Privacy Notice

1. Controller

The controller responsible for processing personal data through this website is:

Email: service@whiskyauction.com
Online contact: Contact form
Phone: +49 4331 56564

2. Visiting this website

When you access the website, our systems may process technical information required to deliver and protect it. This may include your IP address, the date and time of access, the requested page, referrer information, browser and device information, and technical status data.

This processing is necessary to provide a secure and reliable website. It is based on our legitimate interests in operating, securing and improving the service (Article 6(1)(f) GDPR).

Essential session data

The contact form uses an essential session to protect submissions against forgery and automated misuse. The session identifier is required for this security function and is not used for advertising or cross-site tracking.

3. Contact enquiries

When you submit an enquiry, we process the information you provide, including:

• your name and email address;
• your phone number and organization, if provided;
• the enquiry category, collection or item details, and your message;
• the page or collection connected with your enquiry, where applicable;
• a pseudonymized hash of your IP address, browser information and submission timestamps for security and rate limiting;
• the status and timestamps of the email-confirmation process.

We use this information to verify your email address, review and respond to your request, maintain the security of the form, and document our correspondence. The confirmation link expires after 24 hours.

Where your enquiry concerns a possible contract, processing is based on steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). For general enquiries, it is based on our legitimate interest in responding to communications concerning the Collections Registry (Article 6(1)(f) GDPR).

Required fields are necessary for us to receive and answer your enquiry. Without them, we cannot process the request. The checkbox in the form confirms that you have read this notice; it is not consent to advertising or unrelated use of your information.

4. Bot protection with CaptchaFox

We use CaptchaFox, provided by Scoria Labs GmbH, Germany, to distinguish legitimate submissions from automated abuse. For this purpose, CaptchaFox processes the IP address and technical and usage signals required to assess the request. According to the provider, identifying data is anonymized as early as possible, the service does not set cookies or create advertising profiles, and processing takes place in the European Union.

The legal basis is our legitimate interest in protecting the website and contact form against spam and misuse (Article 6(1)(f) GDPR). CaptchaFox acts as our processor. Further information is available in the CaptchaFox privacy information.

5. Recipients and service providers

Access to enquiry information is limited to authorized staff and service providers who need it to operate the website, host its systems, deliver email or provide bot protection. Service providers process personal data only for the relevant service and, where required, under data-processing agreements.

We do not sell personal data. We disclose information to other recipients only where this is necessary to handle your request, required by law, or necessary to establish, exercise or defend legal claims.

6. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected. Enquiry records are kept while the request is being handled and thereafter where required for follow-up, accountability, the establishment or defence of legal claims, or statutory retention obligations. When those purposes no longer apply, the information is deleted or anonymized.

Security and server-log information is retained only for the period needed to investigate operational or security incidents, unless a longer period is required in a specific case. The criteria used are the nature of the request, whether a business relationship results, applicable limitation periods and statutory record-keeping requirements.

7. Your rights

Subject to the conditions of applicable law, you may have the right to:

• request access to your personal data (Article 15 GDPR);
• request correction of inaccurate data (Article 16 GDPR);
• request erasure or restriction of processing (Articles 17 and 18 GDPR);
• receive data you provided in a portable format (Article 20 GDPR);
• object to processing based on legitimate interests (Article 21 GDPR).

To exercise these rights, please use our confidential contact form. You also have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for organizations established in Schleswig-Holstein is the Independent Centre for Privacy Protection Schleswig-Holstein (ULD).

8. Changes to this notice

We may update this notice when our services, processing activities or legal requirements change. The current version is always available on this page.