Thank you for your interest in ShimlaSpirits.com. To enable us to provide our services, we require some data about you. We take the protection of your personal data very seriously and will al-ways process it in accordance with the applicable data protection regulations, in particular with the EU General Data Protection Regulation. The purpose of this Data Privacy Statement is to inform you in detail about the nature, scope and purpose of the personal data processed by us and your rights as a data subject.

1. Data Controller and General Information Your data will be processed by Shimla Spirits Ltd, 352 Bearwood Rd, Smethwick, Birmingham, B66 4ET, England, email: info@shimlagin.com (service provider and data controller within the meaning of the General Data Protection Regulation (GDPR). Please note that whenever we use formulations such as “we” or “us”, we are referring to Shimla Gin Ltd. Within this document, “Shimla Gin” refers to www.shimlagin.com, and to various apps provided by Shimla Gin Ltd., including all sub-pages, content and functions provided therein. Our services are provided for the general public and are not intended to be used by children. We do not knowingly collect any personal data from users classified as children under national legislation.

2. Collection and Processing of Personal Data In general, insofar as any of the services provided by us do not require payment or registration, you can use them without providing personal information. In certain cases we will process the personal data listed in Section 3. This will generally only occur insofar as the processing of this personal data is necessary to ensure the functioning of the website or app, or to provide you with out content and services. Furthermore, we process personal data in connection with your use of viabatuta.com in circumstances where this data is provided voluntarily by you, e.g. in the context of registration, an inquiry to us, an application, the conclusion of a subscription or another legal basis (see Section 4). If you do not wish this to happen, you may be unable to use our services, or at least be restricted from accessing their full range of functions.

3. Categories of Data Processed By Us As soon as you begin using ShimlaSpirits.com, our system automatically collects information from the system of the requesting machine. Data collected can include the following: – Information about the browser type and version
– The operating system of the user
– Mobile Device ID
– Date and time of request
– Web analysis data / pseudonymized user profiles (cookie ID, ad ID, etc.)
– Websites from which users are referred to our website
– Websites accessed by users via our website In addition, we process the following personal data insofar as there is a contractual relationship between you and us, or if you have transmitted the data to us in other ways: – Personal master data (name, address, date of birth)
– Communication data (telephone number, email address)
– Contractual master data (contractual relationship, contractual or product interest, order history)
– Login data with password
– Comments, posts, etc.
– Employee data (name, address and communication data, contractual master data and accounting data, date of birth, marital status, nationality, denomination, field of activity, social insurance status, wage tax data, social data, bank details, HR administration and management data, access and access control data).

