Privacy policy

Bosmen GmbH, trading as Sultan Drinks, is responsible for the processing described here. This policy covers our website, online shop and enquiries sent to us.

Privacy contact: Mag. Dr. Imran Daris Mehic, MBA.

When you visit, our servers receive technical information such as your IP address, requested page, date and time, browser and operating system, referring page and response status. We use this information to deliver the website, diagnose errors and protect it from abuse.

Our hosting provider is Hetzner Online GmbH, Germany. Hosting and technical service providers process the information needed to operate the website on our behalf. See Hetzner’s privacy information.

The legal basis is our legitimate interest in a secure, reliable website under Article 6(1)(f) GDPR. Technical records are kept for operational troubleshooting and security investigations, and no longer than needed for those purposes.

When you create an account or place an order, we process your name, email address, login credentials, telephone number where provided, billing and delivery addresses, and any company details you enter. We also process your basket, purchased products, prices, discounts, delivery choices, payment status and order history.

We use these details to manage your account, fulfil your order, arrange delivery, handle returns and answer order-related questions. The legal basis is Article 6(1)(b) GDPR (performing a contract or taking steps at your request before a contract), and Article 6(1)(c) GDPR for accounting and other legal obligations.

Required checkout details are necessary to accept and deliver your order. Without them, we cannot complete the purchase. Optional fields are identified in the relevant form.

Delivery partners receive the contact and address details needed for delivery. Order details are also processed in our order-management and accounting systems. Where connected, these include KassaPro and our WordPress/WooCommerce order-management system; they receive customer and address details, order items, totals and payment status to coordinate fulfilment and bookkeeping.

Depending on the method offered and selected at checkout, payments are handled by Mollie B.V. (Netherlands) or Stripe. The provider receives the transaction amount, order reference, billing and contact details needed for the payment, as well as payment and technical data collected through its payment form or checkout page.

Card details entered into Stripe’s payment fields are sent directly to Stripe. Mollie payments take place through its payment flow. Our shop receives payment references and status information so we can confirm orders and process refunds.

Our legal basis is Article 6(1)(b) GDPR. Payment providers also process data for their own fraud-prevention and legal obligations; their role and retention rules are explained in the Mollie privacy statement and Stripe privacy policy.

If you contact us, including about distribution, we process your name, email address, optional phone number, message, language and the form you used. We use these details to respond and keep track of your enquiry. Twilio SendGrid delivers contact-form messages and acknowledgements; Brevo delivers order confirmation emails. These providers receive recipient details and the relevant message or order content, and process delivery information.

Contract-related enquiries and order emails are processed under Article 6(1)(b) GDPR. For other enquiries, our legitimate interest in responding to you is the basis under Article 6(1)(f) GDPR. Contacting us or placing an order does not subscribe you to a newsletter.

Provider information: Twilio SendGrid and Brevo.

Our contact forms use Cloudflare Turnstile to distinguish people from automated requests. Cloudflare processes technical signals, including IP address, browser and device information and challenge results. We receive a verification result before accepting a form submission. Turnstile does not receive the contents of your form fields as part of this check.

Our legal basis is our legitimate interest in preventing spam, misuse and attacks under Article 6(1)(f) GDPR. Cloudflare also processes signals to improve its bot detection as described in the Turnstile privacy addendum.

Cookies and similar browser storage keep your basket, sign-in and language choice working. Necessary storage supports the service you request under § 165(3) TKG 2021; the related personal-data processing relies on Article 6(1)(b) or (f) GDPR, depending on its purpose. Optional analytics cookies require your consent under Article 6(1)(a) GDPR and § 165(3) TKG 2021.

Cookiebot, provided by Usercentrics A/S in Denmark, manages cookie choices. It processes browser and request information and records your consent choice with an identifier and timestamp. Its consent record supports our legal duty to document consent (Article 6(1)(c) GDPR). The consent dialog lists detected cookies, their providers, purposes and durations. See Cookiebot’s privacy policy.

You can refuse optional cookies or change your choice at any time. Withdrawing consent does not affect processing that was lawful before withdrawal. Browser settings also let you delete or block cookies; blocking necessary cookies can affect sign-in and checkout. Cookie expiry does not by itself delete records held in our systems.

