Data protection

The protection of your personal data is important to us. In this Privacy Policy, we inform you about what personal data we process when you visit our website, shop in our online store, and subscribe to our newsletter, for what purposes this is done, and what rights you have. We process your data exclusively on the basis of legal provisions, in particular the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

Contents

Person responsible

Responsible for data processing on this website is:

Hans Tschida KG (Weingut Angerhof-Tschida)
Angergasse 5
7142 Illmitz, Austria
Phone: +43 (0) 2175 / 3150
Email: weingut@angerhof-tschida.at

Further details can be found in the Imprint. For all questions regarding data protection and the exercise of your rights, you can reach us at the email address above.

Legal Bases

We process personal data only if one of the following legal bases applies:

  • Consent (Art. 6 para. 1 lit. a GDPR): You have given us your consent, for example, for the newsletter or for Google Maps. You can withdraw your consent at any time with effect for the future.
  • Contract and pre-contractual measures (Art. 6 para. 1 lit. b GDPR): Processing is necessary for the fulfillment of your order, your customer account, or your inquiry.
  • Legal obligation (Art. 6 para. 1 lit. c GDPR): We are legally obliged to process data, in particular for keeping accounting records.
  • Legitimate interest (Art. 6 para. 1 lit. f GDPR): Processing serves our legitimate interests, such as a secure, fast, and error-free operation of the website, and your interests do not override these.

For storing information on your device and accessing it (e.g., cookies), § 165 para. 3 of the Telecommunications Act 2021 (TKG 2021) also applies: We set technically necessary cookies without consent, all others only with your consent.

Hosting, Server Log Files, and Website Delivery

Hosting and Email

Our website and our email inboxes are operated by Pannonia Hosting (Harald Kaintz and Sebastian Udulutsch) Arbeitsgemeinschaft, Hauptstraße 99, 7111 Parndorf, Austria. The provider processes the data exclusively on our behalf (processor according to Art. 28 GDPR). The servers are located within the European Union.

Server Log Files

Each time our website is accessed, the server automatically stores information transmitted by your browser: IP address, date and time of access, accessed page or file, amount of data transferred, status code, referrer URL (the previously visited page), and browser type and operating system. We need this data to technically provide the website, analyze errors, and ward off attacks. The legal basis is our legitimate interest (Art. 6 para. 1 lit. f GDPR). The log files are deleted after a maximum of 30 days, unless a security incident requires longer retention for clarification.

Accelerated Delivery (FastPixel)

To ensure our pages load quickly, we use the FastPixel service from FASTER WEB SOLUTIONS SRL, Str. Schitu Măgureanu 49, Sector 1, Bucharest, Romania. FastPixel optimizes our pages and delivers images, stylesheets, and scripts via its own network (cdn.fastpixel.io). In addition, a small script from FastPixel (api.fastpixel.io) loads, which records the page view for the operation and evaluation of the service. Your IP address, browser information, and the accessed address are transmitted to FastPixel. According to the provider, the data is processed in the EU (Germany and Romania). FastPixel acts as a processor for us. The legal basis is our legitimate interest in a fast and stable website (Art. 6 para. 1 lit. f GDPR). Further information: fastpixel.io/privacy.

Website Security

This website is protected by SSL/TLS encryption. You can recognize this by “https://” in your browser’s address bar.

To protect against attacks, spam, and abusive registrations, we use security functions that, among other things, log failed login attempts, blocked access, and conspicuous registrations with IP address, time, and accessed address. These logs are stored on our server and are continuously overwritten or deleted after a short period.

Additionally, we use the Wordfence firewall from Defiant, Inc., Seattle, USA. Wordfence runs on our server. To detect and ward off attacks, IP addresses and technical details of suspicious access attempts may be transmitted to Defiant’s servers in the USA. The transmission is based on standard contractual clauses of the EU Commission. Further information: wordfence.com/privacy-policy.

