Privacy policy

Thank you for visiting our website, the PENGsite.
The protection of your personal data is very important to us. With this data protection declaration, we would like to inform you about the handling of your personal data when visiting our website and about your rights.

1) Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. For detailed information on the subject of data protection, please refer to our data protection declaration listed below this text.

Data collection on this website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find the contact details of the website operator in the section "Notice about the data controller" in this privacy policy.

What personal data do we collect?
We collect and store all data and information that you enter on our website (e.g. when making a purchase). The information stored is: Your name, billing address, shipping address, payment information (including credit card numbers or Paypal email address), email address and phone number. If you have chosen to personalise an item, we also store the personalisation information.

We also collect information about your device, such as IP address and time zone. We may also use software tools to measure and collect session information (to see how you interact with our website). The information stored may include: individual web pages or products viewed and information about how you interact with the website - such as navigation.

We would like to point out that data transmission on the Internet (e.g. during
communication by e-mail) may have security gaps. It is not possible to provide all-embracing protection of your data against access by third parties.

How do we collect your data?
On the one hand, your data is collected when you provide it to us. This can be, for example, data that you enter in a contact form or when you place an order on our website. It is then part of the process for us to collect the personal data you provide. Please remember that your personal data will only be used for the purposes mentioned above.
Other data is collected automatically or after your consent when you visit the website by our IT systems. This is mainly technical data (e.g. internet browser, operating system or time of page view). This data is collected automatically as soon as you enter this website.

Why and for what do we need your data?
You may ask why we collect this information? Some of the data is collected to ensure that the website is delivered without error. Other data may be used to analyse your user behaviour.

Here at PENG, we want to make your experience as personal as possible. So one of the reasons we collect this information is to communicate with you about your order and to keep you informed about the ordering process.

We collect this information to fulfil all orders placed (this includes processing your payment information, organising shipping and providing order confirmations/invoices).
We also collect this information to meet preferences on the website - such as newsletters.

How do we communicate with our customers?
We may contact you to notify you of orders, inform you of shipment or order confirmation. We may also inform you about our business/offers if you have subscribed to our newsletter. We may contact you by email for these purposes.

How can you withdraw your consent?
You would like us to stop contacting you?
You would like us to delete your personal data?
No problem - just send us an email to hallo@peng-drink.de and we will do it immediately.

What rights do you have regarding your data?
You have the right to receive information about the origin, recipient and purpose of your stored personal data free of charge at any time. You also have a right to request the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances.

Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time about this and other questions on the subject of data protection.

Do you have any questions?
If you would like to access, correct, amend or delete any personal data we hold about you, please contact us at hallo@peng-drink.de. For the purposes of EU data protection law, the website operator is the controller of your personal data.

Analysis tools and third-party tools

During your visit to our website, a statistical evaluation of your surfing behaviour may take place. This happens primarily with so-called analysis programmes. You will find a detailed list of these programmes in the following data protection declaration.

2) Hosting and third-party providers

The website www.peng-drink.de is hosted externally on Checkdomain.de; the associated webshop is also hosted externally on the Shopify.com platform. Shopify provides the online platform through which we sell our products and services to you. Your data may be stored by Shopify's data store, databases and the general Shopify applications. They store your data on secure servers behind a firewall.

All direct payment gateways offered by Shopify and used by our company comply with standards set by the PCI-DSS, which is administered by the PCI Security Standards Council, which is a joint effort of brands such as Visa, MasterCard, American Express, and Discover. The PCI-DSS requirements help ensure the secure handling of credit card information by our shop and its service providers.

For information on sharing your information with third party service providers, please see the "Sharing Your Information with Third Party Service Providers" section.

External hosting

This website is hosted by an external company (hoster). Your personal data collected on this website is stored on the hoster's servers. This data includes, but is not limited to, IP addresses, communication and metadata, names, contact requests, contact details, contractual data, website accesses and other data that may be generated when using a website.

A hoster is used for the purpose of fulfilling contracts with potential and existing customers (Art. 6 para. 1 lit. b DSGVO) as well as in the interest of a fast, secure and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f DSGVO). If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) as defined by the TTDSG. The consent can be revoked at any time.

The hoster is required to follow our instructions regarding your data and will only process the latter to the extent necessary to fulfil its service obligations.

