Brew Tradition

Our Beer Specialities

News

Gallery

Fans and More

Privacy statement

1. Data protection at a glance

General information
The following information gives a simple overview of what happens to your personal data when you visit our website. Personal data is all data that allows you to be identified as a person. You will find detailed information on the topic of data protection from our privacy statement that follows this text.

Data collection on our website
Who is responsible for data collection on this website?
Data processing on this website is done by the website operator. The website operator’s contact details can be found in the legal information and credits for the website.

How do we collect your data?
Some of your data is collected when you share it with us. This can be data that you enter into a contact form, for example.
Other data is automatically collected by our IT systems when you visit our website. This data is mainly technical data (e.g. internet browser, operating system or time the page was retrieved). This data is collected automatically, as soon as you visit our website.

What do we use your data for (purpose of processing)?
- Error-free provision of the online presence, its content and functions.
- Provision of contractual services, service and customer care.
- Responding to contact enquiries and communication with users.
- Marketing, advertising and market research.
- Security precautions

What are your rights in relation to your data?
You always have the right to free information about the origin, recipients and purpose of the personal data saved about you. You also have the right to request correction, blocking or deletion of this data. If you have any questions about this or any other questions about data protection and privacy, you can contact us at any time, at the address given in the legal information about the website. You furthermore have the right to complain to the competent regulatory body.

Analysis tools and tools from third-party providers
Your surfing behaviour can be statistically analysed and evaluated when you visit our website. This is mainly done with cookies and what are known as analysis programs. Your surfing behaviour is normally analysed anonymously. It is not possible to trace the surfing behaviour back to you. You can opt-out of this analysis or prevent it by not using certain tools. You can find more detailed information in the privacy statement below.
You can opt-out of this analysis. We will provide you with information about your opt-out options in this privacy statement.

2. General information and compulsory information

Note on the data controller
The data controller for this website is:
Kulmbacher Brauerei Aktien-Gesellschaft
Lichtenfelser Straße 9
95326 Kulmbach

Contact
Tel.: +49 (0) 9221 / 705-0
Fax: +49 (0) 9221 / 705-292
Email: info@kulmbacher.de

Legal representatives/board of directors
Markus Stodden - Chair of Marketing and Sales (spokesman for the board)
Otto Zejmon - Chair of Finances/Technology
The data controller is the natural or juristic person that makes decisions, either alone or together with others, about the purpose and means of processing personal data (e.g. names, email addresses or similar).

Data protection officer provided for by law
We have appointed an external data protection officer for our company.
Dr. Marion Herrmann from Datenschutz Symbiose GmbH, Hundingstr. 10, 95445 Bayreuth,

Tel: +49 (0) 921 15011-26
Fax: +49 (0) 921 15011-27
Email: datenschutz[at]kulmbacher.de

Relevant legal bases
We provide you with information about the legal bases of our data processing on the basis of Art. 13 GDPR. If the legal basis is not given in the privacy statement, the following applies: The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR, the legal basis for data processing in order to perform our services and to implement measures provided for in the contract, as well as to respond to queries is Art. 6(1)(b) GDPR. The legal basis for data processing to fulfil our contractual obligations is Art. 6(1)(c) GDPR, and the legal basis for data processing to safeguard legitimate interests is Art. 6(1)(f) GDPR.

Changes and updates of the privacy statement
Please inform yourself regularly of the content of our privacy statement. We will adapt the privacy statement as soon as this is required by changes in the way we process data. We will inform you as soon as changes require your cooperation (e.g. consent) or other individual notification.

SSL or TLS encryption
This page uses SSL or TLS encoding for security reasons and to protect transmission of confidential content, such as orders or enquiries that you send to us as the website operator. Secure connections are recognisable because the browser’s address bar will change from ‘http://’ to ‘https://’, and the padlock symbol will appear in the address bar.
The data that you send us cannot be read by third parties if SSL or TLS encoding is activated.

Objection to advertising emails
Use of contact details, published in the context of the duty to provide information about the website, for sending advertising and information materials that have not been expressly requested is hereby prohibited. The operators of the website expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, for example in spam emails.
Location of the web server (§ 13(1) TMG [German Telemedia Act])
Data that is received through our website is processed on servers in Germany.

3. Cooperation with processors and third parties

If, in the course of data processing, we disclose, transmit or otherwise allow access to data to other persons and businesses (processors or third parties), this is only done on the basis of legal permission (e.g. if transmission of data to third parties, such as payment service providers pursuant to Art. 6(1)(b) GDPR, is necessary for performance of the contract), if you have consented to it, if a legal obligation provides for it or on the basis of our legitimate interests (e.g. when using representatives, web hosts, etc.).
If we entrust third parties with data processing on the basis of an “order processing contract”, we do so on the basis of Art. 28 GDPR.

