Privacy policy
CZ Online Shop of Mast Jägermeister SE and Mast-Jaegermeister CZ s.r.o
Last updated: 22 October 2026 | Version 1.0
Scope of this privacy notice
We are delighted by your interest in our company. The protection of your personal data is of high importance to Mast-Jägermeister SE (hereinafter “MJSE”). The processing of personal data, for example your name, address, e-mail address or telephone number, is always carried out in accordance with the General Data Protection Regulation (GDPR) and the supplementary national data protection provisions.
This privacy notice applies to our Czech and Slovak online shop and the associated market domain.
1. Definitions
This privacy notice uses the terms of the GDPR. We explain the most important terms in advance:
| Term | Meaning |
|---|---|
| Personal data | Any information relating to an identified or identifiable natural person, such as name, address, e-mail address, IP address or online identifiers. |
| Data subject | Any identified or identifiable natural person whose personal data are processed. |
| Processing | Any operation relating to personal data, in particular collection, storage, use, disclosure, restriction or erasure. |
| Controller | The entity which alone or jointly with others determines the purposes and means of the processing (Art. 4(7) GDPR). |
| Processor | An entity which processes personal data on behalf of the controller, in accordance with instructions. |
| Consent | Any freely given, specific, informed and unambiguous indication of the data subject's wishes. |
2. Controller
The controller within the meaning of Art. 4(7) GDPR for the processing described in this privacy notice is:
Mast-Jägermeister SE
Jägermeisterstraße 7–15, 38302 Wolfenbüttel, Germany
Telephone: +49 5331 810
E-mail: team-pr@jaegermeister.de
Website: eu.jagermeister.com
MJSE determines the purposes and means of processing, is the owner of the shop system and is responsible for the marketing and CRM measures. For the technical operation and order processing, we use service providers who act for us solely on the basis of instructions pursuant to Art. 28 GDPR.
You may at any time assert your data subject rights against us, even where a service provider processes the request on our behalf.
3. Data Protection Officer
Data Protection Officer of Mast-Jägermeister SE
Jägermeisterstraße 7–15, 38302 Wolfenbüttel, Germany
Telephone: +49 5331 81266
E-mail: datenschutz[at]jaegermeister.de
You may contact our Data Protection Officer directly at any time with questions concerning data protection as well as the exercise of your rights.
4. Hosting and technical provision
Our offerings are operated on the following infrastructure:
| Component | Provider / Platform | Place of processing |
|---|---|---|
| Storefront, checkout, orders, customer account, contact form | Shopify International Ltd., Dublin, Ireland | Globally distributed infrastructure without a fixed EU data location |
| Content and newsletter platform (GCE) | Microsoft Azure, tenant of MJSE | Germany West Central (Frankfurt am Main) |
| Server-side tagging (metrics.jagermeister.com) | Microsoft Azure Container Apps | West Europe (Netherlands) |
| Operation and processing of the online shop | TPL Commercial s.r.o., with its registered office in Sokolovská 270/201, Vysočany, 190 00 Prague 9,, CZ | European Union |
The database and cache of the content platform are accessible only privately and have no public endpoint. Data processing agreements pursuant to Art. 28 GDPR are in place with all of the service providers named. For transfers to third countries, see section 15.
5. Server log files and age verification
5.1 Server log files
Each time our websites are accessed, technical access data are stored in server log files. This includes browser type and version, operating system, the previously visited page (referrer), the subpages accessed, date and time of access, IP address, the internet service provider, as well as comparable information for the purposes of averting danger. We process this data in order to deliver our offerings correctly, to ensure the stability and security of our systems, and to detect misuse.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional provision of our offerings.
Storage period: Server log data are deleted after six weeks unless a specific security-related incident requires longer retention.
5.2 Age verification
In order to be able to use our offers beyond the entry page, it is necessary to provide your date of birth. The age verification serves the protection of minors and is intended to make it more difficult for minors to access spirits advertising and to purchase alcoholic beverages.
