Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection laws is:

Grape Collective GmbH
Wellhausenweg 47
28357 Bremen
Germany

Managing Director: Sebastian Mohr

Phone: +49 (0)170 565 27 62
Email:

2. General information on data processing

Protecting your personal data is important to us. We process personal data only in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Personal data means any information relating to an identified or identifiable natural person.

This Privacy Policy explains which personal data is processed when you visit our website, the purposes of that processing and your rights.

3. Hosting and server log files

Our website is hosted by ALL-INKL.COM.

When you access our website, the hosting provider may process technically necessary data and store it in server log files. This may include, in particular:

  • IP address of the device used to access the site
  • date and time of access
  • page or file accessed
  • amount of data transferred
  • browser type and version
  • operating system used
  • referrer URL
  • hostname of the computer accessing the site
  • status messages indicating whether the request succeeded or failed

This data is processed in particular to ensure the technically reliable and secure provision of the website, as well as its stability and IT security.

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest is in providing a secure, stable and technically reliable website.

Hosting provider:
united-domains AG
Gautinger Straße 10
82319 Starnberg
Germany

Further details on the specific technical hosting infrastructure and retention periods can be found in the hosting provider’s privacy information.

4. WordPress

Our website uses the WordPress content management system.

Based on the current technical configuration, the basic plugins we use do not process additional visitors’ personal data for analytics, profiling or marketing purposes.

If the technical configuration of the website changes or we use additional plugins or services in the future, we will assess their data protection implications before activation and update this Privacy Policy where necessary.

5. Contact by email or telephone

If you contact us by email or telephone, we process the personal data you provide to the extent necessary to handle your enquiry.

This may include, in particular, your name, contact details, company, role and the content you provide.

The legal basis depends on the reason for your enquiry. If you contact us in connection with entering into or performing a contract, processing is based on Article 6(1)(b) GDPR.

In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is in handling and responding to business enquiries and communicating with prospective customers, customers and business partners.

The data will be deleted when it is no longer needed for the relevant purpose, unless statutory retention obligations or other legal grounds prevent deletion.

We do not use a contact form on our website.

6. Fonts

Google Fonts and other web fonts used on our website are hosted locally on our web server.

When you visit our website, no connection is therefore made to Google’s servers or those of other external font providers to load these fonts.

7. Links to social networks

Our website contains links to our company profiles on LinkedIn and Instagram.

These are ordinary links. Content from the social networks is not embedded directly in our website.

Only when you actively click a link do you leave our website and reach the relevant provider. From that point, the provider may process personal data in accordance with its own privacy policy.

The provider of LinkedIn is:
LinkedIn Ireland Unlimited Company
Wilton Place
Dublin 2
Ireland

The provider of Instagram is:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland

Please refer to the respective providers’ privacy information.

8. Cookies and similar technologies

Based on the current technical configuration, we do not use cookies or similar technologies requiring consent for analytics, tracking or marketing purposes on our website.

Where strictly necessary technologies are used, this is only to the extent required to provide the website or its functions that you have expressly requested.

If we use services requiring consent in the future, they will be loaded or run only after you have given your prior consent. In that case, we will use an appropriate consent management system.

You may withdraw consent at any time with effect for the future.

9. Analytics and tracking services

We currently do not use Google Analytics or comparable analytics, tracking or marketing services.

If we use such services in the future, they will be activated only after your express consent, where legally required. This Privacy Policy will then be updated accordingly.

10. Recipients of personal data

Personal data is disclosed to third parties only where necessary to provide and operate our website, where we are legally obliged to do so, where necessary to perform a contract, or where another applicable legal basis or consent exists.

Service providers engaged by us may process personal data on our behalf as part of the technical operation of the website.

11. Retention period

As a rule, we store personal data only for as long as necessary for the relevant processing purpose.

Data may be stored for longer where statutory retention obligations apply or where continued storage is necessary to establish, exercise or defend legal claims.

The data will be deleted once the relevant purpose no longer applies and any statutory retention periods have expired.

12. Your rights

Subject to the applicable legal requirements, you have, in particular, the right to:

  • access the personal data we process about you under Article 15 GDPR;
  • rectification of inaccurate data under Article 16 GDPR;
  • erasure of your data under Article 17 GDPR;
  • restriction of processing under Article 18 GDPR;
  • data portability under Article 20 GDPR; and
  • object to certain processing under Article 21 GDPR.

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future under Article 7(3) GDPR.

13. Right to object

Where we process personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right, subject to the conditions of Article 21 GDPR, to object to that processing at any time on grounds relating to your particular situation.

To exercise your rights, you may contact us at:
info@grape-collective.com

14. Right to lodge a complaint with a supervisory authority

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

The data protection supervisory authority responsible for our company is:

The State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen
Georgstraße 122–124, 27570 Bremerhaven

15. Data security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other risks.

Data transmitted between your browser and our website is encrypted via HTTPS where technically available.

16. Updates and changes to this Privacy Policy

We reserve the right to amend this Privacy Policy if legal requirements, the technical design of our website or the services we use change.

Last updated: September 2026