Privacy Policy

Last updated: 27 October 2026
This is an English translation for your convenience. Only the German version is legally binding.

1. Controller

Jan-Philipp Bleeke, JPB Winemaking
Wildbadstr. 38
56841 Traben-Trarbach
Email: hello@jpbwinemaking.com
Telephone and WhatsApp: +49 176 966 522 73

We are not required to appoint a data protection officer. If you have any questions about data protection, simply write to us at the email address above.

2. Hosting and server log files

This website is hosted by GreenGeeks, 1401 Pennsylvania Ave, Suite 105, Wilmington, DE 19806, USA. The server is located in Montréal, Canada. The European Commission has found that Canada ensures an adequate level of data protection (Art. 45 GDPR). Where GreenGeeks accesses data from the USA, this is safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). GreenGeeks processes the data on our behalf; the data processing agreement is part of GreenGeeks' terms of service (Art. 28 GDPR).

Each time the website is accessed, the server automatically stores data that your browser transmits:

We need this so that the website runs securely and reliably and so that we can detect attacks. The legal basis is Art. 6(1)(f) GDPR. The host deletes the log files automatically as soon as they are no longer needed for these purposes.

We manage the domain through SiteGround (DNS). No content of this website is transferred in the process.

3. Web analytics, cookies and consent

On your first visit, we ask you in a notice whether we may use Google Analytics, Microsoft Clarity, Google Ads and the Meta Pixel. Without your consent, these services are not loaded and no data is transmitted to Google, Microsoft or Meta. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of every page. Withdrawal applies for the future. Your choice is valid for 12 months, after which we ask again.

Google Analytics 4 (category “Statistics”): With your consent, we use Google Analytics provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics evaluates how our pages are used (e.g. pages viewed, time spent, approximate location, device, browser) and sets cookies for this purpose (including _ga, _ga_*, storage period of up to 2 years). Google Analytics 4 does not store full IP addresses. Google deletes the event data after the period we have set, after 14 months at the latest. When an order is placed, we send only the order value to Google Analytics, with no order number and no information about you as a person.

Microsoft Clarity (category “Statistics”): With your consent, we use Microsoft Clarity provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity shows us how visitors use our pages: clicks, mouse movements, scrolling and pages viewed. This produces heatmaps and session recordings that we use to improve the site. Clarity is linked to our Google Analytics: Clarity transmits an identifier of your session and a link to the recording to Google Analytics so that we can view both analyses together. This too happens only with your consent to the category “Statistics”. Entries in form fields and the entire order form are already masked in your browser and are not transmitted to Microsoft. Clarity sets cookies for this purpose (including _clck and CLID, storage period of up to 1 year, and _clsk, storage period of 1 day). Advertising cookies from Microsoft are switched off. Microsoft stores the data for up to 13 months. Further information: privacy.microsoft.com.

Google Ads conversion tracking (category “Marketing”): With your consent, we measure whether visitors who arrive via a Google ad submit an enquiry or an order. For this purpose, Google sets cookies (including _gcl_au, storage period of up to 90 days). When an order is placed, Google receives the order value and the order number so that an order is not counted twice. We do not pass names, addresses, email addresses or telephone numbers on to Google. In Google Ads we see only aggregated figures. Google uses this data as an independent controller for its own purposes as well, for example to improve its advertising services.

Meta Pixel (category “Marketing”): With your consent, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel measures whether visitors who arrive via an ad on Facebook or Instagram submit an enquiry or an order, and helps us show our ads to people who are interested in our wines. For this purpose, your browser transmits information to Meta, for example the page viewed, your IP address, details about your browser and device, and identifiers from cookies (including _fbp, storage period of up to 90 days). If you are logged in to Facebook or Instagram, Meta can assign the visit to your account and also use it for its own purposes, such as advertising. We do not use advanced matching with customer data: names, email addresses, telephone numbers, order numbers and entries from the order form are not transmitted to Meta; when an order is placed, Meta receives only the order value. We are jointly responsible with Meta for collecting the data and transmitting it to Meta (Art. 26 GDPR). You can find the agreement on this at facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing. Further information: facebook.com/privacy/policy.

The legal basis for these services is your consent under Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Data may be transferred to Google LLC, Microsoft Corporation and Meta Platforms, Inc. in the USA. All three companies are certified under the EU-US Data Privacy Framework, so the European Commission has issued an adequacy decision for the USA (Art. 45 GDPR). Should this decision be repealed, we will base transfers on the providers' Standard Contractual Clauses or stop using the services. Further information: policies.google.com/privacy.

Technically necessary storage: Without consent, the website stores in your browser (localStorage) only what is necessary for it to function: the age confirmation (age_verified), your language (jpb-lang), the contents of your crate or order (jpb-bestellung), a discount code you have entered (jpb-gutschein) and your choice in the cookie notice (jpb-consent). This data does not leave your device. Legal basis: Section 25(2) no. 2 TDDDG.