4. Legal Basis and Purpose of Processing We process your data exclusively on the basis of one or more of the possible legal bases for data processing. According to the GDPR, personal data may, in particular, be processed on the basis of a con-tract or for the implementation of pre-contractual measures, on the basis of your consent, on the basis of a legitimate interest or law and/or for the protection of vital or public interests. Registration is required for the provision of certain content or services on our website. All users can register with ShimlaGin.com free of charge, stating their given name, last name, email ad-dress and a password, whereby this registration data is transmitted to us. The collection and processing of this data takes place for the purpose of fulfilling the user agreement between us and the user pursuant to Art. 6.1.b GDPR. Where you have provided an email address in the course of registration or in connection with the performance of a contract, we also use this email address to send you information about similar goods or services as well as about existing subscriptions or about Shimla Gin Ltd. in general. In this case, the processing of the email address is based on our legitimate interest in the advertising our goods and services (Article 6.1.f GDPR). In addition, if you have issued your prior express consent for receiving a newsletter or advertizing materials, we will use your email address to send you our newsletter. In this case, we will process your email address in order to be able to deliver the newsletter as per your request (Art. 6.1.b GDPR). You can object to the use of your email address by sending an email to info@shimlagin.com with effect for the future and without incurring any costs other than transmission costs according to the basic tariffs. Naturally, you can unsubscribe from the newsletter at any time in your user profile or by clicking on the unsubscribe link in the newsletter itself. On the internet, each device capable of transmitting data requires its own unique address, commonly known as an “IP address”. The (at least temporary) storage of the IP address is technically necessary to allow the website to be delivered to the user’s computer. We truncate IP addresses prior to processing them and carry out any further processing anonymously. We offer a comment function (forum) for registered users on our website, in connection with which additional personal data is stored. The same applies to any surveys in which the user chooses to participate. If you wish to post a comment, you will need to register in order to do so. You may use a pseudonym as your “username”. We collect and process the data provided by you to enable us to publish your comment as per your request (Article 6.1.b GDPR). In particular, we require your email address to be able to contact you in case of complaints regarding your comment and to give you the opportunity to respond (Article 6.1.c GDPR). In the case of processing activities not covered by one or more of the aforementioned legal bases, processing will take place only if it is necessary to safeguard a legitimate interest and if your interests, fundamental rights and fundamental freedoms do not override this legitimate interest in the context of a comprehensive balancing of interests (Article 6.1.f GDPR). A legitimate interest can be assumed if the data subject is a customer of the data controller. In relation to the processing of personal data, our legitimate interest consists, in particular, in conducting our business for the benefit of all of our employees and our shareholders. Our legitimate interest in offering you tailored products, notifying you about our products, innovations and quality features and continually improving our products and services forms the legal basis for any and all processing that takes place for the purpose of big data, direct marketing (own advertising and third-party advertising), usage-based online advertising, web/app analysis and lead scoring (combining different selection criteria to determine which adverts to show). For more information on web analysis services, see Section 9. Our legitimate interest in fraud prevention, network and information security and the reliability of our services and/or products also constitute a legal basis for the processing of certain data. Another of our legitimate interests lies in the functionality of the business processes on the basis of which processing occurs for internal administrative purposes (e.g. address management/accounting). When processing the personal data of data subjects covered by our reporting, we also invoke our legitimate interest in exercising freedom of expression and information. You can object at any time to data processing that occurs on the basis of a legitimate interest (see Section 13). In the event that the data is processed for a purpose other than that specified in connection with the original data collection, a compatibility check will be carried out in accordance with Art. 6.4 GDPR. Further processing will only be permitted if the original purpose is compatible with the new purpose or is permitted on a separate legal basis. Recognized compatible purposes include the assertion, exercise or defense of civil law claims, insofar as the interest of the data subject does not override these purposes. In such cases, we will inform you of the new purpose. If the new purpose is incompatible with the purpose cited in connection with the original data collection, collection will be re-established on a new legal basis. In this case, too, we will inform you about the change of purpose.

5. Location of Processing We do not transfer your personal data to countries outside the United Kingdom and the European Economic Area, except in cases where this is permitted under the GDPR. We have no knowledge of or influence over whether third parties with whom you have a separate contractual relationship (e.g. Facebook, if you have a Facebook account) transfer data to countries outside the European Economic Area. We sometimes process data in countries outside the European Economic Area (“EEA”). In order to ensure the protection of your personal rights in connection with these data transfers, we use the standard contractual clauses of the EU Commission to structure our contractual relationships with recipients in third countries in accordance with Art. 46.2.c GDPR. These are available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:EN:PDF at any time. Alternatively, you can download these documents from us using one of the con-tact methods below. In regards to the US, the European Commission decided, by means of a decision adopted on 12 July 2016, that an appropriate level of data protection is provided under the regulations of the EU-U.S. Privacy Shield (adequacy decision, Art. 45 GDPR). For more information – including the certification of the service providers we use – please visit https://www.privacyshield.gov . We only use US service providers who are certified under the EU-US Privacy Shield scheme.

6. Origin of the Data In certain cases, we also receive data because you have consented for it to be transmitted to us. As you know, apps are regularly made available for download from third party sites (e.g. iTunes, Google, etc.). If, in accordance with the applicable terms of use of such a provider, Shimla Gin Ltd. becomes your contractual partner for the purchase of the app, we will process the data provided to us by the third party to the extent necessary for the fulfillment of the contract, such that you are able to download a Shimla Gin app on a mobile device. Information on the Use of Apps our app uses the following permissions for the purposes listed below, as a result of which it gains access to certain functions of your mobile device. • SMS / messages – Sending push notifications, e.g. news or posts. • Storage – For caching data and storing user settings, such as preferred language or favorite item.

