Privacy policy

1. Controller and contact

The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Mastraan Imports, owner Mario Parent Wacholderweg 13F 14052 Berlin Germany Phone: +49 30 5562 0078 Email: contact@mastraan.com

We are not legally required to appoint a data protection officer and have not appointed one. If you have any questions about data protection, please use the contact details above.

2. General information on data processing

We process personal data only to the extent necessary to provide our website, process your orders or comply with legal obligations, or where you have given your consent.

Legal bases. We base processing on the following legal bases:

  • Art. 6(1)(a) GDPR: your consent
  • Art. 6(1)(b) GDPR: performance of a contract with you or pre-contractual measures
  • Art. 6(1)(c) GDPR: compliance with a legal obligation, such as retention obligations under commercial and tax law
  • Art. 6(1)(f) GDPR: our legitimate interests, unless your interests override them

Storing information on your device and accessing it (e.g. cookies) is based on § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) (consent) or, where strictly necessary, § 25(2) TDDDG.

Storage period. We delete personal data as soon as the purpose of storage no longer applies. Statutory retention obligations remain unaffected: under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO), we retain records for six, eight or ten years, depending on their type. During this period, we restrict processing to fulfilling these obligations.

Provision of data. To conclude a contract, we need the data marked as mandatory in the ordering process. Without this data, we cannot enter into a contract with you. We do not carry out automated decision-making, including profiling, under Art. 22 GDPR; for the check carried out by Klarna when paying by invoice, see section 6.

Encryption. For security reasons, our website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar.

3. Hosting and shop system (Shopify)

Our online shop runs on the Shopify platform. The provider for customers in the European Economic Area is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes all data you enter in the shop or that arises from its use on our behalf as a processor under Art. 28 GDPR.

Server log files. When you visit our website, information transmitted by your browser is recorded automatically: IP address, date and time of access, page visited, referrer URL, browser type and version, and operating system. This data is required to deliver the website and ensure its security and stability. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the shop.

Shopify may also transfer data to Shopify Inc. in Canada and to service providers in the USA. For the safeguards, see section 15.

We use cookies and similar technologies. These are small files or pieces of information that are stored on or read from your device.

Strictly necessary cookies are required for the shop to work, for example for the shopping cart, checkout, customer account login and saving your cookie choices. The legal basis is § 25(2) TDDDG in conjunction with Art. 6(1)(b) and (f) GDPR.

Optional cookies for statistics and marketing (see sections 12 and 13) are only set if you have consented via our cookie banner. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

You can change or withdraw your choice at any time with effect for the future via the "Cookie settings" link in the footer of our website. You can also delete or block cookies in your browser; some shop features may then not be available.

5. Orders, contract processing and customer account

Orders. When you place an order with us, we process your name, billing and delivery address, email address, optionally your phone number, and the order and payment information. We use this data to conclude and perform the contract, send you order and shipping confirmations and deal with queries. The legal basis is Art. 6(1)(b) GDPR; for retaining invoices and accounting records, Art. 6(1)(c) GDPR.

Our offer is intended exclusively for persons aged 18 and over. We do not knowingly collect data from minors.

Customer account. You can choose to create a customer account. It stores your addresses and previous orders so that you can order more quickly in future. The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time by sending a message to contact@mastraan.com. Data we are legally required to retain will only be deleted once these retention periods have expired.

Age verification. We only supply alcoholic beverages to persons aged 18 and over. For first orders from customers we do not know personally, we verify age before shipping, for example by phone or by viewing an ID document during a video call. We do not make a copy of the ID. We only store the note "age verified" with the date in your customer record. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 9 of the German Youth Protection Act (JuSchG).

6. Payment service providers

To process your payment, we pass the necessary data (name, address, email address, order number, invoice amount and payment details) to the payment service provider you have chosen. The legal basis is Art. 6(1)(b) GDPR. Some providers process your data under their own responsibility; their privacy notices also apply.

Shopify Payments (credit and debit cards, Apple Pay, Google Pay): payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. For Apple Pay, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, is also involved; for Google Pay, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Shop Pay: if you use Shop Pay, your data is stored by Shopify (Shopify International Limited, address in section 3) under its own responsibility so that you can pay more quickly for future purchases.

PayPal: the provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. For payment methods such as direct debit or pay by invoice via PayPal, PayPal may carry out an identity and credit check.

Klarna: the provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For pay by invoice or instalments, Klarna checks your identity and creditworthiness and may exchange data with credit agencies for this purpose. Klarna decides independently whether to accept the payment method. The legal basis is Art. 6(1)(b) and (f) GDPR; you have the right to express your point of view and to contest the decision by contacting Klarna.

7. Shipping and fulfilment

Logistics partner. Storage, picking and shipping of our goods are handled by Howasped Gesellschaft für Wein- und Industrielogistik GmbH & Co. KG, Schornsheimer Chaussee 11, 55286 Wörrstadt, Germany. For this purpose, it receives your name, delivery address and order data and processes them on our behalf as a processor under Art. 28 GDPR. The legal basis is Art. 6(1)(b) GDPR.

DHL. Delivery may be carried out by DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. In that case, we or our logistics partner pass your name and delivery address to DHL. The legal basis is Art. 6(1)(b) GDPR. We only pass on your email address or phone number if you have expressly consented to this during the ordering process, so that DHL can notify you about the delivery (Art. 6(1)(a) GDPR). You can withdraw this consent at any time, either to us or to DHL.

UPS and freight forwarders. Orders of up to 36 bottles are shipped by our logistics partner with United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany. For orders of more than 36 bottles, our logistics partner arranges a special transport with a freight forwarder commissioned for each shipment. These recipients receive your name and delivery address and, for freight deliveries, your phone number so that a delivery appointment can be arranged with you. The legal basis is Art. 6(1)(b) GDPR.