The following hoster is used by us:

checkdomain GmbH
a dogado group company
Große Burgstraße 27/29
23552 Lübeck
Germany

Shopify

Our online shop or webshop is operated via the Shopify.com platform. This is an offer of the external service provider:

Shopify International Limited
2nd Floor, 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
(hereinafter referred to as "Shopify")

Shopify is a tool for creating and hosting websites. When you visit our website, Shopify collects your IP address and information about the device and browser you are using. Shopify also analyses visitor numbers, visitor sources and customer behaviour, and compiles user statistics. When you make a purchase on our website, Shopify also collects your name, email address, shipping and billing addresses, payment information and other data related to the purchase (e.g. phone number, amount of sales made, etc.). For analytics, Shopify stores cookies in your browser.

For more information, please see Shopify's privacy policy: https://www.shopify.com/legal/privacy.

The use of Shopify is based on Art. 6 para. 1 lit. f DSGVO. We have a legitimate interest in the most reliable presentation of our website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 Para. 1 lit. a DSGVO and § 25 Para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) as defined by the TTDSG. The consent can be revoked at any time.

Sharing your data with third parties

For the smooth operation of this website and the associated webshop, we work together with some third-party providers to whom your personal data is passed on. These third party providers are listed in detail below.

Conclusion of contract, payment and dispatch of goods
The website operator only transfers personal data to third parties if this is necessary in connection with the processing of the contract, e.g. to logistics service providers and/or companies commissioned with the processing of payments. Your data will not be transferred beyond this or only if you expressly consent to the transfer. Your data will not be passed on to third parties (e.g. for advertising purposes) without your express consent.

The legal basis for the data processing is Art. 6 para. 1 lit. b DSGVO, the processing of data for the fulfilment of a contract or pre-contractual measures is hereby permitted.

The companies commissioned with payment processing are:

- AMEX / American Express:
American Express Inc.
World Financial Center
200 Vesey St
New York, NY 10285
United States

- Apple Pay:
Apple Distribution International
Hollyhill Industrial Estate
Hollyhill, Cork
Ireland

- Google Pay:
Google Payment Ireland Limited
70 Sir John Rogerson's Quay
Dublin 2, Dublin
Ireland

- PayPal:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449, Luxembourg

- Klarna:
Klarna Bank AB Sveavägen 46
111 34 Stockholm
Sweden

- Mastercard / Maestro:
Mastercard Inc.
2000 Purchase St
Purchase, NY 10577
United States

- Sofort Bank Transfer:
Sofort GmbH
Theresienhöhe 12
80339 Munich
Germany

- VISA:
Visa Inc.
900 Metro Center Blvd
Foster City, CA 94404
United States

The companies entrusted with delivery and logistics are:

- DPD:
DPD Deutschland GmbH
Wailandtstrasse 1
63741 Aschaffenburg
Germany

- Majamo:
MaJaMo GmbH
Hullerweg 21
49134 Wallenhorst
Germany

- Saloodo:
Saloodo! GmbH
Siegburger Str. 191-193
50679 Cologne
Germany

Bookkeeping and accounting
For our bookkeeping and invoicing we use the software Lexoffice. The provider of this service is:

Haufe-Lexware GmbH & Co. KG
A company of the Haufe Group SE
Munzinger Street 9
79111 Freiburg
Germany

The privacy policy of this company can be found here:
https://www.lexoffice.de/datenschutz/.

Website support
The following company is entrusted with the maintenance of our website and the online offer:

Snow Globe UG (haftungsbeschränkt).
Siegfriedstrasse 3
80803 Munich
Germany

3) Data collection on this website

Cookies

Our internet pages use so-called "cookies". Cookies are small data packets and do not cause any damage to your end device. They are stored either temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your end device. Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or until they are automatically deleted by your web browser.

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies are used to evaluate user behaviour or display advertising. We use cookies to make your experience as personalised as possible and to improve our overall offering in terms of user-friendliness, effectiveness and security. Cookies neither cause damage to your terminal device nor do they contain malware. Cookies are small text files that are placed on your terminal device and stored by your browser. We mainly use "session cookies", which are automatically deleted after your visit to the website. Permanent cookies, on the other hand, remain stored on your end device until they are deleted. These cookies enable us to recognise your browser the next time you visit the website.