7. Transfer of Your Data to Third Parties We transmit your personal data to third parties only if this transmission is necessary in order to fulfill our contractual obligations towards you and it occurs in cooperation with another provider (e.g. a partnership), if we are legally entitled or obliged to make the transfer on any other grounds, or you have issued a corresponding consent. To enable us to provide our services, selected personal information may be shared with certain departments within our company. This includes employees in the accounting, product management, marketing and IT departments. In certain cases, we also use external service providers or affiliates who have been contracted by us to process data on our behalf. Such service providers are contractually obligated by us to adhere to the strict requirements of the GDPR in their role as a processor and may not re-use your data for any other purpose. Our contractors provide us with the following services: subscription management, content recommendations, hosting, survey and comment service(s), maintenance and support, and web and app analytics. The transfer of data to contract data processors takes place on the basis of Art. 28.1 GDPR or, alternatively, based on our legitimate interest in the economic and technical advantages associated with the use of specialist contract data processors pursuant to Art. 6.1.f GDPR. Insofar as we are legally obliged to do so, or if it is permitted under data protection law, we transfer personal data to authorities, e.g. the police or the public prosecution services (Art. 6.1.c GDPR). The disclosure of this data is based on our legitimate interest in the fight against abuse, the prosecution of crimes and the securing, assertion and enforcement of claims, It may only occur if your rights and interests in the protection of your personal data do not over-ride these interests pursuant to Art. 6.1.f GDPR.

8. Cookies and Similar Technologies We use cookies. Cookies are small files that your browser stores on your device in a designated directory. Among other things, they enable you to be identified as a repeat visitor to our website. If you give your consent, cookies may also store login information for online services so that you do not need to re-enter the information each time you visit the site. Many cookies contain a so-called “cookie ID”: a unique identifier for the cookie. This consists of a string via which websites and servers can be assigned to the specific internet browser in which the cook-ie was stored, thus allowing visited websites and servers to distinguish the data subject’s browser from other internet browsers containing other cookies. A particular web browser can be recognized and identified by the unique cookie ID. We use two types of cookies. The first type are cookies which are technically necessarily and without which the functionality of our website would be limited. The second type are optional cookies, which are used to make our website more user-friendly. The user data collected via the essential cookies is not used to create user profiles, while the analysis (optional) cookies are used to improve the quality of our website and its contents. Through the setting of analysis cookies, we learn how the website is used and how we can optimize it. Further information on the analysis services we use can be found in Section 9 of this Privacy Statement. Ads are usually provided by third parties. These third parties may, to the extent permitted by your device settings, use information about your website visits to display ads about products and services that may interest you. Specific contact data such as your name, address, email address and telephone number will not be transmitted under any circumstances. You can prevent the setting of cookies at any time by adjusting the settings in your internet browser to object permanently to the setting of cookies. In addition, previously set cookies can be deleted at any time via an internet browser or other software program. This can be accomplished in all standard internet browsers. Deactivating the setting of cookies in your internet browser may mean that not all features of our website are fully usable. When you use apps instead of a browser, a comparable technology is used in place of cookies. In the course of this, we possibly use an advertising ID, which the manufacturer of your operating system provides for such purposes. “Identifier for Advertizing” (IDFA) for iOS devices or “Google Advertizing ID” for Android devices. The advertising ID is not related to the app, but connected with your terminal device as such. With the assistance of this advertising ID, Media Impact can deliver advertising contents matching your usage of the app (so-called “behavior-oriented advertising”). The purpose of this is to display more interesting and relevant advertising to you than it would be possible without the usage of the respective data. If the advertising ID of your terminal device shall not be used for behavior-oriented advertising, you can set up your device accordingly: If you use a terminal device from the manufacturer Apple: Open the settings and choose the option “privacy”. Under “advertising”, you can now activate the feature “no ad-tracking”. If you use a terminal device with the operating system Android: Open the the app “Google settings” and choose the option “ads”. There you can “Opt out of Ads Personalization”. Cookies cannot identify you as a person. Moreover, our use of cookies is justified on the basis of our legitimate interest in the optimization of our website and the statistical analysis of Shimla Spirits Ltd. justified (Article 6.1.f GDPR).

9. Google reCAPTCHA In order to ensure sufficient data security when submitting forms, we use the reCAPTCHA service of Google Inc. in certain cases. This is used primarily to distinguish whether the input is made by a natural person or abusive by automated and automated processing. The service includes the sending of the IP address and, if applicable, other data needed by Google for the reCAPTCHA service to Google. This is subject to the deviating privacy policies of Google Inc. For more information about the Google Inc. Privacy Policy, please visit http://www.google.com/intl/en/privacy or https://www.google.com/intl/en/policies/privacy/

