Privacy policy

PRIVACY POLICY

European online shop of Mast-Jägermeister SE

| As of: 22 October 2026 | Version 1.0

Scope of this Privacy Policy

We are pleased about your interest in our company. The protection of your personal data is of high importance to Mast-Jägermeister SE (hereinafter “MJSE”). The processing of personal data, for example your name, address, e-mail address or telephone number, is always carried out in accordance with the General Data Protection Regulation (GDPR) and the supplementary national data protection provisions.

This Privacy Policy applies to our European online shop and the associated market domains:

• eu.jagermeister.com – main domain with storefront, checkout and customer account

• fr., hu., it., nl., ro., es. and pt.jagermeister.com – market domains of the same shop with identical systems and cookies

The domains jagermeister.com and www.jagermeister.com redirect to eu.jagermeister.com.

Not covered are the country sites at., cz., sk., uk., us., za., pl., lam., gr., jp. and de.jagermeister.com. Until their migration, the privacy notices published there apply to these offers. Also not covered are websites and services of third parties to which we merely link.

Individual advertising services are not used in all markets. Which services are active on the market domain used by you can be found in Appendix 1 and in the information in our consent management tool.

1. Definitions

This Privacy Policy uses the terms of the GDPR. We explain the most important terms below:

Term	Meaning
Personal data	All information relating to an identified or identifiable natural person, such as name, address, e-mail address, IP address or online identifiers.
Data subject	Any identified or identifiable natural person whose personal data are processed.
Processing	Any operation in connection with personal data, in particular collection, storage, use, disclosure, restriction or deletion.
Controller	The entity which alone or jointly with others determines the purposes and means of the processing (Art. 4 No. 7 GDPR).
Processor	An entity that processes personal data on behalf of the controller, in accordance with instructions.
Consent	Any freely given, specific, informed and unambiguous indication of the data subject's wishes.

2. Controller

The controller within the meaning of Art. 4 No. 7 GDPR for the processing described in this Privacy Policy is:

Mast-Jägermeister SE

Jägermeisterstraße 7–15, 38302 Wolfenbüttel, Germany
Telephone: +49 5331 810
E-mail: team-pr@jaegermeister.de
Website: eu.jagermeister.com

MJSE determines the purposes and means of the processing, owns the shop system and is responsible for the marketing and CRM measures. For the technical operation and order processing, we use service providers who act exclusively on our instructions pursuant to Art. 28 GDPR.

You may always assert your data subject rights against us, even if a service provider processes the request on our behalf.

3. Data Protection Officer

Data Protection Officer of Mast-Jägermeister SE
Jägermeisterstraße 7–15, 38302 Wolfenbüttel, Germany
Telephone: +49 5331 81266
E-mail: datenschutz[at]jaegermeister.de

If you have any questions regarding data protection or regarding the exercise of your rights, you may contact our Data Protection Officer directly at any time.

4. Hosting and technical provision

Our offers are operated on the following infrastructure:

Component	Provider / platform	Processing location
Storefront, checkout, orders, customer account, contact form	Shopify International Ltd., Dublin, Ireland	Globally distributed infrastructure without fixed EU data localisation
Content and newsletter platform (GCE)	Microsoft Azure, MJSE tenant	Germany West Central (Frankfurt am Main)
Server-side tagging (metrics.jagermeister.com)	Microsoft Azure Container Apps	West Europe (Netherlands)
Operation and fulfilment of the online shop	Gekko Agency B.V., Van Graftstraat 10, 3088 GL Rotterdam, Netherlands	European Union

The database and cache of the content platform are accessible exclusively privately and do not have a public endpoint. Data processing agreements pursuant to Art. 28 GDPR exist with all of the service providers named. For transfers to third countries, see Section 15.

5. Server log files and age verification

5.1 Server log files

Whenever our websites are accessed, technical access data are stored in server log files. These include browser type and version, operating system, the previously visited page (referrer), the subpages accessed, date and time of access, the IP address, the internet service provider and comparable information for threat prevention. We process this data in order to deliver our offers correctly, ensure the stability and security of our systems and detect misuse.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional provision of our offerings.