4. Contact by form, email, telephone or WhatsApp

The pages for business clients and hospitality have contact forms. You do not send anything yourself: when you tap the button, your email program opens with a ready-made message. We receive it only once you send it. The same applies if you write to us directly by email, call us or write to us on WhatsApp (for WhatsApp, see section 5). The buttons for enquiries about wine tastings and corporate gifts open WhatsApp or your email program with a template that does not yet contain any personal data.

We use your details to answer your enquiry and, where applicable, to prepare an offer. The legal basis is Art. 6(1)(b) GDPR if a contract is involved, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). Google manages our emails on our behalf (section 10). The AI assistant Claude helps us with replies (section 11). With your consent to “Statistics”, we count that a form has been submitted, without its content.

We delete enquiries that do not lead to a contract once they have been dealt with, after 2 years at the latest. If a contract results, the retention periods from section 5 apply.

5. Orders by WhatsApp and email

Order page: On our order page you put together your order. From your entries (name, addresses, email, selection, note), the page creates a ready-made message in your browser. Your shopping basket and your age confirmation are stored locally in your browser (localStorage) until you delete them. A discount code you enter is saved in your browser's local storage (jpb-gutschein) so that it is retained while you continue browsing (technically necessary). It is deleted when you remove it or when the code expires, and it is transmitted to us with your order enquiry.

Order by email: If you choose “Order by email”, the page transmits this message in encrypted form (HTTPS) to our web server. The web server sends it to us by email and sends a copy to your email address. We do not store the order on the web server. As protection against misuse, the server stores an encrypted value (hash) of your IP address and the time of the request for no longer than 24 hours. Legal basis: Art. 6(1)(b) GDPR (order) and Art. 6(1)(f) GDPR (legitimate interest in protection against misuse).

If you choose the WhatsApp route, your entries are not transmitted to our web server.

WhatsApp: If you tap “Send order enquiry via WhatsApp”, WhatsApp opens, a service of WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland. We receive your order enquiry only once you send the message there. We use the WhatsApp Business App for this. Message contents are end-to-end encrypted. However, WhatsApp processes metadata (for example telephone number, time, device information) and may transfer data to Meta Platforms Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework. Details: WhatsApp Privacy Policy.

Alternatives: You can also place your order by email to hello@jpbwinemaking.com or by telephone. In that case, no processing by WhatsApp takes place.

We use your data exclusively to process and fulfil your order (offer, invoice, shipping). We need your name, billing and delivery address and email address to conclude and perform the contract. Without these details, we cannot accept your order. The note is optional. For shipping, we transmit your name and delivery address to the commissioned parcel carrier (usually DPD Deutschland GmbH, in individual cases UPS).

PayPal: If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, processes your payment data. PayPal's privacy statement applies.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps and performance of the contract) and Art. 6(1)(c) GDPR (statutory retention obligations).

Retention period: We keep invoices and other accounting records for 8 years, offers, order confirmations and the related correspondence (including chat histories containing an offer and acceptance) for 6 years, and books and annual financial statements for 10 years (Section 147 AO (German Fiscal Code), Section 257 HGB (German Commercial Code), Section 14b UStG (German VAT Act)). The periods begin at the end of the calendar year. We delete everything else as soon as the order has been completed and the 2-year warranty period has expired.

6. Wine tastings

You book wine tastings with us by WhatsApp, email or telephone. For this we process your name, your contact details, date, place, format and number of people, and for a tasting at your home also your address. We need this to plan, carry out and invoice the tasting (Art. 6(1)(b) GDPR). Payment is made in advance by bank transfer or PayPal (see section 5). For tastings that we hold with partners, such as the tea and wine tasting, we pass on only what the partner needs to carry it out, for example date, number of people and allergies.

Allergies and intolerances: So that we can choose food and drinks safely, we ask you to tell us about the participants' allergies and intolerances. This is health data. We process it only with your explicit consent, which you give by providing the information (Art. 9(2)(a) GDPR), use it only for the event in question and delete it after the tasting, unless it forms part of records that we are required to keep. If you give us details about other participants, please agree this with them beforehand. You can withdraw your consent at any time; we will then no longer be able to take the allergies into account when making our selection.

Retention period otherwise as in section 5.

7. Corporate gifts

When we send wine gifts for a company, we receive from the company a list with the recipients' names and delivery addresses and the text for the greeting card. We use this data only to pack the parcels, write the cards and send the gifts. The legal basis is Art. 6(1)(b) GDPR towards the company and Art. 6(1)(f) GDPR towards the recipients (the company's interest and our interest in delivering the gift). Name and delivery address go to the parcel carrier (section 5). We do not use the recipient data for advertising. We delete the recipient list 3 months after dispatch, unless it forms part of the invoice.

8. Card payment on site

If you pay by card or phone at wine tastings or events, we use SumUp (SumUp Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, D02 K580, Ireland). SumUp processes your payment data (for example truncated card number, amount and time) as an independent controller for payment processing and fraud prevention. We receive only the payment receipt. The legal basis is Art. 6(1)(b) and (c) GDPR. If you would like a receipt by email or SMS, enter your address or number directly with SumUp. Further information: SumUp's privacy statement.

