Privacy policy of Destillerie Farthofer GmbH for visitors to the website www.destillerie-farthofer.at.

a. In this statement, we inform you about the collection of personal data when you use our website. Personal data is any data that can be related to you personally, e.g. name, address, email addresses, user behaviour.

b. The data controller pursuant to Art. 4 Para. 7 of the EU General Data Protection Regulation (GDPR) is Destillerie Farthofer GmbH, Mostviertelplatz 6, 3362 Öhling, office@destillerie-farthofer.at.

a. You have the following rights with respect to the personal data we hold about you:

• Right of access,

• Right to rectification or erasure,

• Right to restriction of processing,

• Right to object to processing,

• Right to data portability.

b. You also have the right to lodge a complaint with the data protection authority regarding the processing of your personal data or, where applicable, any violation of your data protection rights by us.

When you contact us by email or via a contact form, the data you provide (your email address, and where applicable your name, phone number, or other contact details) will be stored by us in order to respond to your enquiry. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR. For the sending and processing of these enquiries, we use the services of MailerSend (for email delivery) and Supabase (for storage) as data processors. We delete the data as soon as an enquiry has been fully dealt with, or as soon as any claims arising from a legal relationship established in connection with an enquiry no longer exist or can no longer arise.

a. When you use our website for purely informational purposes — that is, when you do not otherwise provide us with any information — we only collect the personal data that your browser transmits to our server. When you visit our website, we collect the following data, which is technically necessary for us to display our website and to ensure its stability and security (the legal basis is Art. 6 Para. 1 lit. f GDPR):

• IP address

• Date and time of the request

• Time zone difference from Greenwich Mean Time (GMT)

• Content of the request (specific page)

• Access status / HTTP status code

• Amount of data transferred in each case

• Website from which the request originates

• Browser

• Operating system and its interface

• Language and version of the browser software.

b. In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive, assigned to the browser you are using, and through which certain information is passed to the party that sets the cookie (in this case, us). Cookies cannot execute programmes or transmit viruses to your computer. They serve to make our online offering more user-friendly and effective overall.

c. Use of cookies: This website uses transient cookies, which are automatically deleted when you close your browser (in particular session cookies), as well as persistent cookies, which are automatically deleted after a specified period of time. You can delete cookies at any time in your browser's security settings and configure your browser settings according to your preferences – for example, to decline third-party cookies or all cookies. Please note that you may not be able to use all features of this website if you do so.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. On our behalf, Vercel processes the server log data mentioned above in order to ensure the operation, stability, and security of the website. The legal basis is Art. 6 para. 1 lit. f GDPR. A data processing agreement is in place with Vercel; EU Standard Contractual Clauses are used for data transfers to the USA.

This website uses Google Tag Manager provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a solution that allows us to manage website tags through a single interface. The Tag Manager tool itself (which implements the tags) does not collect any personal data and does not set any cookies. The tool triggers other tags, which may in turn collect data. If a deactivation has been carried out at the domain or cookie level, this remains in effect for all tracking tags implemented via Google Tag Manager.

This website uses Google Analytics, a web analytics service provided by Google Ireland Ltd. ("Google"). Google Analytics uses so-called "cookies" — text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to and stored on a server operated by Google. However, by activating IP anonymisation on this website, your IP address will be truncated by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide the website operator with further services related to website usage and internet usage. The IP address transmitted by your browser in the context of Google Analytics will not be merged with other data held by Google.

You can prevent the storage of cookies by adjusting the settings in your browser software; however, please note that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout.

We use Google Analytics to analyse the use of our website and to continuously improve it. The statistics we obtain allow us to enhance our offering and make it more interesting for you as a user. The legal basis for the use of Google Analytics is your consent in accordance with Art. 6(1)(a) GDPR.

We use the Google Remarketing application. This is a process by which we aim to reach out to you again. Through this application, our advertisements may be shown to you during your continued use of the internet after you have visited our website. This is done by means of cookies stored in your browser, through which Google records and evaluates your usage behaviour when you visit various websites. According to Google's own statements, data collected as part of remarketing is not merged with your personal data; in particular, Google states that pseudonymisation is used in remarketing.