Cookies that are necessary to carry out the electronic communication process, to provide certain functions that you have requested (e.g. for the shopping basket function) or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 Para. 1 lit. f DSGVO, unless another legal basis is specified. For the purpose of technically error-free and optimised provision of its services, the website operator has a legitimate interest in storing cookies. If consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TTDSG); consent can be revoked at any time. If you do not accept cookies or delete cookies that have already been set, this may lead to restrictions in the function of the website.

Such cookies, which are necessary to carry out electronic communication processes and/or to provide certain functions (such as the shopping basket function), are stored on the basis of Art. 6 para. 1 lit. f DSGVO. For the purpose of technically error-free and optimised provision of its services, the operator of the website has a legitimate interest in storing cookies.

Your browser can be set so that you are informed about the use of cookies. In the course of this, you can refuse the acceptance of cookies for certain cases, allow cookies only in individual cases and/or activate the deletion of cookies at the end of the browser session. If you do not accept cookies or delete cookies that have already been set, this may lead to restrictions in the function of the website.

Cookies from third-party providers are also stored, which enable us to analyse the use of the website so that we, as the operator, can measure and improve its performance. The basis for the storage is your consent (Art. 6 para. 1 lit. a DSGVO). You can revoke your consent at any time. A list of these third-party tools, together with further information on data protection, can be found in section "5. Plugins and tools".

Contact form

If you send us enquiries via our contact form, your details from the contact form, including the information you have entered there, will be stored by us for the purpose of processing your enquiry and in the event of any queries. This data will never be passed on to third parties without your consent.

This data is processed on the basis of Art. 6 Para. 1 lit. b DSGVO if your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, our processing of your data is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 para. 1 lit. f DSGVO) or on your consent if this was explicitly requested (Art. 6 para. 1 lit a DSGVO).

Your data entered in the contact form will remain stored by us until you request us to delete it, revoke your consent to store it or the purpose for storing the data ceases to exist (e.g. when the processing of your enquiry has been completed). Mandatory legal provisions, in particular retention periods, remain unaffected by this.

Enquiry by e-mail, telephone or fax

If you contact us by e-mail, telephone or fax, we will store your enquiry, including all personal information arising from it, for the purpose of processing this request from you. This data will not be passed on to third parties without your consent.

If your enquiry is related to the fulfilment of a contract or if it is necessary for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 Para. 1 lit. b DSGVO. In all other cases, our processing of your data is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 para. 1 lit. f DSGVO) or on your consent if this has been explicitly requested (Art. 6 para. 1 lit a DSGVO).

Registration on our website

Our website offers the possibility for users to register or create a customer account in order to use additional functions on our website. For the purpose of using the respective offer or service for which you have registered, we use the data you have entered. When registering, you will be asked to provide mandatory information, which you must provide in full. Otherwise registration is not possible.

In the event of important changes to the scope of the offer or in the event of technically necessary changes, we will inform you via the e-mail address you provided during your registration.

For the purpose of implementing the user relationship created by your registration and for the possible initiation of further contracts, we process the data you provided during registration (Art. 6 para. 1 lit. b DSGVO).

We store the data you entered during registration for as long as you are registered on our website with a customer account, after which it is deleted. Legal retention periods remain unaffected.

4) Newsletter

If you would like to receive our PENG newsletter, we need your e-mail address together with information that allows us to verify that you are the owner of the e-mail address and that you agree to receive the newsletter. Additional data is not collected or only collected on a voluntary basis. We only use this data to send you the requested information and it is not passed on to third parties.

Your data entered in the newsletter registration form will be processed exclusively on the basis of your consent (Art. 6 para. 1 lit. a DSGVO). Your consent to the storage of your data and email address as well as the use of them for sending the newsletter can be revoked at any time, for example via the corresponding link in the newsletter ("Unsubscribe newsletter"). Your revocation does not affect the legality of the data processing already carried out to date.

Your data deposited with us for the purpose of sending the newsletter will be stored by us or by the corresponding external newsletter service provider until you unsubscribe from the newsletter and will be removed from the newsletter mailing list after unsubscribing from the newsletter or after the purpose has ceased to exist. This applies subject to a possible deletion or blocking of email addresses at our discretion within the scope of our legitimate interest according to Art. 6 para. 1 lit. f DSGVO.

