Privacy policy

Last updated: October 22, 2026

This Privacy Policy explains how Winest GmbH, operating the WYNCH online store at https://wynch.wine (the "Site", "WYNCH", "we", "us" or "our"), collects, uses and protects personal data when you visit the Site, place an order, create an account, join our loyalty program, contact us or otherwise use our services (the "Services").

Controller

The controller responsible for the processing of personal data is:

Winest GmbH
Schönhauser Allee 163
10435 Berlin
Germany

Email: hi@wynch.wine
Phone: +49 1522 2062544
Commercial register: Amtsgericht Berlin-Charlottenburg, HRB 266522 B
VAT ID: DE452730429

What Personal Data We Process

Depending on how you use the Services, we may process the following categories of personal data:

  • Contact details, such as name, email address, telephone number, billing address and delivery address.
  • Order and payment-related information, such as ordered products, order history, delivery status, payment confirmation and refund information. Payment card data is processed by our payment service providers and is not stored by us in full.
  • Account and loyalty program information, such as account login data, saved preferences, rewards, credits, referrals and communication preferences.
  • Customer support information, such as messages, requests, complaints and feedback you send to us.
  • Technical and usage data, such as IP address, device information, browser type, pages viewed, referring URLs, cookie identifiers and similar analytics information.
  • Marketing interaction data, such as newsletter subscriptions, consent records, email engagement and advertising preferences.

How We Use Personal Data

We process personal data for the following purposes:

  • To operate the Site and provide the Services.
  • To process orders, payments, delivery, returns, refunds and customer accounts.
  • To verify age or eligibility where required for the sale and delivery of alcoholic beverages.
  • To provide customer support and respond to inquiries.
  • To administer loyalty, referral, gift card or promotional features.
  • To send service messages, order confirmations and transactional notifications.
  • To send marketing communications where you have consented or where permitted by law.
  • To improve, secure and personalize the Site and Services.
  • To prevent fraud, misuse and unauthorized access.
  • To comply with legal obligations, tax, accounting and regulatory requirements.

Legal Bases

Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

  • Performance of a contract or steps prior to entering into a contract, for example to process orders and provide customer accounts.
  • Compliance with legal obligations, for example tax, accounting, consumer protection and age-related obligations.
  • Your consent, for example for certain cookies, newsletters or marketing communications.
  • Our legitimate interests, for example to secure the Site, prevent fraud, improve our Services and respond to customer inquiries, provided that your interests and fundamental rights do not override those interests.

Cookies And Similar Technologies

We use cookies and similar technologies to operate the Site, remember preferences, analyze performance, support checkout, prevent fraud and provide marketing features. Some cookies are necessary for the Site to work. Other cookies are used only where permitted by law or where you have given consent. You can adjust cookie settings in your browser and, where available, through our cookie preference tools.

Shopify powers our store and may use cookies and similar technologies to provide the ecommerce platform. More information about Shopify cookies is available at https://www.shopify.com/legal/cookies.

Recipients And Service Providers

We may share personal data with service providers and partners who help us provide the Services, including:

  • Shopify, our ecommerce platform provider.
  • Payment processors and fraud prevention providers.
  • Shipping, logistics and fulfillment providers.
  • Email, SMS, customer support and marketing service providers.
  • Analytics, advertising and cookie technology providers, where permitted.
  • Professional advisers, authorities, courts or regulators where required by law or necessary to protect our rights.

These recipients process data only as permitted by applicable law and, where required, under appropriate data processing agreements.

International Transfers

Some service providers may process personal data outside the European Economic Area. Where this happens, we rely on appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses or other transfer mechanisms recognized by applicable data protection law.

Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, including to provide the Services, comply with legal retention obligations, resolve disputes and enforce agreements. Retention periods may differ depending on the type of data and applicable legal requirements.

Your Rights

Subject to applicable law, you may have the right to:

  • Request access to your personal data.
  • Request correction of inaccurate personal data.
  • Request deletion of your personal data.
  • Request restriction of processing.
  • Object to processing based on legitimate interests.
  • Withdraw consent where processing is based on consent.
  • Receive personal data in a portable format where applicable.
  • Lodge a complaint with a data protection supervisory authority.