We use Google Tag Manager to load Google Analytics 4, provided in the EEA by Google Ireland Limited. Analytics helps us understand which pages are used and improve the shop. It processes page views, interactions, referring pages, device and browser information, approximate location and, where you allow analytics cookies, identifiers that distinguish visits.

Analytics cookies are subject to your consent (Article 6(1)(a) GDPR). Our Google configuration uses consent mode with optional storage denied by default. Google tags can still send cookieless consent and measurement signals when consent is denied. Refusing analytics cookies therefore does not necessarily prevent all requests to Google.

Analytics cookie durations are shown in the cookie dialog. Stored user and event data are subject to the retention settings in our Analytics property; aggregated reports can be retained separately. You can change your consent using the button above. Further details are available in Google’s privacy policy and its consent-mode explanation.

Our contact page embeds Google Maps, and the store locator loads map tiles from the OpenStreetMap Foundation. When a map loads, your browser connects to that provider and sends your IP address, browser information and the requested map area. Google can also process cookies or associate activity with a Google account if you are signed in.

We display maps to help you find us and our stockists, based on our legitimate interest under Article 6(1)(f) GDPR. Any non-essential storage or access on your device requires consent under § 165(3) TKG 2021. Analytics consent settings do not automatically prevent these separate map connections.

Our website also shows YouTube videos. A preview image can connect your browser to YouTube before playback; starting a video loads the YouTube player and sends technical and playback information to Google. Other videos and media are delivered by Cloudflare, which receives the IP address and request information needed to deliver the files. We use this media to present our drinks and projects (Article 6(1)(f) GDPR); non-essential device storage or access requires consent. See Cloudflare’s privacy policy.

See Google’s privacy policy and the OpenStreetMap Foundation privacy policy. Links to our social media pages take you to the relevant platform, where its own privacy rules apply.

Access to personal data is limited to the people and service providers who need it for the purposes described above. Recipients include hosting and IT providers, payment and delivery services, email providers and our order-management and accounting providers. We may also disclose information to professional advisers or public authorities where needed to comply with the law or establish, exercise or defend legal claims (Article 6(1)(c) or (f) GDPR).

Providers such as Google, Cloudflare, Twilio and Stripe may process data outside the European Economic Area, including in the United States. Such transfers require a basis under Chapter V GDPR, such as an applicable adequacy decision or the European Commission’s standard contractual clauses with any necessary additional safeguards. The EU–US Data Privacy Framework applies only where the receiving organisation holds a current certification covering the relevant data.

Provider notices linked above describe their international processing. Contact us for information about the safeguards that apply to your data or to request a copy.

Retention depends on why the data was collected and whether we have a continuing contractual or legal need for it:

• Account information is kept while your account is used and as needed to resolve outstanding orders or claims. You can ask us to close your account.
• Enquiries and correspondence are kept until the matter is resolved, and longer where needed as a business record or for legal claims.
• Accounting records and invoices are generally retained for seven years from the end of the relevant calendar year under Austrian law, and longer where required for pending proceedings.
• Security records are kept as needed to investigate and prevent incidents. Browser-storage lifetimes are listed above; provider-held information follows the applicable service and legal retention rules.

When a purpose ends, data is deleted or anonymised unless a retention duty or unresolved legal claim requires us to keep it. Where deletion is restricted by law, the retained data is used only for those remaining purposes.

Subject to the conditions in the GDPR, you have the right to:

• Access your personal data and receive a copy.
• Correct inaccurate data and complete incomplete information.
• Request deletion or restriction of processing.
• Receive data you provided in a portable format where processing is automated and based on consent or a contract.
• Withdraw consent at any time, without affecting the lawfulness of earlier processing.

Right to object: You may object to processing based on legitimate interests for reasons related to your particular situation. You may object to direct marketing at any time, including profiling connected with it.

Send requests to info@sultan-drinks.com. We may need information to verify your identity before releasing or changing personal data. We normally respond within one month; where a lawful extension is necessary, we will explain it within that period.

You can complain to a supervisory authority, including the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, or the authority in the country where you live or work. You do not have to contact us first.

Our shop does not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Payment and security providers may carry out their own fraud checks, as explained in their notices.

We update this policy when our services or processing change. The date at the top identifies this version. The legal references on this page refer to the General Data Protection Regulation (GDPR) and Austrian law.