Retention period: server log data are deleted after six weeks unless a specific security-related incident requires longer retention.

5.2 Age verification

In order to use our offerings beyond the landing page, it is necessary to provide your date of birth. Age verification serves the protection of minors and is intended to make access to liquor advertising and the purchase of alcoholic beverages more difficult for minors.

The information is transmitted via a proxy of our shop system to our content platform on Microsoft Azure in Frankfurt am Main, processed there on the server side, checked by a bot detection system (see section 11), and then passed on to our CRM system Klaviyo. In the European Union, the date of birth is not stored in a cookie on your device.

Legal basis: Art. 6(1)(c) GDPR in conjunction with the requirements under youth protection law and Art. 6(1)(f) GDPR. Our legitimate interest lies in compliance with youth protection requirements.

Retention period: until deletion request, day/month/year are stored for marketing activation for birthdays

6. Contact by e-mail and contact form

If you contact us by e-mail or via our contact form, we process your details, in particular name, e-mail address and message content, in order to handle your request. Recipients are the responsible employees of MJSE and Klaviyo, Inc. as processor. Order-related inquiries are handled by Gekko Agency B.V. on our behalf and subject to our instructions.

Legal basis: Art. 6(1)(b) GDPR to the extent that your inquiry serves a contractual relationship; otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in responding to inquiries.

Retention period: We delete your inquiry six months after final processing, provided that no contractual relationship arises and no statutory retention obligations prevent deletion.

7. Customer account and orders

7.1 Customer account

You can open a customer account in our online shop. Which data are processed is determined by the input form. The customer account enables the management of your address data, access to your order history and simplified order processing. When registering, we also store the time of registration; the IP address is deleted after two weeks.

Legal basis: Art. 6(1)(b) GDPR for providing the customer account and Art. 6(1)(f) GDPR for preventing misuse.

Retention period: 3 years

7.2 Orders and inventory management

When an order is placed, we process the data required for contract performance, in particular name, billing and delivery address, contact, order and payment data. For processing, we transmit the necessary data to Gekko Agency B.V. as processor, to PVS Concepts GmbH, Tilsiter Straße 17, 69502 Hemsbach, for inventory management, and to the commissioned shipping service providers.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR with regard to commercial and tax law obligations.

Retention period: order and invoice data are retained in accordance with the commercial and tax law retention periods of six and ten years, respectively.

7.3 Payment processing

For payment processing, we use the following providers depending on the selected payment method:

Payment method	Provider	Notes
Shopify Payments (credit card, Apple Pay, Google Pay)	Shopify International Ltd., Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, Ireland	Payment processing, fraud prevention, authentication and security checks. For Apple Pay and Google Pay, Apple or Google process data on their own responsibility.
PayPal	PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg	If applicable, identity and credit checks. In the case of automated decisions, the rights under Art. 22(3) GDPR apply vis-à-vis PayPal.
Klarna	Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden	Payment processing, fraud prevention and, where necessary, credit checks.

The payment service providers process the data for their own purposes as independent controllers; their privacy notices also apply.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR for the secure provision of payment methods and fraud prevention.

8. Newsletter and e-mail marketing

For the sending, administration and analysis of our newsletters, we use Klaviyo, Inc., 125 Summer Street, 6th Floor, Boston, MA 02110, USA, as processor. A contract pursuant to Art. 28 GDPR is in place.

8.1 Newsletter based on your consent

You can subscribe to our newsletter on the basis of your consent. The data collected are shown in the input form; as a rule, these are first name, last name, e-mail address, year of birth and address data. Registration takes place using the double opt-in procedure. To document your consent, we store the time of registration and confirmation, the IP address used, the source of the registration and the version of the consent text. Unconfirmed registrations are deleted automatically.

Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in each newsletter e-mail.