After unsubscribing from the newsletter mailing list, the email address may be stored in a blacklist by the website operator or, if applicable, the newsletter service provider in order to prevent future mailings to you. This data from the blacklist is used exclusively for this purpose and is not merged with other information. On the one hand, this serves your interest as well as ours in complying with the legal requirements for sending newsletters (legitimate interest according to Art. 6 Para. 1 lit. f DSGVO). The storage on the blacklist is unlimited in time. You can object to the storage if your interest exceeds our legitimate interest.

5) Plugins and tools

Google Analytics

Our website uses functions of the web analysis service Google Analytics. The service provider is the following company:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4, Ireland

Google Analytics enables the website operator to analyse the behaviour of visitors to the website. This provides the website operator with various usage data such as page views, length of stay, operating systems used and the origin of the visitor. This data can be summarised by Google in a profile, which can be assigned to the respective end device or user.

Google Analytics uses technologies that make it possible to identify users for the purpose of analysing their behaviour, e.g. through device fingerprinting or cookies. This data collected by Google about website usage is generally transmitted to a Google server in the USA and stored there.

As the operator of the website, we have a legitimate interest in analysing user behaviour in order to optimise both our advertising and our online services. These analysis tools are used on the basis of Art. 6 para. 1 lit. f DSGVO. If the user has given his or her consent, e.g. for the storage of cookies, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a DSGVO. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission: https://business.safety.google/adscontrollerterms/sccs/.

IP anonymisation
The "IP anonymisation" function is activated on this website. This function enables Google to truncate your IP address within the EU member states and in other states that are party to the Agreement on the European Economic Area (EEA) before transferring it to the USA. Only in exceptional cases can the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the website operator, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser to Google Analytics will not be merged with any other data held by Google.

Browser plugin
There is a browser plugin that prevents the collection and processing of your data by Google. You can download and install this here: https://tools.google.com/dlpage/gaoptout?hl=de.

Further information on the handling of user data by Google Analytics can be found in Google's privacy policy at this link: https://support.google.com/analytics/answer/6004245?hl=de.

Demographic characteristics with Google Analytics
This website uses Google's "demographic characteristics" feature, which enables it to display suitable advertisements to visitors to the website within the Google advertising network. This may result in the creation of reports that include statements about the age, gender and interests of the website visitors. This is data that comes from Google's interest-based advertising and from third-party visitor data. You can generally prohibit the collection of your data by Google Analytics (as listed in the section "Objection to data collection") and deactivate it at any time via the ad settings in your Google account.

Google Analytics and e-commerce tracking
This website uses the "e-commerce tracking" feature of Google Analytics. The website operator can analyse the purchasing behaviour of visitors to improve online marketing campaigns using e-commerce tracking, which records information such as average order values, orders placed, shipping costs and the elapsed time between viewing and purchasing a product. Google may aggregate this data under a transaction ID associated with each user or their device.

Storage duration
The data stored by Google at user and event level associated with cookies, user identifiers (e.g. User ID) or advertising IDs (e.g. DoubleClick cookies or Android advertising ID) are anonymised or deleted after 26 months. Details can be found here: https://support.google.com/analytics/answer/7667196?hl=de.

Google Ads

The operator of this website uses Google Ads. This is an online advertising programme of the company Google Ireland Limited (referred to as "Google"), with the following address:

Gordon House
Barrow Street
Dublin 4, Ireland

The use of Google Ads makes it possible to display advertisements, both in the Google search engine and on third-party websites, when the user enters certain search terms in the Google search (keyword targeting). In addition, it is possible to play targeted advertisements based on user data stored with Google, such as interests and/or location data. This is known as target group targeting. The website operator has the possibility to evaluate this data quantitatively. For example, it is analysed which search terms led to the display of the respective advertisement and how many advertisements caused the corresponding clicks.

The website operator has a legitimate interest in marketing its products and services as effectively as possible. The use of Google Ads is based on Art. 6 para. 1 lit f DSGVO.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission: https://policies.google.com/privacy/frameworks and https://business.safety.google/adscontrollerterms/sccs/.

