1. General information

At Visitar Bodegas we take our users' privacy seriously. This policy explains what personal data we process, for what purpose, on what legal basis, for how long, and what rights you can exercise. All of this in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

2. What data do we process and why?

Purpose	Data	Legal basis
Responding to enquiries submitted through the contact form	Name, email, phone, message	Consent of the data subject
Managing requests from wineries wishing to be listed or advertised	Contact details and winery details	Pre-contractual measures / legitimate interest
Sending the wine-tourism newsletter	Email	Consent of the data subject
Analytics and website improvement	Browsing data (cookies)	Consent (see cookie policy)
Creating and managing your user account (“My account”)	Name, email, password (encrypted), favourite wineries	Performance of a contract (Art. 6(1)(b) GDPR)
Managing visit bookings and their payment	Name, email, booking details (winery, experience, date, people, amount). Card details are processed directly by Stripe: we never store them	Performance of a contract
Sending transactional emails (confirmation, reminder, cancellation, refund)	Email and booking details	Performance of a contract
Publishing visit reviews	Display name, rating, text, related booking (verification)	Consent of the data subject
Issuing gift cards	Buyer’s and recipient’s email, message, amount	Performance of a contract
Communicating the booking to the winery	Only the booking reference, experience, date, time, people and amount. The winery NEVER receives your name or email	Performance of a contract
Communicating the booking to the company organising an experience	Name, email, phone, pick-up point (if the experience includes it), chosen option, experience, date, time and number of people. Only for experiences run by companies (not wineries), which need this data to provide the service	Performance of a contract

3. Data retention

We retain data for as long as necessary to handle your request and, subsequently, for the legally required periods. In the case of the newsletter, until you unsubscribe. Browsing data is retained according to the periods set out in the cookie policy.

4. Recipients

We do not disclose your data to third parties except where legally required. It may be accessed by the technology providers who provide us with services (web hosting, email, analytics tools and communication services), acting as data processors and with the appropriate safeguards. Some of these providers may be located outside the European Economic Area, in which case the safeguards provided for by the GDPR apply.

When you book an experience run by a company (tours, tastings, routes or other activities not provided by a winery), we share with that company the data needed to carry it out: name, email, phone, pick-up point if any and the booking details. The company processes them as a controller to provide the service and is contractually bound to use them only for that purpose and to protect them under the GDPR. Each experience page shows the company that organises it. Wineries do not receive your contact details.

Processors we use and where they process data: Supabase (database, authentication and functions; servers in the European Union, Ireland region), Stripe (payments; Stripe Payments Europe Ltd., Ireland; card details are processed directly by Stripe), Resend (transactional emails and delivery of the website forms to our mailbox; United States, covered by Standard Contractual Clauses and the EU-US Data Privacy Framework), Google (Tag Manager, Analytics and AdSense; loaded only if you accept cookies; Google Ireland Ltd., transfers covered by the Data Privacy Framework) and Raiola Networks (web hosting; Spain). The wineries you book with act as independent controllers solely for the booking data we pass on (reference, date, time, people and amount), which does not include your name or email.

5. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, as well as withdraw any consent given, by writing to hola@visitarbodegas.com, indicating the right you wish to exercise. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es) if you consider that the processing does not comply with the applicable regulations.

6. Security

We apply reasonable technical and organisational measures to protect your data against loss, misuse or unauthorised access, in line with the state of the art and the nature of the data processed.

7. Changes to this policy

We may update this policy to adapt it to legislative developments or to changes in our services. We recommend that you review it periodically. Please also see our legal notice and our cookie policy.