Retention period for deleting unconfirmed registrations: 14 days

8.2 Advertising to existing customers

If you have purchased goods from us and provided your e-mail address in the process, we may send you information about our own similar goods. We point out your right to object at any time when collecting the data and in every advertising e-mail. The existing customer list is maintained separately, for technical reasons, from the consent-based newsletter list.

Legal basis: Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG.

8.3 Performance measurement, segmentation and personalisation

Insofar as you have given your consent, we use the following functions of our CRM system:

• Open and click tracking within our newsletters

• On-site tracking of your behaviour in our online shop

• Formation of interest groups and segments

• Prediction of interests and purchase probabilities (predictive analytics)

• Personalised product recommendations

• Linking with your order and customer account data from our shop system

No SMS or push communication takes place.

Legal basis: Art. 6(1)(a) GDPR and, insofar as information is stored on or read from your terminal equipment, Section 25(1) TDDDG. Without your consent, no performance measurement, segmentation or personalisation takes place.

No decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you (Art. 22 GDPR), takes place. You may object at any time to processing for direct marketing purposes, including any related profiling.

8.4 Withdrawal, unsubscribe and suppression note

You may withdraw your consent at any time via the unsubscribe link, via our consent management tool or by notifying us. Following a withdrawal of consent or an objection to advertising, we will no longer use your data for advertising purposes. In order to be able to comply with your objection on a lasting basis, we store minimal suppression information, even if your other data are deleted. We retain evidence of your consent and your withdrawal to the extent necessary to fulfil our record-keeping obligations.

9. Prize draws and gamification

When you take part in a prize draw, we process your information for the purposes of conducting the prize draw, evaluating it and handling the prize; the respective terms and conditions of participation also apply. For certain campaigns, we use Brame AG, Sonnenrainweg 8, 8834 Schindellegi, Switzerland, as a processor. An adequacy decision by the European Commission pursuant to Art. 45 GDPR exists for Switzerland.

Legal basis: Art. 6(1)(b) GDPR for conducting the prize draw and, where expressly obtained, Art. 6(1)(a) GDPR for the use of your information for advertising purposes.

Retention period: We delete or anonymise the data as soon as they are no longer required for processing and no retention obligations prevent this.

10. Cookies and consent management

Our websites use cookies and comparable technologies. For managing your consents, we use the consent management tool OneTrust provided by OT Technology Spain, S.L.U., Plaza Pablo Ruiz Picasso 11, Planta 3, 28020 Madrid, Spain, as processor.

All non-essential analytics, marketing and third-party technologies are only set and triggered after you have given your consent; until then, they are blocked. This also applies to data that is forwarded via our server-side tagging (Section 12.1). You can change or withdraw your selection at any time with effect for the future via the cookie settings.

Legal basis: Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR for technically necessary cookies and Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR for all other technologies.

Cookie categories

Category	Description
Strictly necessary	Basic functions such as privacy preferences, login, forms and shopping cart. Cannot be deactivated.
Performance	Measurement of visits, traffic sources and page usage to improve our offers. Only after consent.
Functional	Enhanced functions, such as embedding external media. Only after consent.
Marketing / Targeting	Creation of interest profiles and delivery of relevant advertising, also on other websites and platforms. Only after consent.

Please refer to the current cookie list in our consent management tool for the technologies, providers, purposes and storage periods used in each individual case.

11. Protection against automated access (Friendly Captcha)

To distinguish human input from automated access, we use Friendly Captcha provided by Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany. Your browser solves a cryptographic computing task in the background. Neither are cookies set nor is your usage behaviour, such as mouse movements or clicks, evaluated.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our forms and systems against spam and bot attacks. Consent pursuant to Section 25(1) TDDDG is not required.

12. Web analytics, advertising and server-side tagging

We use analytics and advertising services to evaluate the use of our offers, measure our advertising measures and deliver interest-based advertising to you. Such use takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR, which you may withdraw at any time via our consent management tool.

Please refer to Annex 1 for the services used on the market domain you use.