Google Remarketing

The operator of this website uses Google Analytics Remarketing of the provider Google Ireland Limited (referred to as "Google"), with the following address:

Gordon House
Barrow Street
Dublin 4, Ireland

By, for example, users clicking on certain products, Google Remarketing analyses their behaviour when visiting our website, with the aim of assigning visitors to advertising target groups and thus displaying targeted advertising to you when visiting other online offers (remarketing or retargeting).

In addition, Google's cross-device functions can be linked to the advertising target groups created using Google Remarketing. This means that personalised, interest-based advertisements can also be displayed on other of your end devices (computer or tablet) depending on your previous surfing and usage behaviour on one end device (e.g. smartphone).

You can object to personalised advertising via your Google account, if available: https://myadcenter.google.com/?hl=de&sasb=true.

The website operator has a legitimate interest in marketing its products and services as effectively as possible. The use of Google Ads is based on Art. 6 para. 1 lit f DSGVO. If a corresponding consent has been obtained, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit a DSGVO; this consent can be revoked at any time.

You can find further information as well as Google's data protection regulations in the data protection declaration under the following link: https://policies.google.com/technologies/ads?hl=de.

Formation of target groups with customer matching
For the purpose of target group formation, the operators of this website use, among other things, Google Remarketing's customer matching. In this process, certain customer data such as e-mail addresses from our customer master data are passed on to Google. If the customers in question are Google users and are logged into their Google account, they will receive targeted advertising messages within the Google offering, including YouTube, Gmail or the Google search engine, for example.

Google Conversion Tracking

Our website uses Google Conversion Tracking from the following provider:

Google Ireland Limited (referred to as "Google")
Gordon House
Barrow Street
Dublin 4, Ireland

Google Conversion Tracking enables both us and Google to recognise whether certain actions have been carried out by the user. For example, we can evaluate which buttons on our website were clicked and how often, as well as measure the performance of individual products, i.e. how often they were purchased or viewed. These data can be used to create conversion statistics. As the website operator, we receive information on the total number of users who have clicked on our ads and what actions they have taken there. We do not receive any information to personally identify the users. Only Google itself uses appropriate cookies or comparable recognition methods with which it is possible to identify the user.

The website operator has a legitimate interest in marketing its products and services as effectively as possible. The use of Google conversion tracking is based on Art. 6 para. 1 lit f DSGVO. If a corresponding consent has been obtained, the processing is carried out exclusively on the basis of Art. 6 (1) lit a DSGVO; this consent can be revoked at any time.

Further information on Google conversion tracking can be found in Google's privacy policy: https://policies.google.com/privacy?hl=de.

Meta Pixel (formerly Facebook Pixel)

In order to measure the conversion of visitor actions, this website uses pixels from Meta (formerly Facebook). The provider of this service is:

Meta Platforms Ireland Limited
4 Grand Canal Quay Square
Dublin, D02 X525
Ireland

However, Meta says your collected data is also transferred to the US and other third countries.

Pixel enables tracking of the behaviour of website visitors when they have been directed to the provider's website via an advertisement of the provider on one of the Meta Platforms. In this way, the effectiveness of the meta-advertisements can be measured for statistical and market research purposes and future advertising measures can be optimised.

For us as the website operator, this collected data is anonymised; no conclusions can be drawn about the identity of the visitors. However, this data is processed and stored by Meta so that Meta is in turn able to establish a connection to the respective user profile. Meta generally uses this data for its own advertising purposes in accordance with the Meta data usage policy. This enables Meta to place advertisements on Meta's platforms as well as outside of them. As the site operator, we have no influence on this use of your data by Meta.

The use of Meta Pixel is based on Art. 6 para. 1 lit. f DSGVO. As the website operator, we have a legitimate interest in effective advertising and marketing measures involving social media. If a corresponding consent has been requested (e.g. for the storage of cookies), the processing is only carried out on the basis of Art. 6 para. 1 lit. a DSGVO. This consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://www.facebook.com/help/566994660333381.