The legal basis for these protective measures is our legitimate interest in the security of our website and the data of our customers (Art. 6 para. 1 lit. f GDPR).

Cookies and Consents

Cookies are small text files that your browser stores on your device. We use technically necessary cookies, without which our website would not function, for example, for the shopping cart and the ordering process (WooCommerce), for logging into the customer account, for the selected language (WPML), and to save your cookie selection. We set these cookies based on our legitimate interest or for the fulfillment of the contract (Art. 6 para. 1 lit. b and f GDPR).

Content that transfers data to third parties and requires consent (currently Google Maps) is only loaded after you have agreed via our cookie banner (Art. 6 para. 1 lit. a GDPR). For managing consents, we use the WordPress plugin Complianz, which runs on our own server. Your selection is stored in a cookie; as proof, we store your consent with a shortened (anonymized) IP address in our database.

You can change or withdraw your selection at any time via the button for managing consents or in our Cookie Policy. There you will also find an overview of the cookies used. You can also delete or block cookies in your browser; however, not all functions of our shop may work then.

Visitor Statistics

To understand how our website is used, we use the Burst Statistics plugin. Burst runs entirely on our own server, does not set cookies, and does not pass any data to third parties. Anonymized data such as pages visited, dwell time, origin page, device type, and browser are collected, without us being able to personally identify you. The legal basis is our legitimate interest in improving our offer (Art. 6 para. 1 lit. f GDPR).

Fonts (Adobe Fonts)

For a consistent display, we use fonts from Adobe Fonts, a service of Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. When a page is accessed, your browser loads the fonts from Adobe’s servers. Your IP address is transmitted to Adobe so that the fonts can be delivered. According to Adobe, the IP address is not stored and no cookies are set. Adobe collects information such as our website’s domain, the fonts delivered, and the project ID to settle licenses with font manufacturers. A transfer to Adobe Inc. in the USA cannot be ruled out; Adobe is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in a uniform and appealing presentation of our website (Art. 6 para. 1 lit. f GDPR). Further information: Privacy notices for Adobe Fonts.

Google Maps

On our contact page, we embed a map from Google Maps, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded after you have agreed to it via our cookie banner (Art. 6 para. 1 lit. a GDPR). When loading, your IP address and information about your browser are transmitted to Google; Google may set cookies in the process. A transfer to Google LLC in the USA is possible; Google is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time via the cookie settings. Further information: policies.google.com/privacy.

Online Shop and Customer Account

Orders

When you place an order in our shop, we process the data required for its fulfillment: first and last name, billing and delivery address, email address, phone number (if provided), the products ordered, prices, the chosen payment and shipping method, and your messages to us. We use this data to fulfill the purchase contract, send you order confirmations and invoices, deliver the goods, process payments, and handle inquiries, cancellations, and warranty cases. The legal basis is contract fulfillment (Art. 6 para. 1 lit. b GDPR) and our legal obligation to retain data (Art. 6 para. 1 lit. c GDPR). Mandatory fields are marked in the order form; without this information, we cannot process the order.

For delivery, we pass on the name, delivery address, and, if applicable, phone number or email address to the commissioned transport company, insofar as this is necessary for delivery and notification.

Customer Account

You can voluntarily create a customer account. There we store your email address, your password (encrypted only), your address data, and your previous orders, so that you can order faster in the future and view your orders (Art. 6 para. 1 lit. b GDPR). You can request the deletion of your account at any time by email. Data that we must retain for tax or commercial law reasons will be blocked until the end of the retention period and then deleted.

Revocation

If you cancel a contract via our cancellation form, we process the data provided there (order number, name, email address, order date, and your comments) to process the cancellation (Art. 6 para. 1 lit. b and c GDPR).

Retention

We retain order and invoice data for the duration of the statutory retention period; according to § 132 of the Federal Tax Code (BAO), this is usually seven years. After that, they are deleted or, if deletion is not yet possible, their processing is restricted.