Transmission to third countries
If we process data in a third country (i.e. outside of the European Union (EU) or the European Economic Area (EEA)) or if this happens in the course of using third party services or during disclosure or transmission of data to third parties, we only do it to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we only process your data, or have your data processed in the presence of the specific requirements under Art. 44(ff) GDPR. I.e. processing is done on the basis of specific guarantees, such as official recognised establishment of an EU-compliant level of data protection (e.g. through “Privacy Shield” for the USA) or observance of officially recognised, special contractual obligations (‘standard contractual clauses’).

4. Your rights as the data subject (data subject’s rights)

Information, restriction/blocking, deletion
Within the scope of the applicable legal provisions, you always have the right to free information about the personal data saved about you, its origin and recipients, and the purpose of the data processing and, if applicable, the right to correction, restriction/blocking or deletion of this data. If you have any questions about this or any other questions about personal data and privacy, you can contact us at any time, at the address given in the legal information about the website.

Withdrawal of consent to data processing
Much of data processing is only possible with your express consent. If you have already given consent you can withdraw it at any time. An informal email informing us of this is sufficient. This does not affect the lawfulness of data processing that took place up until withdrawal.

Right to data portability
You have the right to have data that we process automatically, on the basis of your consent or in order to perform a contract, issued to yourself or to a third party in a common, machine-readable format. If you request direct transmission of data to another data controller, this is only possible if it is technically feasible.

Right to complain to the competent regulatory body (complaints office)
If you have any complaints, suggestions or questions, please contact our data protection officer (link to details of the data protection officer above)
The data subject has the right to complain to a competent regulatory body in cases of violations of data protection law.

Our competent regulatory body for data protection is:
Bavarian Data Protection Authority (BayLDA)
Promenade 27, 91522 Ansbach
Tel: +49 (0) 981 53 1300
Email: poststelle@lda.bayern.de

5. Deletion of data

The data we process will be deleted or its processing restricted pursuant to Art. 17 and 18 GDPR. Unless expressly stated in this privacy statement, the data we save will be deleted as soon as it is no longer necessary for its function and no statutory retention obligations conflict with its deletion. If this data is not deleted because it is necessary for other, legally admissible purposes, its processing will be restricted. I.e. the data is blocked and not processed for other purposes. This applies, for example, to data that has to be retained for commercial or tax law reasons.

According to legal guidelines, data is required to be retained, specifically, for 6 years pursuant to § 257(1) HGB [German Commercial Code] (trading books, inventories, opening balances, annual accounts, commercial correspondence, accounting documents, etc.), and for 10 years pursuant to § 147 Abs. 1 AO [German Tax Code] (books, records, reports, accounting documents, commercial and business correspondence, documents relevant to taxation, etc.).

Online presence in social media
On the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR, we maintain online presences within social networks and platforms, in order to communicate with the customers, interested parties and users active on these social networks and platforms, and to be able to provide them with information about our services. The terms and conditions of trade and the privacy guidelines of the respective operators apply when these networks and platforms are retrieved.
Unless stated otherwise in this privacy statement, we process users’ data if users communicate with us within the social media networks and platforms, e.g. write contributions on our online presences or send us messages.

6. Data collection on our website

Server log files
The website provider automatically collects and stores information in server log files that your browser automatically sends to us. This information is:
•    Browser type and version
•    Operating system used
•    Referrer URL
•    Host name of the computer accessing the information
•    Time of the server request
•    IP address
This data is not merged with other data sources.
The basis for data processing is Art. 6(1)(b) GDPR that permits processing of data in order to perform a contract or to take pre-contractual measures.

Making contact / contact form
If you send us an enquiry using the contact form, we will store your data from the enquiry form, including the contact details you have provided, for the purposes of processing the enquiry and any associated follow-up questions. We will not pass on this data without your consent.
The data given in the contact form is only processed on the basis of your consent (Article 6(1)(a) GDPR). You can withdraw this consent at any time. An informal email informing us of this is sufficient. This does not affect the lawfulness of data processing operations that took place up until withdrawal.
We will store the data you provide in the contact form until you request its deletion, withdraw your consent for its storage, or if it is no longer necessary to store the data (e.g. if the processing of your enquiry is complete). This does not affect compulsory statutory provisions – retention periods in particular.

