privacy policy
We process personal data only as far as is necessary to run this website and provide our services. This page explains which data that is, what we use it for and what rights you have. Last updated: 12 October 2026.
Controller
Bio-Weingut Frühwirth (Owner: Hans Frühwirth)
Wiener Neustädter Straße 75, 2524 Teesdorf, Austria
Phone: +43 2253 81216 · E-mail: info@fruehwirth.bio
Hosting and server logs
This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When you access the website, Vercel processes technically necessary access data (IP address, date and time, page accessed, browser type) and keeps the logs available to us for 30 days. The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). A data processing agreement is in place with Vercel; the transfer to the USA is based on the EU Standard Contractual Clauses.
Traffic measurement
We count how often our pages are visited and posts in the news feed are shown, swiped or tapped using Vercel Web Analytics, the same provider that hosts the website, so that we can improve what we offer (Art. 6 (1) (f) GDPR). This happens without cookies; a checksum derived from the request expires after 24 hours, and no profiles are created.
Contact
If you contact us by e-mail, telephone or via the contact form, we process your details to handle the enquiry and any follow-up questions (Art. 6 (1) (b) GDPR). Our e-mail account is run by Google (Google Workspace, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland); we keep e-mails there without a fixed deletion date. Messages from our forms (contact, order, reservation) are sent via Resend (see Newsletter). We sort incoming e-mails and orders with the help of processors (Anthropic, OpenAI and Google, processing also in the USA); the same applies to the content of telephone calls. We record telephone calls, transcribe them automatically and keep recording and transcript for ten years so that orders and reservations can be traced (Art. 6 (1) (f) GDPR). If you do not want that, please tell us. Our team listens to recordings and reads transcripts through a protected access provided by Cloudflare (Cloudflare, Inc., San Francisco, USA).
Customer management
To look after our customers we keep a customer register. It holds contact details (name, e-mail address, telephone number, postal address where applicable), notes on enquiries, orders and conversations, including summaries and in some cases transcripts of telephone calls, and a note on how you relate to us (for instance wine customer or Heuriger (wine tavern) guest). The details come from your orders, from your contacting us by e-mail or telephone, from the reservation form and from publicly accessible sources on the internet, where we look for missing e-mail addresses and telephone numbers with the help of Anthropic, OpenAI and Google (processing also in the USA).
The legal basis is the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) as well as our legitimate interest in orderly customer management (Art. 6(1)(f) GDPR).
As a processor, we use Attio for this purpose (Attio Limited, 42 St John's Square, 2nd Floor, London EC1M 4EA, United Kingdom); a data processing agreement is in place. The European Commission has issued an adequacy decision for the United Kingdom, so no additional safeguards are required for the transfer. The data is stored on servers within the EU (Ireland).
Wine post after a purchase. If you buy wine from us via the order form or in the web shop, we will send you the occasional wine post by e-mail about our own wines. Under § 174 (4) TKG 2021 this is permitted without a separate subscription, because we received your address with the purchase. The legal basis is our legitimate interest in advertising our own products (Art. 6 (1) (f) GDPR). You can decline this when you order (in the order form, „keine Weinpost“ (no wine post) in the remarks is enough) and at any time, free of charge, via the unsubscribe link in every wine post or with a short e-mail to info@fruehwirth.bio. Addresses listed in the RTR's ECG list do not receive wine post. All other entries in the customer register, for instance after a reservation or an enquiry, receive marketing e-mails only with a separate subscription (see Newsletter).
We keep entries in the customer register without a fixed deletion date. At your request we delete your entry promptly, unless a statutory retention obligation prevents this (see Your rights).
Receipts, business cards and photos
Invoices and delivery notes from companies, business cards and documents we receive at trade fairs, for example, as well as photos and files sent to us by customers or our team are read automatically so that we can sort and file them. For this we pass the image or file on to processors (Anthropic, OpenAI and Google, processing also in the USA). The legal basis is the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR), for receipts our statutory retention obligations (Art. 6 (1) (c) GDPR) and otherwise our legitimate interest in orderly record-keeping (Art. 6 (1) (f) GDPR). We keep receipts for at least seven years (§ 132 BAO), business cards and photos without a fixed deletion date.