The information is transmitted via a proxy of our shop system to our content platform on Microsoft Azure in Frankfurt am Main, processed there on the server side, checked by a bot detection system (see section 11) and then passed on to our CRM system Klaviyo. In the European Union, the date of birth is not stored in a cookie on your end device.
Legal basis: Art. 6(1)(c) GDPR in conjunction with the provisions under youth protection law and Art. 6(1)(f) GDPR. Our legitimate interest lies in compliance with youth protection requirements.
Storage period: 90 days
6. Contact by e-mail and contact form
If you contact us by e-mail or via our contact form, we process your details, in particular name, e-mail address and message content, in order to deal with your enquiry. The recipients are the responsible employees of MJSE as well as Klaviyo, Inc. as processor. Order-related enquiries are processed by TPL Commercial s.r.o. in accordance with our instructions on our behalf.
Legal basis: Art. 6(1)(b) GDPR insofar as your enquiry serves the purpose of a contractual relationship, otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in responding to enquiries.
Storage period: We delete your enquiry six months after final processing, provided that no contractual relationship arises and there are no statutory retention obligations to the contrary.
7. Customer account and orders
7.1 Customer account
You can open a customer account in our online shop. Which data are processed is shown in the input form. The customer account enables the management of your address data, access to your order history and a simplified order process. When you register, we also store the time of registration; the IP address is deleted after two weeks.
Legal basis: Art. 6(1)(b) GDPR for providing the customer account and Art. 6(1)(f) GDPR for preventing misuse.
Storage period: 3 years
7.2 Orders and merchandise management
When you place an order, we process the data required for performance of the contract, in particular name, billing and delivery address, contact, order and payment data. For processing, we transfer the required data to TPL Commercial s.r.o., with its registered office in Sokolovská 270/201, Vysočany, 190 00 Prague 9, company ID (IČ): 046 95 780, registered in the Commercial Register at the Municipal Court in Prague, section C, file 252154, for merchandise management and to the commissioned shipping service providers.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR with regard to commercial and tax law obligations.
Storage period: Order and invoice data are retained in accordance with the commercial and tax law retention periods of six and ten years respectively.
7.3 Payment processing
For payment processing, depending on the selected payment method, we use the following providers:
| Payment method | Provider | Notes |
|---|---|---|
| Shopify Payments (credit card, Apple Pay, Google Pay) | Shopify International Ltd., Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, Ireland | Payment processing, fraud prevention, authentication and security checks. In the case of Apple Pay and Google Pay, Apple and Google respectively process data under their own responsibility. |
The payment service providers process the data for their own purposes as independent controllers; their privacy notices additionally apply.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR for the secure provision of the payment methods and fraud prevention.
8. Newsletter and e-mail marketing
For the sending, administration and evaluation of our newsletters, we use Klaviyo, Inc., 125 Summer Street, 6th Floor, Boston, MA 02110, USA, as a processor. A contract pursuant to Art. 28 GDPR is in place.
8.1 Newsletter on the basis of your consent
You can subscribe to our newsletter on the basis of your consent. The data collected are determined by the input form; these are usually first name, surname, e-mail address, year of birth and address data. Registration takes place using the double opt-in procedure. In order to evidence your consent, we store the time of registration and confirmation, the IP address used, the source of the registration and the version of the consent text. Unconfirmed registrations are automatically deleted.
Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in every newsletter e-mail.
Deadline for the deletion of unconfirmed registrations: 14 days
8.2 Advertising to existing customers
If you have purchased goods from us and provided your e-mail address in the process, we may send you information about our own similar goods. We draw your attention to your right to object at any time when the data are collected and in every advertising e-mail. The existing customers list is maintained technically separately from the consent-based newsletter list.
Legal basis: Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act Against Unfair Competition (UWG).