Registration on this website
You can register on our website, in order to use its additional functions. We only use the data you enter for the purpose of using the respective offer or service for which you have registered. Compulsory information requested at registration must always be provided in full. We will otherwise reject the registration.
We will use the email address provided at registration to inform you by email of important changes, such as changes to the range of offers or for changes that are necessary for technical reasons.
The data given at registration is processed on the basis of your consent (Article 6(1)(a) GDPR). If you have given consent you can withdraw it at any time. An informal email informing us of this is sufficient. This does not affect the lawfulness of data processing that has already taken place.
We will save the data recorded at registration, provided that you are registered on our website. The data will then be deleted. This does not affect compulsory statutory retention periods.

Prize draws
During prize draws, personal data is only collected to the required extent. For you to be able to participate in our prize draw, we will need your email address, as well as your postal address, in order to be able to inform you in the event that you win and/or to send you the prize. If you win the main prize, a photograph will usually be published, giving your name, location and the prize. Other winners are given with their title, first letter of their first name and their location. By taking part in the prize draw, you consent to this data being saved.
The data given in the contact form is only processed on the basis of your consent (Article 6(1)(a) GDPR). You can withdraw this consent at any time. An informal email informing us of this is sufficient. This does not affect the lawfulness of data processing operations that took place up until withdrawal.
We will store the data you provide in the contact form until you request its deletion, withdraw your consent for its storage, or if it is no longer necessary to store the data (e.g. once the prize draw is complete). This does not affect compulsory statutory provisions – retention periods in particular.

Data processing (customer and contract data)
We only collect, process and use personal data if it is necessary for establishing, formulating the content of or changing legal relationships (stock data). This is done on the basis of Art. 6(1)(b) GDPR that permits processing of data in order to perform a contract or to take pre-contractual measures. We only collect, process and use personal data through use of our web presence (usage data), if this is necessary to enable the user to use the service or to charge them for it.
Customer data collected will be deleted following completion of the order or once the business relationship comes to an end. This does not affect compulsory statutory retention periods.

7. Analysis tools and advertising


Google Analytics
The website uses functions of the web analysis service, Google Analytics. Google Analytics is provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google Analytics uses ‘cookies’. These are text files that are stored on your computer and enable analysis of your use of the website. Information generated by the cookie about your use of this website is normally sent to a Google server in the USA, where it is stored.
Google Analytics cookies are stored on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour, in order to optimise both their web presence and advertising.

IP anonymization
We have activated the IP anonymization function on this website. This means that your IP address is abbreviated by Google within the Member States of the European Union or in other contracting parties to the Agreement on the European Economic Area, before transmission to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and abbreviated there. Google will use this information on behalf of the operator of this website to evaluate your use of the website, to compile reports about website activities and to provide the website operator with other services associated with website and internet use. Google will not associate with other data the IP address transmitted by your browser in the context of Google Analytics.

Browser plugin
You can prevent cookies from being saved by making the appropriate setting in your browser software. However, we would like to point out that, by preventing cookies from being saved, you will not be able to use all of the functions of this website. You can also prevent Google from recording and processing the data generated by the cookie, relating to your use of the website (incl. your IP address), by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en-GB

Opt-out of data collection
You can prevent Google Analytics from recording your data by clicking the following link. An opt-out cookie will be set to prevent your data from being recorded the next time you visit this website Deactivate Google Analytics.
You can find more information about how Google Analytics handles user data, in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=en

Order data processing
We have concluded a contract with Google concerning order data processing, and we fully implement the strict guidelines of the German data protection authorities in our use of Google Analytics.

Demographic features of Google Analytics
This website uses the Google Analytics function ‘demographic features’. It enables reports to be created that contain information about the age, gender and interests of visitors to the website. This data comes from interest-related advertising from Google, as well as visitor data from third-party providers. It is not possible to assign this data to individual persons. You can deactivate this function at any time using Ads Settings in your Google account, or generally opt-out of your data being recorded by Google Analytics as described under “Opt-out of data collection”.
Furthermore, personal data will be anonymised or deleted after 14 months.

Google Re/Marketing Services
On the basis of our legitimate interests (i.e. interest in analysis, optimization and economic operation of our online offer, within the meaning of Art. 6(1)(f) GDPR), we use the marketing and remarketing services (‘Google Marketing Services’ for short) of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (“Google”).