10. Web / App Analysis Services In order to improve our content on an ongoing basis, to adapt it to the interests of our users and to display usage-based online advertising, we use a number of services that collect and evaluate data on our website or in our app. Insofar as these service providers do not themselves constitute data controllers within the meaning of data protection law, they always process the pseudonymized user data according to the provisions of a contract data processing agreement. You can disable these individual analysis services at any time with effect for the future. The following paragraphs contain more information about the analysis services we use. Google Analytics We have integrated functions of Google Analytics (including IP anonymization) into our Online Services. Google Analytics is a web analytics service and is designed to collect, compile and analyze data about the behavior of website visitors. Among other things, a web analytics service collects information about the referrer URL, the pages of the website that were accessed, and how often and for what length of time a page was viewed. Web analytics data is used primarily to optimize websites and for the cost-benefit analysis of internet advertising. The operator of Google Analytics is Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA. We use the anonymization function “ga (‘set’, ‘anonymizelp’, true)”, which prompts to Google to truncate and anonymize the user’s IP address if the access request comes from a Member State of the European Union or another Contracting Party to the Agreement on the European Economic Area. The purpose of Google Analytics is to analyze visitor flows on our website. Among other things, Google uses the data and information obtained to evaluate visitors’ use of our website, to com-pile reports for us about activity on our web pages and to provide other services related to the use of our website. Google Analytics places a cookie on the data subject’s computer system (for the definition of a cookie, please see above). Google can use the cookie-generated information to analyze your use of our website. Each time you visit any of the pages of our website into which a Google Analytics component has been incorporated, the internet browser on your computer system is automatically prompted by the respective Google Analytics component to submit the data to Google for online analysis. As part of this technical process, Google will become aware of personal data such as your IP address. This serves, among other things, to enable Google to track the origin of visitors and clicks and thus to reach subsequent commission settlements. The cookie stores personally identifiable information, such as access time, the location from which the access was requested and the frequency of site visits by the data subject. Each time you, as the data subject, visit our website, your personal information – including the IP address of your internet connection – is transferred to Google in the United States of America and stored there. Google may transfer the personal data collected via this technical process to third parties. As described above, data subjects can prevent the setting of cookies by our website at any time by adjusting the settings of their internet browser and thus objecting permanently to the setting of cookies. Adjusting the browser settings in this way will also prevent Google from set-ting a cookie on the computer system. In addition, cookies already set by Google Analytics can be deleted at any time via the internet browser or other software programs. Furthermore, data subjects have the option to object to and block the collection of Google Analytics-generated data about the use of this website and the processing of this data by Google. In order to do this, the data subject must download and install the browser add-on accessible under the link https://tools.google.com/dlpage/gaoptout?hl=en-GB. This browser add-on informs Google Analytics, via JavaScript, that no data or information about website visits may be transmitted to Google Analytics. Google classes the installation of the browser add-on as an objection on the part of the data subject. If the data subject’s computer system is later deleted, formatted or reinstalled, the data subject must re-install the browser add-on to disable Google Analytics. If the browser add-on is uninstalled or disabled by the data subject or by another person within the data subject’s sphere of influence, it is possible to reinstall or reactivate it as desired. Other information and Google’s own data privacy guidelines can be found at https://privacy.google.com/intl/en-GB/index.html and https://www.google.com/analytics/terms/us.html. More details about Google Analytics can be found here: https://www.google.com/intl/en_uk/analytics/#?modal_active=none. Google DoubleClick We have integrated components of DoubleClick by Google into this website. DoubleClick is a Google brand under which special online marketing solutions are marketed to advertising agencies and publishers. The operator of DoubleClick by Google is is Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA. DoubleClick by Google transmits data to the DoubleClick server with every impression, click, or other activity. Each of these data transfers triggers a cookie request to the data subject’s browser. If the browser accepts this request, DoubleClick sets a cookie on the data subject’s computer system (for the definition of a cookie, please see above). The purpose of the cookie is to optimize and display advertising. The cookie is used, among other things, to serve and display user-relevant advertisements as well as to generate reports on or optimize advertising campaigns. The cookie is used to avoid multiple impressions of the same advertising message. DoubleClick uses a cookie ID, which is necessary for the execution of the technical process. It is required, for example, to display an ad in a browser. DoubleClick can also use the cookie ID to see which ads have already appeared in a browser and thus to avoid avoid duplication. The cookie ID further enables DoubleClick to track conversions. A “conversion” is recorded when, for example, a user has previously been shown a DoubleClick ad and then makes a purchase on the advertiser’s site using the same internet browser. A DoubleClick cookie does not contain any personally identifiable information. However, a DoubleClick cookie may contain additional campaign identifiers. A campaign identifier identifies the campaigns with which the user has already come into contact. Each time you visit any of the pages of this website that are operated by us and into which a DoubleClick component has been integrated, the Internet browser on your computer system will be automatically prompted, by the respective DoubleClick component, to transmit the data to Google for the purpose of online advertising and calculating commission settlements. As part of this technical process, Google will gain knowledge of the data it uses to draw up commission settlements. Google learns, among other things, that you, as the data subject, have clicked on certain links on our website. As already described above, you can prevent the setting of cookies by our website at any time by adjusting the corresponding settings on your internet browser and thus objecting permanently to the setting of cookies. Adjusting the settings in this way will also prevent Google from set-ting a cookie on the computer system. In addition, cookies already set by Google can be deleted at any time via an internet browser or other software program. Further information and the respective data privacy guidelines of DoubleClick by Google can be viewed at https://policies.google.com/?hl=en.