8.3 Performance measurement, segmentation and personalisation
Where you have consented, we use the following functions of our CRM system:
- Open and click tracking within our newsletters
- On-site tracking of your behaviour in our online shop
- Formation of interest groups and segments
- Prediction of interests and purchasing probabilities (Predictive Analytics)
- Personalised product recommendations
- Linking with your order and customer account data from our shop system
There is no SMS or push communication.
Legal basis: Art. 6(1)(a) GDPR and, insofar as information is stored on or read from your terminal equipment, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Without your consent, no performance measurement, segmentation or personalisation takes place.
There is no decision based exclusively on automated processing, including profiling, which produces legal effects or similarly significant effects (Art. 22 GDPR). You may object at any time to processing for the purposes of direct marketing, including any related profiling.
8.4 Withdrawal, unsubscribe and suppression notice
You may withdraw your consent at any time via the unsubscribe link, via our consent management tool or by notifying us. Following a withdrawal or objection to advertising, we will no longer use your data for advertising purposes. In order to be able to take permanent account of your objection, we store minimal suppression information, even if your other data are deleted. We retain evidence of your consent and withdrawal insofar as this is necessary for the fulfilment of our obligations to provide evidence.
9. Prize draws and gamification
When participating in a prize draw, we process your details for the purposes of conducting, evaluating and administering the prize; the respective terms of participation also apply. For certain promotions, we use Brame AG, Sonnenrainweg 8, 8834 Schindellegi, Switzerland, as a processor. For Switzerland, there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR.
Legal basis: Art. 6(1)(b) GDPR for the conduct of the prize draw and, insofar as expressly obtained, Art. 6(1)(a) GDPR for any advertising use of your details.
Storage period: We delete or anonymise the data as soon as they are no longer required for processing and no retention obligations preclude this.
10. Cookies and consent management
Our websites use cookies and comparable technologies. To manage your consents, we use the consent management tool OneTrust of OT Technology Spain, S.L.U., Plaza Pablo Ruiz Picasso 11, Planta 3, 28020 Madrid, Spain, as processor.
All non-essential analysis, marketing and third-party technologies are only set and triggered after you have given your consent; until then, they are blocked. This also applies to data that are forwarded via our server-side tagging (section 12.1). You may change or withdraw your selection at any time via the cookie settings with effect for the future.
Legal basis: Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR for technically necessary cookies and Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR for all other technologies.
Cookie categories
| Category | Description |
|---|---|
| Strictly necessary | Basic functions such as privacy preferences, login, forms and shopping basket. Cannot be deactivated. |
| Performance | Measurement of visits, traffic sources and page usage to improve our offerings. Only with consent. |
| Functional | Extended functions, such as embedding external media. Only with consent. |
| Marketing / Targeting | Creation of interest profiles and delivery of relevant advertising, also on other websites and platforms. Only with consent. |
Please refer to the current cookie list in our consent management tool for the technologies, providers, purposes and storage periods used in each individual case.
11. Protection against automated access (Friendly Captcha)
To distinguish human input from automated access, we use Friendly Captcha from Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany. Your browser thereby solves a cryptographic computing task in the background. Neither cookies are set nor is your usage behaviour such as mouse movements or clicks evaluated.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our forms and systems against spam and bot attacks. Consent pursuant to Section 25(1) TDDDG is not required.
12. Web analysis, advertising and server-side tagging
We use analysis and advertising services to evaluate the use of our offerings, measure our advertising activities and show you interest-based advertising. Use takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR, which you can withdraw at any time via our consent management tool.
Please refer to Annex 1 for which services are used on the market domain you use.
For the collection and transmission of data via the pixels mentioned in sections 12.5 to 12.7, we are jointly responsible with the respective provider (Art. 26 GDPR). Further processing takes place under the sole responsibility of the provider.
12.1 Server-side tagging
We operate server-side tagging via the subdomain metrics.jagermeister.com on Microsoft Azure Container Apps in the West Europe region (the Netherlands). Event data is first transmitted to our own server and only then forwarded to the respective analysis and advertising services. Forwarding to third parties takes place exclusively in accordance with your consent given in the consent management tool.