To exercise your rights, contact us at hi@wynch.wine. We may need to verify your identity before responding.

Marketing Communications

If you subscribe to marketing communications, you may unsubscribe at any time using the unsubscribe link in our messages or by contacting us. Even if you opt out of marketing, we may still send transactional or service-related messages, such as order confirmations and delivery updates.

Children

The Services are not intended for children. We do not knowingly collect personal data from children. Because we sell alcoholic beverages, customers must meet the applicable legal age requirements for purchasing alcohol.

Security

We use technical and organizational measures designed to protect personal data. However, no online service can be guaranteed to be completely secure. Please contact us immediately if you believe your account or data has been compromised.

Third-Party Links

The Site may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. Please review their privacy notices before providing personal data.

Changes To This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date.

Contact

If you have questions about this Privacy Policy or our data protection practices, contact:

Winest GmbH
Schönhauser Allee 163
10435 Berlin
Germany
Email: hi@wynch.wine
Phone: +49 1522 2062544

Personalised WYNCH advertising and advertising audiences

If you expressly and voluntarily consent to personalised wine offers and advertising from WYNCH, Winest GmbH may use the data, contact channels and advertising platforms specifically described in that consent. A shared advertising consent may cover messages by email, SMS, WhatsApp and Telegram, personalised platform advertising, contact matching, retargeting and remarketing, audience creation and updates, audience inclusions and exclusions, and campaign measurement. The legal basis is Article 6(1)(a) GDPR.

Where contact matching is already covered by your valid, expressly given shared advertising consent, no additional separate consent is required for that matching or for each individual audience inclusion or exclusion within the agreed scope. A newsletter subscription without this expressly described scope, a purchase, a customer account or merely reading this Privacy Policy does not grant that permission. Updating this Privacy Policy does not expand previously given consent.

Within the consented scope, contact details, email opens and link clicks, purchases and WineMatcher preferences may be combined in your recipient profile, including in Klaviyo, to personalise WYNCH offers and measure their effectiveness. For contact matching, only an email address or telephone number lawfully available to us and covered by the relevant consent may be shared in hashed form with the named advertising platforms. The platforms match these identifiers with their user accounts to show WYNCH advertising or include or exclude matching accounts from audiences. Hashing is pseudonymisation, not anonymisation; not every identifier can be matched.

The envisaged advertising platforms are Google, including YouTube and the Google advertising network (Google Ireland Limited), Meta with Facebook and Instagram (Meta Platforms Ireland Limited), and TikTok (TikTok Technology Limited and TikTok Information Technologies UK Limited). Only functions actually configured and covered by the relevant consent are used. Further information: Google, Meta and TikTok. Similar audiences (lookalikes) are covered only if expressly included in the relevant advertising consent. Non-essential website pixels, cookies and comparable technologies remain subject to the applicable consent requirements, including section 25 TDDDG; a newsletter confirmation does not automatically activate them.

Messages are sent only through contact channels actually offered and permitted for the relevant product and country, using contact details you have provided and that can be reliably attributed to you. Email double opt-in alone does not verify ownership of a telephone number or messenger account. Alcohol-related marketing through WhatsApp is currently not part of our offering in Germany because of the platform's restrictions.

You may withdraw your consent wholly or partly at any time with effect for the future via the available unsubscribe function or hi@wynch.wine. We stop the processing covered by the withdrawal, stop new matching uploads for that purpose and remove the affected contacts from our corresponding customer-list audiences. Necessary internal suppression records may remain solely to honour and document the withdrawal; they do not authorise fresh external matching uploads. Withdrawal does not affect the lawfulness of earlier processing or prevent all advertising on a platform.

Audience data is used only while a valid legal basis and the relevant purpose remain. Necessary consent evidence may be retained separately to meet legal obligations or defend claims. International transfers must also satisfy Articles 44–49 GDPR, as explained above. Changes to campaigns, creative material or technical procedures remain within the expressly agreed scope; additional independent advertising platforms or materially different purposes require renewed assessment, information and, where necessary, updated consent.