For the collection and transmission of data via the pixels referred to in Sections 12.5 to 12.7, we are jointly responsible with the respective provider (Art. 26 GDPR). Any further processing is carried out under the sole responsibility of the provider.

12.1 Server-side tagging

We operate server-side tagging via the subdomain metrics.jagermeister.com on Microsoft Azure Container Apps in the West Europe region (Netherlands). Event data is first transmitted to our own server and only from there forwarded to the respective analytics and advertising services. Forwarding to third parties takes place exclusively in accordance with your consent granted in the consent management tool.

12.2 Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to manage the tags used on our website. The Tag Manager does not itself create user profiles, but it triggers other tags. Non-essential tags are triggered only in accordance with your consent.

12.3 Google Analytics 4

We use Google Analytics 4 provided by Google Ireland Limited. Information about your usage behavior is collected, such as pages visited, length of stay, source of the visit and interactions. The processing serves the analysis and optimization of our offerings. Data retention is enabled for 14 months

12.4 Google Ads conversion tracking and remarketing

We use Google Ads provided by Google Ireland Limited to measure the effectiveness of our advertising campaigns (conversion tracking) and to show you interest-based advertising in the Google advertising network after a visit to our website (remarketing). For this purpose, cookies or comparable identifiers are used to record visits, interactions and purchases. You can additionally configure settings for personalized advertising in your Google account.

12.5 Meta Pixel and Meta Conversions API

We use the Meta Pixel and the Meta Conversions API provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. This allows us to measure the effectiveness of our advertising on Facebook and Instagram and to show you interest-based advertising there. With the Conversions API, events such as page views or purchases are transmitted to Meta not from your browser, but via our server-side tagging. This also takes place only with your consent.

We are jointly responsible with Meta for the collection and transmission of the data. The allocation of responsibilities is governed by Meta's Controller Addendum. You may assert your rights both against us and against Meta.

12.6 X Pixel

We use the conversion tracking pixel of the service X to measure the effectiveness of our advertising on the X platform and to show you interest-based advertising there. In doing so, information about your visit, in particular pages viewed and interactions, is transmitted to X and, where applicable, assigned to your X account.

X Internet Unlimited Company One Cumberland Place Fenian Street Dublin 2, D02 AX07 Ireland

Further information can be found at: https://gdpr.x.com/en/inbound-controller-dpa.html

12.7 Spotify Pixel

We use Spotify's advertising pixel to measure the effectiveness of our advertising campaigns on Spotify. Information about your visit to our website is transmitted to Spotify and matched with advertising contacts on Spotify.

Shopify International Limited The Sidings, 4th Floor Grand Canal Quay Dublin, D02 E7K8,

Further information can be found at: https://www.spotify.com/us/legal/end-user-agreement/

12.8 Adform

We use Adform's advertising technology to serve advertising campaigns on third-party websites and to measure their effectiveness. For this purpose, cookies or comparable identifiers are used to record advertising contacts and subsequent visits or purchases.

AdformS/A Silkegade 3B, stuen & 1st floor, DK-1113 Copenhagen

Further information can be found at: Adform Privacy Compliance Agreement Online Acceptance - Adform

13. Presences on social networks

We maintain presences on social networks, including Facebook and Instagram. We are jointly responsible with Meta Platforms Ireland Limited for the statistics created within the scope of Page Insights. We receive aggregated statistics only and have no access to the personal data processed by Meta for this purpose. You may assert your rights against us and against Meta: https://www.facebook.com/legal/controller_addendum

14. Erasure and blocking of personal data

We store your personal data only for as long as this is necessary to achieve the respective purpose or as provided for by statutory provisions. We have specified the actual storage periods for the individual processing operations. Erasure does not take place as long as a contractual relationship has not been fully terminated, statutory retention obligations exist or the data is required for the defense of legal claims.