12.2 Google Tag Manager
We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to manage the tags used on our website. The Tag Manager itself does not create user profiles, but triggers additional tags. Non-essential tags are triggered only in accordance with your consent.
12.3 Google Analytics 4
We use Google Analytics 4 from Google Ireland Limited. Information about your usage behaviour is collected, such as pages viewed, dwell time, origin of the visit and interactions. The processing serves to analyse and optimise our offerings. Data retention is enabled for 14 months
12.4 Google Ads Conversion Tracking and Remarketing
We use Google Ads from Google Ireland Limited to measure the effectiveness of our advertising campaigns (conversion tracking) and to show you interest-based advertising in the Google advertising network after a visit to our website (remarketing). For this purpose, cookies or comparable identifiers are used through which visits, interactions and purchases are recorded. You can also adjust settings for personalised advertising in your Google account.
12.5 Meta Pixel and Meta Conversions API
We use the Meta Pixel and the Meta Conversions API of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, in order to measure the effectiveness of our advertising on Facebook and Instagram and to show you interest-based advertising there. With the Conversions API, events such as page views or purchases are transmitted to Meta not from your browser, but via our server-side tagging. This too takes place only with your consent.
We are jointly responsible with Meta for the collection and transmission of the data. The allocation of responsibilities is governed by Meta's Controller Addendum. You may assert your rights against both us and Meta.
12.6 X Pixel
We use the conversion tracking pixel of the service X in order to measure the effectiveness of our advertising on the X platform and to show you interest-based advertising there. In doing so, information about your visit, in particular pages viewed and interactions, is transmitted to X and, where applicable, assigned to your X account.
X Internet Unlimited Company One Cumberland Place Fenian Street Dublin 2, D02 AX07 Ireland
Further information can be found at: https://gdpr.x.com/en/inbound-controller-dpa.html
12.7 Spotify Pixel
We use Spotify's advertising pixel to measure the effectiveness of our advertising campaigns on Spotify. In doing so, information about your visit to our website is transmitted to Spotify and matched against advertising contacts on Spotify.
Shopify International Limited The Sidings, 4th Floor Grand Canal Quay Dublin, D02 E7K8,
Further information can be found at: https://www.spotify.com/us/legal/end-user-agreement/
12.8 Adform
We use Adform's advertising technology to serve advertising campaigns on third-party websites and to measure their effectiveness. For this purpose, cookies or comparable identifiers are used through which advertising contacts and subsequent visits or purchases are recorded.
AdformS/A Silkegade 3B, stuen & 1st floor, DK-1113 Copenhagen
Further information can be found at: Adform Privacy Compliance Agreement Online Acceptance - Adform
13. Presence on social networks
We maintain presences on social networks, including on Facebook and Instagram. We are jointly responsible with Meta Platforms Ireland Limited for the statistics created in the context of page insights. We receive exclusively aggregated statistics and have no access to the personal data processed by Meta for this purpose. You may assert your rights against us and Meta: https://www.facebook.com/legal/controller_addendum
14. Erasure and blocking of personal data
We store your personal data only for as long as this is necessary to achieve the respective purpose or as statutory provisions provide. We have specified the concrete retention periods in the individual processing operations. Erasure does not take place as long as a contractual relationship has not yet been fully terminated, statutory retention obligations exist or the data are required for the defence of legal claims.
