PRIVACY POLICY

In Vega Tolosa Winery, we are committed to protecting the privacy and security of your personal data. This Privacy Policy describes how we collect, use and protect the personal information you provide to us through our website, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RGPD) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

1. RESPONSIBLE FOR THE TREATMENT

Company name: Pagos de Familia Vega Tolosa S.A.
Commercial Name: Vega Tolosa Winery
C.I.F.: A02483626
Registered office: Paseo Cañada, 26 – 1st floor
E-mail: info@vegatolosa.com
Activity: Wine making, e-commerce and wine tourism services.

2. PURPOSE OF THE TREATMENT

In Bodega Vega Tolosa we treat the information provided by interested persons with the following purposes:

Online Store Management: Process wine and product orders, manage payment through secure gateways and make the corresponding invoicing and shipping.
Reservations and Wine Tourism: Manage reservations for guided tours, tastings and experiences in our winery, as well as communication related to your visit.
Partner Area: Manage the registration, access, preferences and purchases of users registered in our private area or loyalty club.
Customer Service: Address queries, doubts or requests received through the contact form or email.
Newsletter and Communications: If you give us your express consent (subscription to the newsletter), we will use your email to send you news, exclusive offers and news about our winery.
Analysis and Improvement: Perform statistical analysis of the use of the web to improve our services (see Cookie Policy).

3. LEGITIMATION

The legal basis for the processing of your data depends on how you interact with us:

Performance of a contract: It is the legal basis for processing your purchases in the online store, wine tourism reservations and registration in the partner area. Without this data we would not be able to provide the service to you.
Consent of the interested party: It is the basis for sending the newsletter, the use of analytical cookies and the response to your general queries. You can withdraw this consent at any time.
Legal obligation: For tax, accounting and administrative management (e.g. issuing invoices).
Legitimate interest: To perform security checks, fraud prevention and improve the user experience.

4. HOW TO STORE DATA

Your data will be kept for as long as the business relationship is maintained or for the years necessary to comply with legal obligations.

Customer data and billing: They will be kept for a minimum of 5 years after the last operation to comply with tax and commercial regulations.
Subscriber data (Newsletter): They will be kept until the user requests their withdrawal or revokes their consent.
Partner details: As long as the user keeps their account active. If you unsubscribe, the data may be blocked during the legal periods of prescription of responsibilities.

5. RECIPIENTS

We do not transfer your data to third parties, except legal obligation or when it is strictly necessary to provide the contracted service. We share data with the following service providers, who act as processors under conditions of confidentiality:

Transport companies: Your shipping data (name, address and telephone number) will be transferred to the logistics companies we work with (Post, SEUR, MRW, or other punctual) exclusively to deliver your order.
Payment platform: Payments are managed securely through the gateway Redsys. Bodega Vega Tolosa does not have access to or store the complete data of your card; the transaction is carried out directly with the bank.
Email Management: We use the tool FluentCRM to manage our communications and database, operated from our own systems.
Tax Advisory: For compliance with the accounting and tax obligations of the company.
Public administration: Tax Agency and other competent bodies, when required by law.

6. INTERNATIONAL TRANSFERS

Our hosting servers are located within the European Economic Area (EEA), guaranteeing a high level of protection.

For web analytics we use Google Analytics, a service of Google, LLC. The use of these tools may involve an international transfer of data to the US. U.S.A. Google adheres to the EU-US Data Privacy Framework, which ensures an adequate level of protection of your personal data in accordance with European regulations.

7. RIGHTS OF USERS

What are your rights?

As a user, you have the right to have control over your data. You can exercise the following rights free of charge:

Access: Consult what personal data we have about you.
Correction: Modify the data if they are inaccurate.
Deletion: Request that we delete your data when it is no longer necessary.
Limitation: Request the limitation of the processing of your data in certain circumstances.
Opposition: Oppose the processing of your data (for example, not to receive further advertising).
Portability: Receive your personal data in a structured format.

To exercise these rights, send an email to info@vegatolosa.com, indicating in the subject "Data Protection" and attaching a copy of your ID or equivalent document to verify your identity.

8. PROTECTION OF MINORS AND ALCOHOL

The sale of alcohol is prohibited to children under 18 years of age.

This website, as well as the registration in the area of partners and the purchase of products, is aimed exclusively at over 18 years of age. Bodega Vega Tolosa implements age verification notices for access. If we detect that a minor has provided us with personal data without proper authorization, we will proceed to its immediate deletion.

9. SECURITY MEASURES

Pagos de Familia Vega Tolosa S.A. undertakes to comply with its obligation of secrecy of personal data and its duty to keep them, and will adopt the necessary measures (such as the use of secure HTTPS/SSL protocols) to prevent their alteration, loss, treatment or unauthorized access, taking into account at all times the state of technology.