15. Transfer to third countries

Where we transfer personal data to recipients outside the European Economic Area, this is done only on the basis of a transfer mechanism permitted under Chapter V of the GDPR:

Recipients	Legal basis for transfer
Klaviyo, Inc., USA	Adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), for as long as and to the extent that Klaviyo, Inc. is validly certified; additionally, EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Shopify International Ltd., Ireland	Contracting party established in the EU. As there is no fixed EU data location, transfers to third countries are carried out on the basis of the EU Standard Contractual Clauses and, where applicable, an adequacy decision.
Brame AG, Switzerland	Adequacy decision for Switzerland (Art. 45 GDPR).
Google, Meta	Where transfers to the USA take place: EU-U.S. Data Privacy Framework (Art. 45 GDPR), additionally EU Standard Contractual Clauses.
X, Spotify, Adform	EU-U.S. Data Privacy Framework

Despite appropriate safeguards, it cannot be completely ruled out that, in the case of processing in third countries, public authorities may access data under the law applicable there. A copy of the appropriate safeguards can be requested using the contact details stated under section 3.

16. Your rights

You have the following rights under the GDPR:

Right	Content
Access (Art. 15)	Information as to whether and which data we process about you, including the purposes, recipients, storage period, origin of the data and automated decision-making, as well as a copy of the data.
Rectification (Art. 16)	Rectification of inaccurate data and completion of incomplete data.
Erasure (Art. 17)	Erasure of your data, in particular where they are no longer necessary or you have withdrawn consent.
Restriction (Art. 18)	Restriction of processing, for example where accuracy is disputed or while an objection is being reviewed.
Data portability (Art. 20)	Receipt of the data you have provided in a structured, commonly used and machine-readable format.
Objection (Art. 21)	Objection to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation; to direct marketing, including profiling, at any time and without giving reasons.
Withdrawal (Art. 7(3))	Withdrawal of consent at any time with effect for the future.

To exercise your rights, please contact us using the contact details stated under section 2 or 3. You also have the right to lodge a complaint with a supervisory authority for data protection, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

The provision of personal data is partly required by law or contract or necessary for entering into a contract; otherwise it is voluntary. The consequences of not providing the data are described for the respective processing operation.

17. Changes to this Privacy Policy

We adapt this Privacy Policy if the processing described or the legal framework changes. The version published on our websites shall apply.

ANNEX 1

Market-specific analytics and advertising services used

This annex forms part of the Privacy Policy. All services listed are activated only with your consent. The current cookie list in our consent management tool is always decisive.

Overview of the services used

Service	Provider and notes
Google Analytics 4	Google Ireland Limited, Dublin, Ireland. Web analytics (section 12.3).
Google Ads	Google Ireland Limited, Dublin, Ireland. Conversion tracking and remarketing (section 12.4).
Meta Pixel and Conversions API	Meta Platforms Ireland Limited, Dublin, Ireland. Remarketing (section 12.5).
X Pixel	X Internet Unlimited Company One Cumberland Place Fenian Street Dublin 2, D02 AX07 Ireland. Remarketing (section 12.6).
Spotify Pixel	Spotify USA Inc., 4 World Trade Center, 150 Greenwich Street, 62nd Floor, New York, NY, 10007 Remarketing (section 12.7).
Adform	AdformS/A Silkegade 3B, ground floor & 1st floor, DK-1113 Copenhagen Remarketing (section 12.8).

Use by market domain

Legend: “Yes” = service is used on the market domain. “No” = service is not used there.

Market domain	GA4	Google Ads	Meta Pixel / CAPI	X	Spotify	Adform
eu.	Yes	Yes	Yes	Yes	Yes	Yes
fr.	Yes	Yes	Yes	Yes	Yes	Yes
hu.	Yes	Yes	Yes	Yes	Yes	Yes
it.	Yes	Yes	Yes	Yes	Yes	Yes
nl.	Yes	Yes	Yes	Yes	Yes	Yes
ro.	Yes	Yes	Yes	Yes	Yes	Yes
es.	Yes	Yes	Yes	Yes	Yes	Yes
pt.	Yes	Yes	Yes	Yes	Yes	Yes