15. Transfers to third countries
To the extent that we transfer personal data to recipients outside the European Economic Area, this is done only on the basis of a transfer mechanism permitted under Chapter V GDPR:
| Recipient | Basis for transfer |
|---|---|
| Klaviyo, Inc., USA | Adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), for as long as and to the extent that Klaviyo, Inc. is effectively certified, supplemented by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). |
| Shopify International Ltd., Ireland | Contracting party with its registered office in the EU. As there is no fixed EU data location, transfers to third countries take place on the basis of the EU Standard Contractual Clauses and, where applicable, an adequacy decision. |
| Brame AG, Switzerland | Adequacy decision for Switzerland (Art. 45 GDPR). |
| Google, Meta | To the extent that transfers to the USA take place: EU-U.S. Data Privacy Framework (Art. 45 GDPR), supplemented by EU Standard Contractual Clauses. |
| X, Spotify, Adform | EU-U.S. Data Privacy Framework |
Despite suitable protective measures, where processing takes place in third countries it cannot be ruled out in full that public authorities may access data under the law applicable there. You may request a copy of the appropriate safeguards via the contact details set out in section 3.
16. Your rights
Under the GDPR, you have the following rights:
| Right | Content |
|---|---|
| Right of access (Art. 15) | Information as to whether, and which, data we process about you, including the purposes, recipients, storage period, source of the data and automated decision-making, as well as a copy of the data. |
| Rectification (Art. 16) | Rectification of inaccurate data and completion of incomplete data. |
| Erasure (Art. 17) | Erasure of your data, in particular where it is no longer required or you have withdrawn consent. |
| Restriction (Art. 18) | Restriction of processing, for example where accuracy is contested or while an objection is being reviewed. |
| Data portability (Art. 20) | Receipt of the data you have provided in a structured, commonly used and machine-readable format. |
| Objection (Art. 21) | Objection to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation; to direct marketing, including profiling, at any time and without giving reasons. |
| Withdrawal (Art. 7(3)) | Withdrawal of consent at any time with effect for the future. |
To exercise your rights, please use the contact details stated in section 2 or 3. You also have the right to lodge a complaint with a data protection supervisory authority, in particular at the place of your habitual residence, your place of work or the place of the alleged infringement.
The provision of personal data is in part required by law or contract or necessary for the conclusion of a contract; otherwise it is voluntary. The consequences of not providing it are described for the respective processing operation.
17. Changes to this privacy notice
We adapt this privacy notice if the described processing operations or the legal framework change. The version published on our websites shall apply in each case.
ANNEX 1
Analysis and advertising services used for specific markets
This annex forms part of the privacy notice. All services listed are activated exclusively on the basis of your consent. The current cookie list in our consent management tool is always authoritative.
Overview of the services used
| Service | Provider and notes |
|---|---|
| Google Analytics 4 | Google Ireland Limited, Dublin, Ireland. Web analytics (section 12.3). |
| Google Ads | Google Ireland Limited, Dublin, Ireland. Conversion tracking and remarketing (section 12.4). |
| Meta Pixel and Conversions API | Meta Platforms Ireland Limited, Dublin, Ireland. / Remarketing (section 12.5). |
| X Pixel | X Internet Unlimited Company One Cumberland Place Fenian Street Dublin 2, D02 AX07 Ireland. Remarketing (section 12.6). |
| Spotify Pixel | Spotify USA Inc., 4 World Trade Center, 150 Greenwich Street, 62nd Floor, New York, NY, 10007 / Remarketing (section 12.7). |
| Adform | AdformS/A Silkegade 3B, stuen & 1st floor, DK-1113 Copenhagen / Remarketing (section 12.8). |
Use by market domain
Legend: “Yes” = service is used on the market domain. “No” = service is not used there.
| Market domain | GA4 | Google Ads | Meta Pixel / CAPI | X | Spotify | Adform |
|---|---|---|---|---|---|---|
| eu. | Yes | Yes | Yes | Yes | Yes | Yes |
| fr. | Yes | Yes | Yes | Yes | Yes | Yes |
| hu. | Yes | Yes | Yes | Yes | Yes | Yes |
| it. | Yes | Yes | Yes | Yes | Yes | Yes |
| nl. | Yes | Yes | Yes | Yes | Yes | Yes |
| ro. | Yes | Yes | Yes | Yes | Yes | Yes |
| es. | Yes | Yes | Yes | Yes | Yes | Yes |
| pt. | Yes | Yes | Yes | Yes | Yes | Yes |