11. Online Marketing and Internet Advertising This website is marketed by Shimla Spirits Ltd. As part of this process, advertising is optimized for you through the collection and processing of information about your usage behavior, and is aligned to your predicted interests. As a result, you, as a user and data subject, benefit by receiving advertising that is more in line with your interests. A cookie is stored on your computer to record your usage behavior, but does not enable you to be personally identified.

12. Social Networks You can find us on the social networks of third party companies, such as Facebook or Twitter. We have also integrated certain functions of these networks into our Online Services; you can only use these if you are registered and logged in to the respective social network at the time. Please note that use of the social network is governed by the usage and privacy conditions of the respective third party company and that we have no influence over these. However, we are happy to provide some information about how such networks process your personal data in this regard. YouTube We have chosen to integrate certain YouTube components into this website. YouTube is a free internet video portal that allows video publishers to upload videos and other users to view, rate and comment on them. YouTube allows the publication of all types of videos. As such, it offers complete film and television broadcasts as well as music videos, trailers and user-made vide-os. The operator of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA. Each time you visit any of the page of this website and into which a YouTube component (YouTube video) has been integrated, the internet browser on your computer system will be automatically prompted, by the respective YouTube component, to download a representation of that component from YouTube. More information about YouTube can be found at https://www.youtube.com/intl/en-GB/yt/about/. As a result of this technical process, YouTube and Google gain knowledge of the specific pages of our site that you visit. If you, as the data subject, are logged in to YouTube at the same time as accessing a page containing a YouTube component, YouTube can identify which specific page of the website you are visiting. This information is collected by YouTube and Google and assigned to your individual YouTube account. If a data subject is logged into YouTube at the time of accessing our website, YouTube and Google will receive information from the YouTube component that the data subject has visited our website. This happens regardless of whether or not they click on a YouTube video or not. If the data subject does not wish such information to be transmitted to YouTube, they may pre-vent this from happening by logging out of their YouTube account before accessing our web-site. YouTube’s privacy policy, which can be viewed at https://www.google.com/intl/en/policies/privacy/, gives information about the collection, processing, and use of personally identifiable information by YouTube and Google. On smartphones and tablets, the aforementioned services are typically not implemented through the use of plug-ins, but by a “sharing” function that is internal to the device. Depending on the device settings, information can also be transferred to other social media service providers. Please refer to your device information.

13. External Links Our website contains links referring to third party sites. Shimla Spirits Ltd. has no influence over whether or not these website operators comply with data protection regulations.

14. Duration of Storage We store personal data for only as long as we are entitled to do so and the purpose of processing remains in place. The respective statutory retention period applies in respect of the duration of storage of personal data. Once the period has expired, and insofar as is the corresponding data is no longer required to fulfill or initiate a contract, the data will be routinely deleted.

15. Contact Data and Your Rights as a Data Subject If you have any questions or suggestions about privacy and the exercise of your rights as a data subject, you are welcome to contact our Data Protection Officer at any time: Shimla Spirits Ltd., 
352 Bearwood Rd, Smethwick, Birmingham, B66 4ET, England
; email: info@shimlagin.com. Access and Rectification: At any time, and free of charge (a maximum of once per year), you can obtain information from us about whether or not personal data about you is being processed by us. You can also request specific details about the data being stored and obtain a copy of this stored data. You have the right to correct incorrect data and to have incomplete personal data completed. Deletion, Restriction and the Right to be Forgotten You have the right to request the deletion of your personal data or the restriction of its processing. Please keep in mind that legal storage obligations exist in respect of (e.g.) paid contracts, such as the purchase of a subscription from Shimla Gin Ltd., and that we may not be able to delete your data fully anyway. In this case, your data will be marked with the aim of restricting its future processing.