Google is certified under the Privacy Shield framework and is therefore guaranteed to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

Google Marketing Services allow us to display advertisements for and on our website in a more targeted way, so that we only show users advertisements that potentially correspond to their interests. If, for example, a user is shown advertisements for products that they are interested in on other websites, this is called “remarketing”. For this purpose, Google directly runs a Google code and ‘(re)marketing tags’ (invisible graphics or code, also called ‘web beacons’) are incorporated into the website when our or other websites, on which Google Marketing Services are active, are retrieved. With the help of the beacons, an individual cookie, i.e. small file, is stored on the user’s device (comparable technologies can also be used in place of cookies). Cookies can be placed by different domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com or googleadservices.com. Which websites the user visits, which content they are interested in and which offers they have clicked are recorded in this file, in addition to technical information about the browser and operating system, referring websites, time of visit and other information about use of the online offer. The user’s IP address is also recorded. In the context of Google Analytics, we provide information to the effect that IP addresses are abbreviated within the Member States of the European Union or in other contracting parties to the Agreement on the European Economic Area, and only under exceptional circumstances are they sent to a Google server in the USA in full and abbreviated there. IP addresses are not associated with the user’s data within other Google offers. Google can associate the aforementioned information with information from other sources. If the user then visits other websites, they might see advertisements that have been tailored to them according to their interests.

The user’s data is processed pseudonymously within Google Marketing Services. This means that Google does not save or process the user’s name or email address, but processes the relevant data in cookie-related form, within a pseudonymous user profile. This also means that, from the point of view of Google, the advertisements are not managed and displayed for a specifically identified person, but for the cookie holder, regardless of who this cookie holder is. This does not apply if a user has specifically allowed Google to process this data without pseudonymisation. Information about users gathered by Google Marketing Services is sent to Google and stored on Google’s servers in the USA.


Google DoubleClick
We can incorporate advertisements from third parties on the basis of the Google Marketing Service “DoubleClick”. DoubleClick uses cookies that enable Google and its partner websites to link up advertisements on the basis of visits by users to this website or other websites on the internet.
We can incorporate advertisements from third parties on the basis of the Google Marketing Service “AdSense”. AdSense uses cookies that enable Google and its partner websites to link up advertisements on the basis of visits by users to this website or other websites on the internet.
We can also use the ‘Google Optimizer’ service. Using ‘A/B testings’, Google Optimizer allows us to understand the effect of various changes to a website (e.g. changes to input fields, design, etc.). Cookies are placed on the user’s devices for the purpose of these tests. This only involves processing of pseudonymous user data.

We also use ‘Google Tag Manager’ to incorporate and manage Google analyses and marketing services on our website.

More information about use of data for marketing purposes by Google can be found on the overview page: https://policies.google.com/technologies/ads. Google’s privacy policy can be viewed at https://policies.google.com/privacy.

If you would like to opt-out of interest-based advertising by Google Marketing Services, you can use the settings and opt-out options provided by Google: https://adssettings.google.com/authenticated.


Newsletter

The information below concerns the contents of our newsletter, as well as the processes for registration, sending and statistical analysis and evaluation, and your right to object. By subscribing to our newsletter, you express your agreement to receiving the newsletter and the processes described.

1.    Newsletter content: We only send newsletters, emails and other electronic messages with commercial information (hereinafter “newsletters”) with the consent of the recipient or statutory permission. If this is in the context of registering for a newsletter whose content is correctly described, they are relevant for the consent of the user. Our newsletters also contain information about our products, offers, promotions and our business.
2.    Double opt-in and logging: Users subscribe to our newsletter by means of a double opt-in process. This means that, after subscribing, you will receive an email where you are asked to confirm your registration. This confirmation is required to prevent people from signing up with third-party email addresses. Subscriptions to the newsletter are recorded so that the subscription process is traceable according to the statutory requirements. This includes storing the time of subscription and confirmation, as well as the IP address. Changes to your data that is stored with the service provider responsible for sending the newsletter are also recorded.
3.    The newsletter is sent and success is measured on the basis of the consent of the recipient pursuant to Art. 6(1)(a), Art. 7 GDPR, in conjunction with § 7(2)(3) UWG [Act Against Unfair Competition] or on the basis of statutory permission pursuant to § 7(3) UWG.
4.    The subscription process is recorded on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR, and is used as evidence of consent to receiving the newsletter.
5.    Cancellation/withdrawal - newsletter recipients can cancel receipt of our newsletter, i.e. withdraw their consents, at any time. You will find a link for cancelling the newsletter at the end of each newsletter. When a user unsubscribes from the newsletter, personal data is deleted, unless its storage is required or justified by law, although processing in this instance is restricted to these exceptional purposes. In particular, we can store the email addresses provided for up to three years on the basis of our legitimate interests, before deleting them for the purposes of sending the newsletter, in order to prove that consent was previously given. Processing of this data is limited to the purpose of defending against any claims. Individual requests for deletion can be made at any time, if previous existence of consent is confirmed at the same time.