Privacy Policy

1. Controller

B4T Distillers UG (haftungsbeschränkt), Breite Straße 17, 57076 Siegen, Germany, Managing Director: Björn Bach. Phone: +49 176 61078041 · Email: b.bach@hcp-capital.com

We have not appointed a data protection officer, as we are not legally required to do so.

2. Hosting and server log files

Our website is hosted by Lovable (Lovable Labs Incorporated) on infrastructure of Cloudflare, Inc., including content delivery and asset storage (Cloudflare R2). When you visit our website, the servers automatically record log data: IP address, date and time of access, the page requested, referrer URL, browser type and operating system.

This processing is based on Art. 6 (1) (f) GDPR (legitimate interest in the secure, stable operation of the website). Log data is deleted after a short period. Data may be processed on servers outside the EU; the providers are bound by data processing agreements and EU standard contractual clauses (Art. 46 GDPR).

3. Shop and order processing (Shopify)

Our shop and checkout are operated with Shopify (Shopify International Ltd., Dublin, Ireland; parent company Shopify Inc., Canada). When you place an order, the data you enter — name, address, email address, order and payment data — is processed by Shopify on our behalf to handle payment, invoicing and shipping.

The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). Data may be transferred to Canada and the USA. Canada is covered by an adequacy decision of the European Commission; for transfers to the USA, Shopify uses EU standard contractual clauses under Art. 46 (2) (c) GDPR.

4. Payment service providers

Depending on the payment method you select, your payment data is transmitted to the respective provider: Shopify Payments (Stripe Payments Europe Ltd., Ireland), PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), Apple Pay (Apple Distribution International Ltd., Ireland), Google Pay (Google Ireland Ltd., Ireland) and Klarna / instant bank transfer (Klarna Bank AB, Sweden).

The legal basis is Art. 6 (1) (b) GDPR. The providers act as independent controllers for their own payment processing.

5. Newsletter

We only send our newsletter after you have actively consented (Art. 6 (1) (a) GDPR). We store your email address, the time of sign-up and the source of the sign-up in our own database, hosted by Supabase (Supabase Inc.) on EU servers, on the basis of a data processing agreement.

You can withdraw your consent at any time with effect for the future by emailing b.bach@hcp-capital.com; we will then delete your address.

6. Contact forms

Your name, email address and message are stored so that we can answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries and Art. 6 (1) (f) GDPR (legitimate interest in answering you) otherwise. The data is deleted once the enquiry has been dealt with and no statutory retention periods apply.

7. Cookies and local storage

We use technically necessary cookies and browser local storage to run the shop — for example to remember your shopping cart and your age confirmation. These are required for the site to work and are stored on the basis of § 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR. Optional cookies are only set with your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can give or refuse in the cookie notice and withdraw at any time.

8. Social media links

Our website links to our profiles on Instagram (Meta Platforms Ireland Ltd.) and LinkedIn (LinkedIn Ireland Unlimited Company). These are simple links — no data is transmitted to the networks until you click them. Once you are on those platforms, the privacy policies of the respective provider apply.

9. Storage period

We store personal data only as long as necessary for the stated purposes or as required by statutory retention obligations (in particular commercial and tax law, generally 6 to 10 years for order data).

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw consent at any time (Art. 7 (3) GDPR).

Right to object: you have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR).

To exercise these rights, contact us at b.bach@hcp-capital.com.

11. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.