Table reservation
Via the reservation form we process name, telephone number, requested date, time and number of people, and optionally e-mail address and remarks, for the purpose of making and handling the reservation (Art. 6 (1) (b) GDPR). To handle it we use our reservation system (Google Workspace as processor) and create tasks for our service team in Todoist (Todoist Inc., Wilmington, USA). We delete reservation data as soon as it is no longer needed for handling and proof.
If you are already in our customer register, we note there that you were a guest at our Heuriger (wine tavern). If you also tick the newsletter box in the form, we create an entry for you in the customer register with name, e-mail address and telephone number (see Customer records).
Newsletter
If you sign up for our newsletter, we process your e-mail address on the basis of your consent (Art. 6 (1) (a) GDPR). Sign-up uses a double opt-in procedure: you receive a confirmation e-mail and are only subscribed once you click the confirmation link. For sending we use Resend (Resend, Inc., USA) as processor; the transfer rests on the EU standard contractual clauses. You can unsubscribe at any time via the unsubscribe link in every e-mail or informally by e-mail to us; you can withdraw your consent at any time with effect for the future. After you unsubscribe, your address remains marked as unsubscribed with us and with Resend so that you no longer receive the newsletter.
Tractor Race
If you enter the leaderboard of the tractor race, we store your nickname, your email address, your time, the recording of your run (your steering inputs), the timestamps, your answers on “18 or over” and on the newsletter, and notes on whether a run looks suspicious. We need this for the leaderboard, the prize draw and protection against manipulation. Publicly we show only your nickname (the first word if there are several) and your time. Your entry appears on the leaderboard straight away. We use your email address only to notify you if you win; for the newsletter only if you tick that box separately. In that case we send you an email with a confirmation link. Only your click on it signs you up. We delete this data no later than three months after the race ends, the winners’ data only once the prize has been handed over. We count page views without cookies and without personal data.
The legal basis is your participation in the prize draw (Art. 6(1)(b) GDPR), for protection against manipulation our legitimate interest in a fair draw (Art. 6(1)(f) GDPR) and for the newsletter your consent (Art. 6(1)(a) GDPR). We store the entries in Google Workspace as a processor; the confirmation email for the newsletter is sent via Resend (see Newsletter).
On your device, the game stores your own best time and run in the browser (localStorage) so your ghost can ride along, and whether you have already seen the instructions. This data stays on your device and is not sent to us. If you have signed up for the leaderboard, the browser also keeps an identifier that our server calculates from your entry. When the leaderboard loads, the browser sends this identifier to our server. We use it to show you your own place in the list; your email address cannot be read from it. You can delete all of this in your browser settings.
Online shop and basket
The basket and your choice between light and dark display are stored in your browser. When you go to the checkout, the contents of the basket are passed to Shopify (Shopify International Ltd., 2nd Floor, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland), which handles the purchase as processor; in doing so we process the data needed to handle the order (Art. 6 (1) (b) GDPR) and keep it in line with statutory retention periods (in particular 7 years under § 132 BAO). We manage orders in our inventory system wineNET (winenet GmbH, Jois, Austria).
360° tour
On the page Premises we offer a 360° tour provided by 3D Swissmedia (Swissmedia Group AG, Switzerland). The tour is only loaded when you explicitly start it. Before that, no connection to this provider is made and no data is sent there.
If you start the tour, your IP address and technical details of your browser are sent to the provider and its service provider Cloudflare; in the process a cookie (cf_clearance, valid for one year) is set, which the provider uses to protect against automated access. The basis is your consent, which you give by starting the tour (Art. 6 (1) (a) GDPR, § 165 (3) TKG 2021). You can delete the cookie in your browser at any time; if you do not load the tour, it is never created.
Your rights
You have the rights to access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, simply contact info@fruehwirth.bio. If you believe that the processing of your data breaches data protection law, you can lodge a complaint with the Austrian data protection authority (www.dsb.gv.at).
Where we process your data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you can object on grounds relating to your particular situation; you can object to its use for advertising at any time without giving reasons.