Payment service provider

We work with the following payment service providers to process payments. Depending on the chosen payment method, we transmit the data required for payment (in particular name, address, email address, order number, and amount) to the respective provider. You enter your card or account details directly with the payment service provider; we do not receive them. The payment service providers also process the data on their own responsibility, for example, for fraud prevention and identity verification, and may collect technical information about your device for this purpose. Scripts from the providers are loaded on pages with payment functions, especially the shopping cart and checkout. The legal basis is contract fulfillment (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in secure payment processing (Art. 6 para. 1 lit. f GDPR).

  • Credit and debit card, EPS transfer: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. A transfer to Stripe, Inc. in the USA is possible; Stripe is certified under the EU-US Data Privacy Framework. For EPS, you will be redirected to your bank’s online banking. Privacy Policy: stripe.com/at/privacy
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Privacy Policy: paypal.com/at/webapps/mpp/ua/privacy-full

Newsletter

If you subscribe to our newsletter, we will inform you by email about new wines, offers, and news from the winery. Your email address is mandatory; first and last name are voluntary and serve for personal address. Registration is possible via our registration form, when registering a customer account, or when placing an order (checkbox, not set by default).

We use the double opt-in procedure: After registration, you will receive an email with a confirmation link. Only after confirmation will you be added to the mailing list. To prove your registration, we store the time of registration and confirmation, as well as your IP address. From the IP address, we also determine the country from which the registration was made.

For the newsletter, we use the WordPress plugin “Newsletter”, which runs on our own server. The emails are sent via our hosting provider’s mail server; an external newsletter service is not involved. To improve our newsletter, we evaluate whether a newsletter has been opened and which links in it have been clicked. For this purpose, the newsletter contains a small invisible image and links that are redirected via our server; the evaluation is assigned to your email address.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR, § 174 TKG 2021). You can unsubscribe from the newsletter at any time via the unsubscribe link in each email or by sending us a message. After unsubscribing, we delete your data from the mailing list; we retain proof of earlier consent for as long as we need it to defend against claims (Art. 6 para. 1 lit. f GDPR).

Contact us

If you contact us by email or phone, we process your information (e.g., name, email address, phone number, and the content of your inquiry) to answer your request. The legal basis is the initiation or fulfillment of a contract (Art. 6 para. 1 lit. b GDPR) or our legitimate interest in answering your inquiry (Art. 6 para. 1 lit. f GDPR). We delete the data as soon as the inquiry is resolved and no legal retention obligations exist.

Emails automatically sent by our website (e.g., order confirmations or newsletter confirmations) are sent via our hosting provider’s mail server.

Recipients and Transfers to Third Countries

We only pass on your data if this is described in this Privacy Policy, you have consented, or we are legally obliged to do so. Recipients include in particular our processors (hosting, website delivery), payment service providers, transport companies, and, where legally required, authorities and our tax advisors. Contracts according to Art. 28 GDPR exist with our processors.

A transfer to countries outside the European Union or the European Economic Area (in particular to the USA) may occur with the aforementioned services from Adobe, Google, Stripe, PayPal, and Defiant (Wordfence). This only happens if an adequate level of data protection exists, for example, on the basis of an adequacy decision by the EU Commission (EU-US Data Privacy Framework) or standard contractual clauses (Art. 45 and 46 GDPR).

Storage Period

We store personal data only for as long as necessary for the respective purpose or as long as legal retention obligations exist. The specific periods can be found in the individual sections. After that, the data is deleted or, if deletion is not yet possible, its processing is restricted.

Your Rights

You have the following rights under the GDPR:

  • Right to information about the data we process (Art. 15 GDPR)
  • Right to rectification of inaccurate data (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing based on our legitimate interest (Art. 21 GDPR)
  • Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7 para. 3 GDPR)

Simply contact weingut@angerhof-tschida.at. If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Changes to this Privacy Policy

We adapt this Privacy Policy if our website, our services, or the legal situation changes. The version published here applies in each case.

Status: November 2026