Transparency about your data.

Email: hallo@champagnermax.at

The website is provided through Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Access may involve processing, in particular, IP address, date and time, requested URL, referrer, browser and user-agent information, device and connection information, and technical request and error information. This serves website delivery and stability, error analysis, and protection against misuse and security risks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and functional operation of the webshop.

Technical runtime and error logs may be created. Champagner Max uses these only for operations, security and error analysis. Technical log data are retained within the operational and diagnostic periods provided by Vercel for the plan used and are not used by Champagner Max for advertising or profiling.

Vercel operates a global infrastructure and uses subprocessors. Data may therefore also be processed outside the European Union or European Economic Area, particularly in the USA. Vercel provides appropriate safeguards for international transfers, such as EU standard contractual clauses. Further information is available in Vercel’s privacy policy and data processing agreements.

The shop uses the Shopify Storefront API to provide navigation, products, prices, availability and product images, and to create and update Shopify baskets. Depending on the function, requests are made through the application server or directly in the browser. The browser also loads product images from Shopify’s image service. For direct connections, Shopify receives in particular the browser’s IP address and connection data, and the requested product and basket information.

The ordering process involving payment takes place in the Shopify checkout. The data entered for ordering, delivery and payment are processed there, in particular contact, billing, delivery, order and payment data. Processing is for steps prior to entering into a contract and contract performance under Article 6(1)(b) GDPR and, where legally required business records are concerned, under Article 6(1)(c) GDPR.

For baskets containing alcoholic products, confirmation of a minimum age of 16 is required before proceeding to checkout. The date of birth entered is processed only temporarily and locally in the browser. The full date of birth, year of birth and calculated age are not stored permanently, transmitted to Shopify or analytics services, or recorded in logs, URLs, localStorage or sessionStorage. The only age confirmation sent to the Shopify basket is the attribute age_verification with the value 16_plus_confirmed . Baskets containing only Zalto glasses do not require age confirmation. No official identity check is carried out.

Shopify International Limited in Ireland processes European customers’ data for the Shopify platform. Shopify may involve other group companies and subprocessors and process data outside the European Economic Area. Shopify identifies adequacy decisions, binding corporate rules and standard contractual clauses as appropriate safeguards for this.

Further information is available in the Shopify privacy policy.

In the B2B shop, we associate the basket with the signed-in customer and their authorised company location. For this purpose, we check customer and company-contact identifiers and transmit the location identifier and an access token to Shopify. Server-side B2B basket requests also forward the buyer IP address supplied by the hosting infrastructure to Shopify. For signed-in private customers, the transition to checkout may reuse an existing Shopify sign-in; account affiliation and address data are first retrieved through our account interface to check eligibility. The Shopify sign-in and our local account session are separate sessions.

Depending on the payment method selected in the Shopify checkout, the data required for payment processing are processed by Shopify and the payment provider offered there. The provider selected is displayed in the checkout. The data required depend on the payment method chosen. Champagner Max does not receive the full login credentials for your bank or payment account.

Recipients are payment service providers; the legal basis is Article 6(1)(b) GDPR. The relevant payment service’s privacy information applies to additional statutory or regulatory checks and fraud-prevention measures.

To deliver ordered goods, we transmit the necessary data to the delivery provider engaged. These include name, delivery address, necessary consignment and delivery information and, where required for delivery, email address and/or telephone number. Recipients are shipping and logistics providers. Processing serves contract performance and delivery under Article 6(1)(b) GDPR.

To retain your selection in the private-customer basket between page visits, the website uses the browser’s local storage (localStorage) under the key champagner-max-cart. Stored data include selected products and variants with quantities, product information and image URLs, availability information, and the product-specific indication of whether age confirmation is required. The Shopify basket ID, checkout address, prices and totals, total quantity, and a technical status for an uncertain basket-creation outcome are also stored. Date of birth and personal age confirmation are not part of these locally stored data.

The website sets no expiry period for this local entry. It is updated when the basket changes; a reset basket may remain stored as an empty record. If synchronisation identifies that a Shopify basket no longer exists, the local basket state is reset. You can delete the local entry through your browser’s website data settings; this removes the selection saved on that device.

Storage is technically necessary for the basket function you request and is not used for advertising or audience measurement. The legal basis for subsequent processing is Article 6(1)(b) GDPR.

The B2B basket is processed separately. In Upstash (Redis), we store the Shopify basket ID, a hashed association with the session, customer and company location, a hash of the access token, and technical version, time and processing information on the server for secure synchronisation. B2B basket contents are held in browser memory only while the view is open, rather than in local basket storage. The server-side association expires no later than the absolute session limit of 12 hours. It can no longer be used after sign-out or session expiry, but may remain in Redis until that limit. This does not delete the Shopify basket or order records held by Shopify.

The Cormorant Garamond and Inter fonts are delivered as files stored locally on this web server. Loading the fonts does not establish a connection to Google Fonts or transmit data to Google.

The contact form does not send form data to a web server. Your entries are assembled exclusively in the browser into a prepared email; only when you send it in your email application are the message and your contact details transmitted to Champagner Max through the email providers involved.

For our hallo@champagnermax.at mailbox, we use A1 Telekom Austria AG, Lassallestraße 9, 1020 Vienna, Austria, as email provider. Email processing includes in particular your email address, name if supplied, message content, attachments, other voluntary information and technical email metadata.