9. Withdrawing from a contract via the website

If you submit a withdrawal via “Withdraw from contract”, we process your name, the order number or order date, your email address for the confirmation of receipt and, if provided, your postal address and the wines concerned. The web server sends us the declaration by email and sends you a confirmation of receipt with date and time; the withdrawal itself is not stored on the web server. As protection against misuse, the server stores an encrypted value (hash) of your IP address and the time for no longer than 24 hours. The legal basis is Art. 6(1)(b) and (c) GDPR (Section 356a BGB (German Civil Code)) and, for protection against misuse, Art. 6(1)(f) GDPR. Retention period as for order data (section 5).

10. Email, calendar and storage

For emails (hello@jpbwinemaking.com), appointments, documents and spreadsheets, we use Google Workspace provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Enquiries, orders, invoices and address lists are also stored there. Google processes this data on our behalf on the basis of Google's data processing terms (Art. 28 GDPR). A transfer to Google LLC in the USA is possible; Google is certified under the EU-US Data Privacy Framework (see section 3). The legal basis is Art. 6(1)(b) and (f) GDPR.

11. Use of artificial intelligence

For our work we use the AI assistant Claude provided by Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, on the business plan (Claude Team). With Claude we write and translate texts, create images and videos, sort enquiries and orders, prepare offers and invoices and draft replies to emails. For this purpose, Claude is connected to our email inbox, our calendar and our storage in Google Workspace (section 10). In doing so, Claude may process contents of your messages and of our documents, such as name, contact details, addresses, orders and appointments.

We check every reply, every offer and every invoice ourselves before we send it. We ourselves decide on orders, prices and appointments; the AI does not decide anything about you on its own (see “Automated decisions” in section 16).

Anthropic processes the data on our behalf on the basis of a data processing agreement (Art. 28 GDPR) and does not use it to train its AI models. Data may be transferred to Anthropic, PBC in the USA. This is safeguarded by the European Commission's Standard Contractual Clauses in the data processing agreement (Art. 46(2)(c) GDPR). Chats remain stored until we delete them; Anthropic then removes them from its systems within 30 days. Anthropic deletes working sessions with Claude Code after 30 days.

The legal basis is Art. 6(1)(b) GDPR where we use it to handle your enquiry, order or wine tasting, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to work quickly and carefully as a small business. You can object to this under Art. 21 GDPR; we will then handle your request without AI. A short message to hello@jpbwinemaking.com is enough.

We label images and videos that were created with AI and could look like real recordings as AI-generated.

12. Emails to customers

If you have ordered from us, we occasionally send you news about our own wines and wine tastings by email. The legal basis is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG (German Act Against Unfair Competition). You can object at any time, and this incurs no costs other than the transmission costs at the basic rates. A short reply such as “Stop” to the email or a message to hello@jpbwinemaking.com is enough.

13. Embedded content

YouTube: On the home page we show a video from YouTube. The preview image is hosted on our own server. The video itself loads only when you tap the preview image (2-click solution). Only then is data transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (including IP address; YouTube may set cookies). The legal basis is your consent by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google's privacy policy applies.

Spotify: On the page for the wine Captain Lucy you can listen to a song via Spotify. The Spotify player is loaded only after you click (2-click solution). Only then is data transmitted to Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden (IP address, cookie data). The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Spotify's privacy policy applies.

Fonts: This website uses fonts such as Space Grotesk, whose files are hosted locally on our server. No connection to Google servers is made.

Winestro partner seal: In the footer of some pages we show the Winestro partner seal. The image is hosted on our own server. Only when you click it does the Winestro page open; Winestro's privacy policy applies there.

Cosmos: On some wine pages (Cosmonat, The Dark Natter, Venus), a photo from the service Cosmos (cosmos.so) is loaded. In the process, your IP address is transmitted to the Cosmos server. The legal basis is Art. 6(1)(f) GDPR (our interest in an attractive presentation). Cosmos's privacy policy applies.

14. Instagram

We have a profile on Instagram (@jpb_winzergram), a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. On this website, Instagram is only linked; Meta's rules apply only once you open the link. The legal basis for our profile is Art. 6(1)(f) GDPR: our legitimate interest is to show our wines and wine tastings and to get in touch with you. For the statistics on our profile (Insights), we are jointly responsible with Meta (Art. 26 GDPR). You can find the agreement on this at facebook.com/legal/terms/page_controller_addendum.

15. Advertising by post to businesses

I occasionally write to businesses by post, for example with a postcard about Christmas gifts for customers. For this I use the company name, postal address and the name of the managing director, as they appear in the company's publicly accessible legal notice.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR), on this website via “Cookie settings” in the footer, otherwise by email. To do so, write to us at hello@jpbwinemaking.com.

Right to object (Art. 21 GDPR)

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data, unless we have compelling legitimate grounds or need it for legal claims. You can object to the use of your data for advertising by post or email at any time without giving reasons; we will then no longer use your data for this purpose.

Complaint: You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, datenschutz.rlp.de.

Automated decisions: We do not make decisions based solely on automated processing, and we do not carry out profiling within the meaning of Art. 22 GDPR.

17. SSL encryption

For security reasons, this website uses SSL encryption (HTTPS). As a result, data that you transmit to us is transferred in encrypted form.