Privacy & cookie notice

1. Controller

Wine Connect S.r.l., registered office Firenze, Via Duca d'Aosta 20, VAT IT07561510483, Companies Register di Firenze.

To exercise your rights or ask about this notice: info@wearewineconnect.com. No Data Protection Officer is appointed; requests go to the controller.

2. Categories of data

We process only what the Service needs:

• Identity and contact: email, contact name, company name, phone, country.
• Account: credentials (hashed), role (buyer, winery, operations, CRM, carrier, admin), language preference, cookie consent.
• Buyer profile and compliance: delivery addresses, EU VAT, company category, invoice and excise data.
• Orders and samples: lines, quantities, prices, totals, payment status, SEPA reference, tracking.
• Payments: outcome, amount, transaction IDs. Full card data stay with Stripe; inbound IBAN is our Qonto account.
• Logistics: professional address, postcode, transport documents, pallet codes.
• Communications: transactional email, book-a-call, briefs, support messages.
• Technical data: IP address, user-agent, security logs, error diagnostics, Turnstile tokens.
• Catalogue use (search, cart) as needed to run the Service.
• Measurement cookies and pixels only if you accepted optional cookies.

3. Purposes and legal bases (GDPR Art. 6)

Each purpose has its own basis:

• Contract (Art. 6(1)(b)): account, onboarding, authenticated catalogue, cart, checkout, orders, samples, invoicing, delivery, order support.
• Legal obligation (Art. 6(1)(c)): invoices and books (Italian civil/tax retention, typically 10 years), VAT, excise, e-DAS, customs, lawful authority requests.
• Legitimate interest (Art. 6(1)(f)): platform security, fraud and abuse prevention, diagnostics, catalogue improvement, communications strictly tied to an open order. You may object at any time.
• Consent (Art. 6(1)(a)): measurement and marketing cookies (GTM, GA4, Meta Pixel) via the banner; newsletter if you opted in at signup or in the profile. Consent can be withdrawn without affecting prior processing.

4. Recipients

Data are available to Wine Connect staff by role (admin, operations, CRM, logistics) and, as needed, to wineries (pallet prep for your order) and the carrier.

Providers that process data for us, or as independent controllers of their payment services:

• Supabase: authentication, database and storage.
• Vercel: website hosting.
• Stripe: card and PayPal payments.
• PayPal (via Stripe): if you choose PayPal.
• Qonto: SEPA account and transfer matching.
• Resend: transactional email (confirmations, magic links, order status).
• Cloudflare Turnstile: bot protection on login/signup (required for the Service).
• Google Maps Platform (Places): address autocomplete on pages that need it.
• Google Tag Manager / Google Analytics 4 and Meta Pixel: only with optional-cookie consent.
• Carriers and logistics operators performing delivery.
• Tax and legal advisers and, where required, authorities (customs, excise, Garante).

5. Transfers outside the EEA

Some providers (notably Stripe, PayPal, Google, Meta, Vercel, Cloudflare) may process data outside the European Economic Area. Transfers then rely on Chapter V GDPR: adequacy decisions where they exist and/or the European Commission’s Standard Contractual Clauses, plus technical measures (HTTPS, minimisation).

6. Retention

We do not keep data indefinitely. Main periods:

• Account and profile: for the relationship and, after closure, as long as needed to wind up open orders and disputes.
• Paid orders, invoices, tax and excise documents: 10 years from recording, as required by Italian law.
• Unpaid / draft orders: long enough to complete or close them, then deletion or anonymisation.
• Security and diagnostic logs: a limited period, as a rule not more than 12 months, unless an investigation is open.
• Cookie consent (wc-cookie-consent): 12 months, then the banner is shown again.
• Newsletter: until you withdraw consent.

7. Cookies and similar technologies

We use cookies and local storage. The banner lets you “Accept all” or “Reject optional”. Rejecting optional cookies does not block login, catalogue, cart or checkout.

• Strictly necessary (always on): Supabase session (sb-* cookies), language (wc-locale), the consent cookie itself (wc-cookie-consent), Turnstile, security cookies. Basis: contract / legitimate interest in running a secure site.
• Functional: Google Maps Places on address pages (onboarding, profile). You can still type the address by hand.
• Measurement and marketing (consent only): Google Tag Manager, Google Analytics 4 (IP anonymised where configured), Meta Pixel. They do not load if you reject optional cookies.

8. Automated decisions

We do not take decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). Catalogue suggestions or briefs are aids; they do not place an order for you.

9. Your rights

Under Arts. 15-22 GDPR you may request access, rectification, erasure, restriction, portability, objection to legitimate interest, and withdrawal of consent. Erasure may be limited by tax-retention duties.

Write to info@wearewineconnect.com from the account email. We reply within one month, extendable by two in complex cases. You may lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, Italia, https://www.garanteprivacy.it.

10. Security

We apply appropriate technical and organisational measures: HTTPS, role-based access, service keys kept off the public client, internal error logs. No system is immune: if a relevant breach occurs we will inform you and, where required, notify the Garante within the legal deadline.

11. Minors and B2B

The Service is not for anyone under 18 and is not consumer retail. If we find an incompatible account we close it and delete data that the law does not require us to keep.

12. Changes

We may update this notice. The date at the top is current. For material changes (new purposes, new significant recipients) we will highlight them on the site or by email. Continued use after publication means you have seen the update, without prejudice to mandatory rights or to consents already given or withdrawn.