Legal information

Privacy policy

Document under legal review. Last updated: [À COMPLÉTER].

Data controller

[À COMPLÉTER : raison sociale], [À COMPLÉTER : adresse du siège]. Contact: [À COMPLÉTER : adresse de contact].

Data collected and purposes

• Waiting list: first name, email, postcode, plan preferences, language, origin of the registration (link or event). Purpose: to notify you of the opening. Legal basis: your consent.
• VinoBox news (optional): email. Purpose: tasting calendar and editorial content. Legal basis: separate consent, which you can withdraw in one click.
• Wines you liked at a tasting: email and chosen wines. Purpose: to suggest these wines to you again. Legal basis: consent.
• Business requests and contact: contact details and message. Purpose: to reply to you. Legal basis: pre-contractual measures / legitimate interest.
• Server logs, with truncated IP addresses. Purpose: security. Legal basis: legitimate interest.

Retention periods

• Unconfirmed registration: deleted after 30 days.
• Confirmed registration: until you unsubscribe or [À COMPLÉTER : maximum period].
• Email delivery events (delivery, bounce, complaint): 12 months.
• Server logs: 14 days.

Processors

• OVHcloud: website hosting (OVHcloud (VPS, datacenter [À COMPLÉTER : localisation UE à confirmer dans le manager])).
• Convex, Inc.: database and server functions, eu-west-1 region (Ireland). US company: [À COMPLÉTER : transfer safeguards to be checked].
• Resend: sending of emails from the eu-west-1 region (Ireland). Account logs and metadata are stored in the United States: [À COMPLÉTER : transfer safeguards to be checked].
• Plausible Analytics: audience measurement without advertising cookies, only if you accept it. [À COMPLÉTER : location to be checked.]
• Stripe (only once payments open): payment. VinoBox does not store any card data.
• [À COMPLÉTER : nom du caviste partenaire]: order preparation and delivery (once sales open).

Your rights

You can access, correct or erase your data, object to its processing or request its portability by writing to [À COMPLÉTER : adresse de contact]. You can also lodge a complaint with the Data Protection Authority (Belgium).