This serves to answer enquiries, communicate, initiate and perform contracts and, where relevant, document business communications. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual enquiries; otherwise Article 6(1)(f) GDPR, with a legitimate interest in handling business communications. We retain the data only as long as necessary for the enquiry, contract, legal obligations or legal claims. Further information is available in the A1 privacy information.

The webshop itself does not incorporate advertising or audience-measurement services. Technically necessary local basket storage is described in section 6. Scroll positions and associated navigation identifiers are also stored temporarily in the browser’s session storage (sessionStorage) so that the previous page position can be restored when navigating back. These data are not used for advertising or profiling and remain local to the browser session. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is user-friendly navigation.

When you use the enabled customer-account or B2B functions, sign-in takes place through Shopify Customer Accounts using OpenID Connect. We process your customer identifier, name, email address, saved addresses, order items, amounts, payment and fulfilment status, and billing and shipping addresses to display your account and orders. Personal address management transmits your name, address and any supplied telephone number to Shopify. In the B2B area, we also check company contacts, company and location details, roles and permissions so that only authorised people can access the relevant company location and its orders.

For sign-in, we set the __Host-cm_login cookie with a maximum lifetime of 10 minutes; it is deleted when the sign-in callback completes or fails. After successful sign-in, we set __Host-cm_session with a maximum lifetime of 12 hours. Both cookies contain random technical identifiers and are restricted to this website (Path=/, no Domain attribute, Secure, HttpOnly, SameSite=Lax). They securely associate the sign-in and session and are not used for advertising or audience measurement. Account functions cannot be used without these cookies.

We store the associated sign-in and session data on the server in Upstash (Redis). These include technical sign-in verification values, customer and identity identifiers, access, refresh and identity tokens, timestamps, a value protecting against forged requests and, where applicable, the selected company location. These tokens are not stored in the session cookie. Sign-in transactions are valid for no more than 10 minutes and are consumed once during the callback. Server sessions expire after 30 minutes without a request that extends the session, and no later than 12 hours after creation; successful local sign-out deletes the server session and both cookies. Any remaining Shopify session is separate.

Upstash provides the technical storage for these functions. Short-lived request counters and lock identifiers are also processed there to prevent abuse and coordinate concurrent requests. In the implemented process, request counters expire after 5 minutes and refresh and address locks after no more than 30 seconds. The B2B processing lock lasts no more than 2 minutes; its associated status data are subject to the period described in section 6. These technical limits are not retention periods for customer accounts, orders, provider logs or backups.

The Redis service is provided by Upstash, Inc. Under its data processing agreement, data may be processed worldwide, including in the USA. The agreement provides, in particular, for standard contractual clauses for restricted international transfers. Further information is available in the Upstash data processing agreement.

Processing for your personal customer account and orders serves pre-contractual steps and contract performance under Article 6(1)(b) GDPR. For business customers’ contact persons, permission checks and abuse prevention, we rely on Article 6(1)(f) GDPR; our legitimate interest is the secure administration of the business relationship and protection against unauthorised access. The technically necessary sign-in and session cookies serve the account access you request (section 165(3) of the Austrian Telecommunications Act 2021).

Hosting infrastructure and integrated Shopify services may use technical storage or cookies. In the separate Shopify checkout, Shopify and the selected payment provider in particular may use cookies or similar technologies. The privacy and cookie information provided there applies.

For your privacy preferences, the website loads Shopify’s privacy dialogue from Shopify’s servers. Shopify receives, in particular, your IP address and connection data. Existing decisions about analytics, marketing, preferences and sale of data are read through Shopify’s Customer Privacy API and passed to Shopify when requesting the checkout URL for B2C and B2B. Shopify handles storage of these decisions; our application code does not create an additional local entry for them. You can reopen the dialogue through “Cookie settings” in the footer. The mere availability of the dialogue is not treated as consent.

We retain account profiles and saved addresses for as long as they are necessary for the existing customer relationship or other legitimate processing purposes.

You can request erasure of your personal data using the contact details in section 1. The shop operator initially handles these requests manually using the designated functions in the Shopify admin. We separately consider other affected data recipients where necessary.

Erasing personal data is different from completely removing a Shopify customer profile. Legally required invoice and order records remain subject to their own retention obligations independently of this.

We generally retain orders, invoices, payment and business records relevant for tax or business law, and corresponding business correspondence, for seven years under Austrian statutory retention obligations. The period is calculated in accordance with the applicable statutory rules. Longer retention takes place only where documents are required for ongoing proceedings or to establish or defend legal claims. The legal basis for statutory retention obligations is Article 6(1)(c) GDPR, and for protecting legal claims Article 6(1)(f) GDPR.

Contact enquiries without further retention obligations are deleted once their purpose has been fulfilled and no legal or evidential obligations remain. The periods and criteria described above apply to basket data, sign-in and session data, technical security storage and hosting data. Expiry of a technical session does not delete the customer account or business records subject to statutory retention. Where Shopify or other recipients act as independent controllers, additional statutory retention obligations of their own may apply.

Under the GDPR, you have, in particular, rights of access, rectification, erasure, restriction of processing, data portability and objection, subject to its provisions. Where processing is based on consent, consent may be withdrawn for the future. To exercise your rights, write to hallo@champagnermax.at.

You also have the right to complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.