8. Withdrawal function

If you declare a withdrawal using the withdrawal function on our website ("Withdraw from contract"), we process the data you provide (name, order or contract number, email address and, where applicable, the items concerned) as well as the date and time of receipt. The purpose is to process your withdrawal, send you the legally required acknowledgement of receipt on a durable medium (§ 356a of the German Civil Code, BGB) and document receipt. The legal basis is Art. 6(1)(c) GDPR and Art. 6(1)(b) GDPR.

For technical processing and logging, we use Google Workspace (Google Apps Script and Google Sheets) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor. We send the acknowledgement of receipt via Brevo (Sendinblue SAS, Paris, France), also as a processor. Data processing agreements under Art. 28 GDPR are in place with both providers. A transfer to Google LLC in the USA cannot be ruled out (see section 15).

We store this data for the statutory limitation period, usually three years from the end of the year in which the withdrawal was declared. Where the data is relevant under commercial or tax law, the retention periods in section 2 apply.

9. Contacting us

If you contact us by email, phone or via the contact form, we process the information you provide (such as your name, email address, phone number and the content of your message) in order to answer your enquiry. If the enquiry relates to a contract or its initiation, the legal basis is Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering enquiries. We delete the data once your enquiry has been fully dealt with, unless statutory retention obligations apply.

10. Newsletter

With your consent, we send you our newsletter with information about products, new arrivals and offers. The legal basis is Art. 6(1)(a) GDPR.

Double opt-in. After signing up, you receive an email asking you to confirm your subscription. Only then will you receive the newsletter. We store the time and IP address of the sign-up and confirmation so that we can prove your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Sending and analysis. We send the newsletter via Shopify Email (Shopify International Limited, address in section 3) as a processor. This records whether and when an email was opened and which links were clicked. This analysis is part of your consent and helps us improve our newsletters.

You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by sending a message to contact@mastraan.com. After you unsubscribe, we remove your email address from the mailing list; we keep the proof of your earlier consent for up to three years.

11. Customer reviews (Judge.me)

For product reviews, we use the Judge.me service provided by Judge.me Ltd, c/o Buckworths, 2nd Floor, 1-3 Worship Street, London EC2A 2AB, United Kingdom, as a processor under Art. 28 GDPR.

Review request. If you agreed to receive emails from us when placing your order, we send you an email about 14 days after shipping, inviting you to review the products you bought. For this purpose, we pass your name, email address and order details to Judge.me. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by sending a message to contact@mastraan.com.

Submitting a review. When you submit a review, we process your name, email address, your review (stars and text) and, where applicable, photos or videos. The review and your name are published in the form you provide; your email address is not published. Based on the order data, we mark reviews from customers who bought the product from us as "Verified buyer". The legal basis is your consent given by voluntarily submitting the review (Art. 6(1)(a) GDPR), which you can withdraw at any time; we will then delete the review.

The data is stored for as long as the review is published. Transfers to the United Kingdom are covered by an adequacy decision of the European Commission. Judge.me uses some sub-processors in other countries, including the USA (see section 15).

12. Google Analytics and Google Ads

With your consent, we use services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. They are integrated via the Shopify app "Google & YouTube" using Google Consent Mode: without your consent, no cookies are set for these services. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

Google Analytics 4 analyses how visitors use our shop, for example pages viewed, time spent, device type and approximate location. IP addresses are not stored by Google Analytics 4. The data is deleted after 14 months.

Google Ads is used for advertising. With conversion tracking, we measure whether a visit via an ad led to a purchase. Remarketing allows us to show relevant ads to visitors of our shop on other websites.

Google may transfer data to Google LLC in the USA (see section 15). You can withdraw your consent at any time via the "Cookie settings".

13. Shopify marketing features

With your consent, we use Shopify's enhanced features. Shopify uses data about your interactions with our shop, with other merchants and with Shopify to enable personalised advertising and recommend products. Shopify is itself responsible for this processing, including responding to your requests regarding your rights. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

You can withdraw your consent at any time via the "Cookie settings". Further information and the option to exercise your rights with Shopify can be found at privacy.shopify.com.

14. Social media presence

Our website links to our profiles on Facebook, Instagram and X. These are simple links, not plugins: data is only transferred to the respective provider when you click a link.

We maintain these profiles to communicate with customers and prospective customers. The legal basis is Art. 6(1)(f) GDPR. The providers are:

  • Facebook and Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
  • X: Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland

For the statistics function of our Facebook and Instagram pages ("Page Insights"), we are joint controllers with Meta under Art. 26 GDPR. Under the agreement concluded with us, Meta assumes primary responsibility, in particular for fulfilling your rights. The providers may transfer data to the USA (see section 15).

15. Transfers to third countries

Some of the providers named above or their sub-processors process data outside the European Economic Area. We ensure an adequate level of data protection as follows:

  • United Kingdom (Judge.me Ltd): adequacy decision of the European Commission under Art. 45 GDPR
  • Canada (Shopify Inc.): adequacy decision of the European Commission under Art. 45 GDPR
  • USA (including Google LLC, Shopify, Stripe, PayPal, Meta, X, sub-processors of Judge.me): adequacy decision on the EU-U.S. Data Privacy Framework, where the recipient is certified under it; otherwise the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR

16. Your rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to contact@mastraan.com is sufficient.

Right to object under Art. 21 GDPR

Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing, you may object to this processing at any time without giving reasons. We will then no longer use your data for this purpose.

Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

17. Updates to this privacy policy

This privacy policy is current as of October 2026. We update it when our data processing or the legal situation changes. The version published on this website applies.