01What we do, case by case
Requests for wines, tastings and quotes
- Data
- Name, e-mail, phone, items requested, notes; delivery address, dates and times; company, tax number and country, if given.
- Purpose
- Answering the request, confirming prices, arranging delivery, keeping the customer's history.
- Legal basis
- Steps prior to a contract and performance of the contract, at your request (GDPR, Art. 6(1)(b)).
- Kept for
- Up to 2 years after the last contact. Invoicing details: 10 years (legal obligation, Art. 6(1)(c)).
Price-list request
- Data
- E-mail and mobile number.
- Purpose
- Sending the list and talking to you about trade terms.
- Legal basis
- Steps prior to a contract, at your request (Art. 6(1)(b)).
- Kept for
- Up to 2 years after the last contact.
Campaigns and news
- Data
- Name, e-mail, mobile number and the date of consent. For ads, the e-mail and mobile number may be uploaded, hashed, to Meta's and Google's platforms to build audiences.
- Purpose
- Sending you campaigns and showing you our ads.
- Legal basis
- Your consent (Art. 6(1)(a)), given in a box that is never pre-ticked.
- Kept for
- Until you withdraw consent. Just reply to any of our e-mails or write to almaduva.lda@gmail.com.
Address search
- Data
- The text you type in the address field and, when you pick a result, that address's coordinates.
- Purpose
- Avoiding address mistakes and planning delivery routes.
- Legal basis
- Performance of the contract (Art. 6(1)(b)).
- How
- The search goes through our server: the map service receives the text, never your IP address or identity.
Analytics and marketing on the site
- Data
- Pages viewed, products viewed and added to the request, cookie identifiers.
- Purpose
- Measuring what interests people and advertising to those who visited the site.
- Legal basis
- Your consent on the cookie notice (Art. 6(1)(a)). Without it nothing is loaded.
- Kept for
- The periods Google and Meta set for their cookies (up to 13 months).
02Who helps us (processors)
They work on our behalf, under a data-processing agreement, and only for the purposes stated:
- Supabase: database of requests and customers. Servers in Ireland (European Union).
- Vercel: site hosting, visit counts and speed measurement (no cookies). A US company; traffic may pass through servers outside the EU.
- Resend: delivery of confirmation e-mails and team notices. A US company.
- Photon (komoot, Germany): address search on OpenStreetMap data. It receives only the text searched.
- Google (Tag Manager and Ads) and Meta (Pixel): only if you accept marketing cookies.
Transfers to the US rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
03Security
- Every connection to the site and the database is encrypted (HTTPS).
- The management area only opens to authorised Alma d'Uva staff, each with their own account.
- The database refuses any read of requests or customers that does not come from one of those accounts.
- If a data breach puts you at risk, we notify the CNPD within 72 hours and tell you without delay.
04How to exercise your rights
Write to almaduva.lda@gmail.com from the e-mail you used in the request and say what you want: to see, correct, erase, restrict, object, take your data with you or withdraw consent. We may ask you to confirm your identity. We reply within 30 days; erasure covers the database and the e-mail logs, except what the law makes us keep (invoices).
You always have the right to complain to the CNPD at cnpd.pt. The summary is in the Privacy policy.