If personal data is collected on our website with the help of the Meta Pixel tool and transmitted to Meta, both we as the website operator and the company Meta Platforms Ireland Limited (4 Grand Canal Quay Square, Dublin, D02 X525 Ireland) are aware of this.
Dublin, D02 X525 Ireland) are jointly responsible for the data processing (Art. 26 DSGVO). This joint responsibility is limited to the collection of the data and its transmission to Meta. The processing carried out by Meta after the transfer is not part of this mutual responsibility. The obligations concerning both sides are laid down in an agreement on joint data processing. You can read the agreement here: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for the secure implementation of the Meta tool on our website and for providing data protection information when using the tool. Meta is in turn responsible for the security of the data in the Meta products. You can claim your data protection rights (e.g. requesting information) regarding your data processed by Meta directly from Meta. If you request your data protection rights from us, we are obliged to forward this request to Meta.

Further information on the protection of your privacy can be found in Meta's data protection information: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0.

In addition, you can deactivate the remarketing function "Custom Audiences" in the settings section for advertisements via https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To use this function, you must be logged in to Facebook.

If you do not have a Facebook account, you can deactivate usage-based advertising by Facebook or Meta at the European Interactive Digital Advertising Alliance: https://www.youronlinechoices.com/de/praferenzmanagement/.

Map displays via Mapbox

This website uses an interactive map to display objects on a street map. For this purpose, the product Mapbox, a map service of the company Mapbox, Inc. is used in combination with OpenStreetMap. Below are the addresses of these two companies:

MapBox Inc.
740 15th St Nw
Suite 500
Washington, DC 20005
United States

and

Open Street Map Foundation (OSMF)
132 Maney Hill Road
Sutton Coldfield, West Midlands, B72 1JU
United Kingdom

By embedding the interactive map on our website, information about the use of this website, including your IP address, is transmitted to Mapbox, Inc. and the Open-Street-Map-Foundation.

When you visit this website, personal data is automatically transmitted to the aforementioned service providers, namely:
- Browser type/version,
- operating system used,
- Referrer URL (the previously visited page),
- host name of the accessing rec,
- time of the server request.

The processing of your personal data is carried out by the responsible party on the basis of your consent in accordance with Art. 6 Para. 1 lit. a) in conjunction with Art. 7 DSGVO. Your failure to give consent will only result in the Mapbox / OpenStreetMap service not being made available to you.

When you call up the map, your data is transferred to MapBox Inc. and the Open-Street-Map Foundation (OSMF). Mapbox and OSMF may transfer your data to third parties if this is required by law or if third parties process this data on your behalf. It cannot be ruled out that the recipients will associate your IP address with other data. It is technically possible that the recipients can identify at least individual users on the basis of the data received. We have no influence on the fact that personal data and personality profiles of users of the website are processed for other purposes. We do not know how long the recipients will store and use your data.

Your personal data will be transferred to Mapbox Inc. and Openstreetmap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) in accordance with your consent pursuant to Art. 49 Para. 1 lit. a DSGVO to a third country (USA/UK from 01.01.2021). Access by state authorities cannot be ruled out.

You can revoke your consent at any time by changing your settings. Further information on this can be found in the data protection declarations of OSMF (https://wiki.osmfoundation.org/wiki/Privacy_Policy / https://wiki.osmfoundation.org/wiki/Services_and_tile_users_privacy_FAQ) and in the data protection declaration of Mapbox: https://www.mapbox.com/legal/privacy/.

Integration of videos via YouTube

This website uses plugins from the YouTube website, which is operated by Alphabet (Google). The operator is YouTube LLC, with the following address:

901 Cherry Ave.
San Bruno, CA 94066
United States

YouTube LLC is a subsidiary of Google LLC:

Amphitheatre Parkway
Mountain View, CA 94043
United States

When embedding, we use the extended data protection mode, whereby the connection to the YouTube servers is only established as soon as you watch the video. If you are logged into your YouTube account, this enables YouTube to directly associate your surfing behaviour with your user profile. This can be prevented if you log out of your YouTube account beforehand.

The use of YouTube services on our part is in the interest of an appealing presentation of our online offers. This is a legitimate interest according to Art. 6 para. 1 lit. f DSGVO. The provision of the data is necessary so that you can use the function.

You can find further information on the handling of your user data in YouTube's privacy policy: https://www.google.de/intl/de/policies/privacy.