In addition, the website uses the remarketing feature "Custom Audiences" of Meta Platforms Ireland Ltd. for the Facebook and Instagram apps. This allows users of the website to be shown interest-based advertisements ("Facebook Ads" or "Instagram Ads") when visiting the social networks Facebook and Instagram or other websites that also use this process. Due to the marketing tools used, your browser automatically establishes a direct connection with Meta's servers. Through the integration of Custom Audiences, Meta receives the information that you have accessed the relevant page of our website or clicked on one of our ads. If you are registered with a Meta service, Meta may be able to associate the visit with your account. The "Custom Audiences" feature can be deactivated at https://www.facebook.com/settings/?tab=ads . For further information on data processing by Meta, please visit https://www.facebook.com/privacy/policy.

We use the LinkedIn Remarketing application via the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company. This is a process by which we aim to reach out to you again. Through this application, our advertisements may be shown to you during your continued use of LinkedIn after you have visited our website. The LinkedIn Insight Tag creates a unique LinkedIn browser cookie in a visitor's browser and enables the collection of metadata such as IP address, timestamps, and page events (e.g. page views). For more information, please visit https://www.linkedin.com/help/linkedin/answer/65521.

All data in the area of remarketing (Google, Meta, LinkedIn) is only stored or transmitted to the third-party providers described above after your explicit consent when using this website and in accordance with the settings you have chosen in the cookie consent dialogue. The legal basis is Art. 6(1)(a) GDPR.

a. We have embedded YouTube videos in our online offering, which are hosted on https://www.youtube.comare stored and can be played directly from our website. All of them are embedded in "enhanced privacy mode", meaning that no data about you as a user is transmitted to YouTube if you do not play the videos. Data is only transmitted once you start playing a video. We have no influence over this data transmission.

b. By visiting the website, YouTube receives the information that you have accessed the relevant sub-page of our website. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website.

c. Further information on the purpose and scope of data collection and its processing by YouTube can be found in Google's privacy policy at https://policies.google.com/privacy.

We send newsletters, emails and other (electronic) notifications (hereinafter "newsletter") only with the consent of the recipients or on the basis of a legal permission. When signing up for the newsletter, its contents are described in specific terms. Beyond that, our newsletters contain information about our products, events and our company.

For sending our newsletter, we use the rapidmail service provided by rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg, Germany, as a data processor.

For newsletter sign-ups, we use the so-called double opt-in procedure. This means that after you sign up, we will send you an email to the address provided, in which we ask you to confirm that you wish to receive the newsletter. We store the IP addresses you use and the times of sign-up and confirmation in order to be able to verify your registration and, if necessary, to investigate any potential misuse of your personal data. The only mandatory detail required for sending the newsletter is your email address.

You may withdraw your consent to receive the newsletter at any time and unsubscribe from it. You can declare your withdrawal by clicking the unsubscribe link provided in every newsletter email, by emailing office@destillerie-farthofer.at or by sending a message to the contact details provided in the legal notice.

Performance measurement: Newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from the mailing service provider's server when the newsletter is opened. As part of this retrieval, technical information is first collected — such as information about your browser and system, as well as your IP address and the time of retrieval — and evaluated to optimise the service. The legal basis for data processing in connection with the sending of the newsletter is the recipient's consent (Art. 6(1)(a) GDPR).

1. Controller — Destillerie Farthofer GmbH, Mostviertelplatz 6, 3362 Öhling, registered under FN 546836 x (Regional Court of St. Pölten), office@destillerie-farthofer.at.

2. Purpose of Data Processing — We collect, process and use personal data relating to you, your company or your employees for the purpose of carrying out and managing our business relationship. The legal basis is Art. 6(1)(b) GDPR (performance of a contract, pre-contractual measures) and, where applicable, Art. 6(1)(a) GDPR (consent).

3. Categories of Recipients — To fulfil our contractual relationship, the stored data is shared both internally with the relevant departments within our company and passed on to third parties, such as service providers we engage.

4. Access, Erasure, Complaints — You have the right at any time to request information about your stored personal data, its origin and recipients, and the purpose of data processing, as well as the right to rectification, data portability, objection, restriction of processing, and the blocking or deletion of incorrectly or unlawfully processed data. If you believe that the processing of your data violates applicable data protection law, you have the option to lodge a complaint with the data protection authority.

5. Data Retention — We will not retain data for longer than is necessary for the fulfilment or enforcement of our contractual or legal obligations and claims, or for the defence against any (liability) claims that may arise.