as necessary by national laws of EU member states.

Consent:
Article 6(1)(a) of the GDPR serves as the legal basis for processing operations for which we have obtained consent for a specific processing purpose.
Performance of a contract:
Article 6(1)(b) of the GDPR serves as the legal basis for processing operations necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request.
Legal obligation:
Article 6(1)(c) of the GDPR serves as the legal basis for processing operations necessary for compliance with a legal obligation.

Article 6(1)(d) of the GDPR serves as the legal basis where processing is necessary to protect the vital interests of the data subject or of another natural person.
Public interest:
Article 6(1)(e) of the GDPR serves as the legal basis for processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Legitimate interests:
Article 6(1)(f) of the GDPR serves as the legal basis for processing necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data take precedence, in particular where the data subject is a child.

Right of access:
Data subjects have the right, in accordance with Article 15 of the GDPR, to request confirmation as to whether we are processing data relating to them. They may request access to this data, as well as the further information listed in Article 15(1) of the GDPR, and a copy of their data.

Right to rectification:
You have the right, in accordance with Article 16 of the GDPR, to request the rectification or completion of personal data processed by us.

Right to erasure:
You have the right, in accordance with Article 17 of the GDPR, to request the immediate erasure of your personal data. Alternatively, you may request that we restrict the processing of your data in accordance with Article 18 of the GDPR.

Right to data portability:
You have the right, in accordance with Article 20 of the GDPR, to request that the data you have provided to us be made available to you and to request that it be transferred to another controller.

Right to lodge a complaint:
You also have the right to lodge a complaint with the supervisory authority responsible for you in accordance with Article 77 of the GDPR.

Right to object:
Where personal data is processed on the basis of legitimate interests pursuant to Article 6(1), first sentence, point (f) If your personal information is processed based on legitimate interests under Article 6(1)(f) of the GDPR, you have the right to object to that processing under Article 21 of the GDPR, either because of your particular situation or because the processing is for direct marketing. In the latter case, you have a general right to object, and we will honour it without requiring you to specify a particular situation.

Some data processing activities require your explicit consent. You may withdraw any consent you have given at any time by sending us a brief message or emailing datenschutz@oema.de. The lawfulness of any data processing carried out up to the point of withdrawal remains unaffected by the withdrawal.

Our website contains links to the online offerings of other providers. We hereby point out that we have no influence over the content of the linked online offerings or over the providers’ compliance with data protection regulations.

We reserve the right to amend this privacy notice at any time in the event of changes to our online offering and in accordance with applicable data protection regulations, to ensure that it complies with legal requirements.