Social media

The operator of the website maintains profiles in social media or on social media platforms in order to provide information about itself and its products and to exchange information and communicate with the users there. Our profiles on the corresponding social media platforms are merely linked on our websites. No plug-ins are used that would establish a connection to the servers of these providers simply by visiting our website. When calling up the corresponding platform, the respective data protection provisions and terms and conditions of the platform operator apply. When opening a link from our website to one of our social media profiles, we prevent the disclosure of the URL of origin (referrer) at this point (when using appropriately supporting browsers). We do this in order to keep the amount of data involved in social media as low as possible.

Communication via WhatsApp

We use the instant messenger service WhatsApp, among others, to communicate with our customers and other third parties. The provider of this service is the following company:

WhatsApp Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2, Ireland.

When using WhatsApp, communication takes place via peer-to-peer encryption (end-to-end), which prevents Whatsapp or other third parties from accessing the communication content. However, WhatsApp does gain access to the metadata that is generated during the communication process (e.g. sender, recipient and time of message transmission). In addition, we would like to point out that, according to its own statement, WhatsApp shares personal user data with its parent company Meta (formerly Facebook), which is based in the USA. Further information on data processing can be found in Whatsapp's privacy policy at the following link: https://www.whatsapp.com/legal/privacy-policy.

We use WhatsApp on the basis of a legitimate interest in communicating as quickly and effectively as possible with customers, interested parties and other business and contractual partners (Art. 6 para. 1 lit. f DSGVO). If your corresponding consent has been requested, the data will be processed exclusively on the basis of this consent. The latter can be revoked at any time with effect for the future.

The communication content shared between you and us via WhatsApp remains stored with us until you request us to delete it, revoke your consent to store it or the purpose for storing the data ceases to exist (e.g. when the processing of your enquiry has ended). Mandatory legal provisions, in particular retention periods, remain unaffected by this.
Our WhatsApp accounts are set up in such a way that no automated data comparison with the address book on the respective smartphone used takes place. We have concluded an order processing agreement with WhatsApp.

6) General notes and mandatory information

Data protection

The operator of this website takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. When you use this website, various personal data are collected. Personal data is data by which you can be personally identified. This Privacy Policy explains what information we collect and how we use it. It also explains how and for what purpose this is done. We would like to point out that data transmission on the Internet (e.g. when communicating by e-mail) can have security gaps. Complete protection of data against access by third parties is not possible.

Note on the responsible body

The responsible party for data processing on this website is the website operator:

PENG Beverages GmbH
Karl-Marx-Str. 183
D-12043 Berlin
Germany

Phone: +49 170 4705988
E-mail: hallo@peng-drink.de

The controller is the legal or natural person who, jointly or alone with others, determines the means and purposes of the processing of personal data (e.g. names, e-mail addresses, etc.).

Storage period

Your personal data will be stored by us until the purpose for processing the data no longer applies, unless a separate storage period has been specified in this data protection declaration.

If you wish to submit a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless there are other legally valid reasons for storing personal data that conflict with this (these include, for example, retention periods under tax and/or commercial law). In the latter case, your data will be deleted once these reasons no longer apply.

General information on the legal basis for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6 para. 1 lit. a DSGVO or Art. 9 para. 2 lit. a DSGVO if special categories of data are processed in accordance with Art. 9 para. 1 DSGVO. In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 para. 1 lit. a DSGVO. If you have consented to the storage of cookies or to the access to information in your terminal device (e.g. via device fingerprinting), the data processing is additionally carried out on the basis of Section 25 (1) TTDSG. This consent can be revoked at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 para. 1 lit. b DSGVO. Furthermore, if your data is required for the fulfilment of a legal obligation, we process it on the basis of Art. 6 para. 1 lit. c DSGVO. Furthermore, the data processing may be carried out on the basis of our legitimate interest according to Art. 6 para. 1 lit. f DSGVO. Information on the relevant legal basis in each individual case is provided in this data protection declaration.

Note on data transfer to the USA and other third countries

Among other things, we use tools from companies based in the USA or other third countries that are not secure from a data protection perspective. If these tools are active, your personal data may be transferred to these third countries and processed there. We would like to point out that no level of data protection comparable to that in the EU can be guaranteed in these countries. For example, US companies are obliged to hand over personal data to security authorities without you as a data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. intelligence services) process, evaluate and permanently store your data located on US servers for monitoring purposes. We have no influence on these processing activities.

Revocation of your consent to data processing

Many data processing operations associated with the use of our website and our online services require your prior express consent. You can revoke such consent already given at any time. This is done informally, as described in the paragraph above. The lawfulness of the processing of your data carried out up to the time of the revocation remains unaffected.

Right to object to the collection of data in specific cases and to direct marketing (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6 ABS. 1 LIT. E OR F DSGVO, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING AT ANY TIME FOR REASONS CONCERNING YOUR PARTICULAR SITUATION, TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA. THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE EVERY LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS DATA PROTECTION STATEMENT. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDES YOUR INTERESTS, RIGHTS AND FREEDOMS; OR THE PROCESSING IS FOR THE PURPOSE OF ASSERTING, EXERCISING OR DEFENDING LEGAL CLAIMS (OBJECTION ACCORDING TO ART. 21 PARA. 1 DSGVO).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH ADVERTISING; THIS ALSO APPLIES TO PROFILING, INSOFAR AS IT IS CONNECTED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21 PARA. 2 DSGVO).

Right of appeal to the competent supervisory authority

In the event of a breach of the GDPR, data subjects shall have a right of appeal to the competent supervisory authority in the Member State of the habitual residence, place of work or place of the alleged breach. This right of appeal is without prejudice to any other administrative or judicial remedy.

Right to data portability

You may have your data, which we process automatically on the basis of your consent or for the performance of a contract, transferred to yourself or to a third party in a tangible, machine-readable format. If you wish your data to be transferred directly to a third party, this will only be done if it is technically possible.

Information, deletion and correction

Within the framework of the applicable legal provisions, you have the right to obtain information free of charge at any time about your stored personal data, the origin and recipients of the data and the purpose of the data processing; you also have the right to have your data deleted or corrected if necessary. If you have any further questions on this subject, please contact us at any time.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time in this regard. You have the right to restrict processing in the following cases:

- If you dispute the accuracy of your personal data stored with us, we usually need some time to check this. You have the right to request the restriction of the processing of your personal data for the duration of this check.

- If the processing of your personal data is or has been unlawful, you may request restriction of the data processing instead of erasure.

- If we no longer need your personal data, but you need them to exercise, defend or enforce legal claims, you have the right to request restriction of the processing of your personal data instead of erasure.

- If you have lodged an objection in accordance with Art. 21 (1) DSGVO, a balance must be struck between your interests and ours. If it is not yet clear whose interests prevail, you have the right to demand the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, your data may only be processed apart from storage with your consent, or for the purpose of
- assert, exercise or defend legal claims;
- to protect the rights of another natural or legal person,
- for reasons of important public interest of the European Union or a member state.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential data such as orders and enquiries that you send to us, this website uses SSL or TLS encryption. An encrypted connection can be recognised by the browser address line. The displayed address then changes from "http://" to "https://", and the browser line usually shows the symbol of a padlock.

If SSL or TLS encryption is activated, your data transmitted to us cannot be read by third parties.

Encrypted payment transactions on this website

After concluding a contract for which a charge is made, you are obliged to provide us with your payment details, such as account number in the case of direct debit authorisation, as this data is required for the processing of payments.

All payment transactions of the usual means of payment (e.g. Visa/MasterCard, direct debit) always take place via an encrypted SSL or TLS connection. An encrypted connection can be recognised by the browser address line. The displayed address then changes from "http://" to "https://" and the browser line usually shows the symbol of a padlock.

If SSL or TLS encryption is activated, your payment data transmitted to us cannot be read by third parties.

Objection to advertising e-mails

We hereby object to the use of contact data published within the scope of the imprint obligation to send advertising and information material that has not been expressly requested. The operator of this website expressly reserves the right to take legal action in the event of the unsolicited sending of advertising information, such as spam e-mails.

Privacy Policy Updates

Please note that we reserve the right to change this Privacy Policy at any time, so please review it regularly. Changes and clarifications will be effective immediately upon posting on the website. If we make material changes to this policy, we will notify you here that it has been updated so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we use and/or disclose it.

Last updated on 06.12.2022
in accordance with the General Data Protection Regulation (GDPR).

End of the privacy policy.