Data controller
MAS GORI SCP (Enlaire Vins) · Tax ID J66295726 · Masia Cal Gori s/n (Can Rossell), 08739 Subirats, Barcelona, Spain · info@enlairevins.cat · +34 620 097 761.
What data we process and why
Contact and visits: name, email, phone (optional) and whatever you tell us, to reply and arrange the visit. To book the visit, the deposit is charged by card through Stripe (and, where applicable, refunded the same way).
«Which wine suits you?» quiz: name, email and your answers, to send you the result.
Orders: name, email, phone, delivery address and the wines ordered, to confirm shipping, charge it by card through Stripe, prepare and ship the order and issue the invoice. You enter your card details directly with Stripe: we never see or store them.
Newsletter: your email address, to send you news from the winery.
Ratings: a few days after an order arrives, we email you a link to rate the wines. If you use it, we process the score, the comment and the name or initials and town you enter, in order to publish them on the wine page. We only ask once, and the email carries a link to stop receiving them. What we publish is what you wrote: never your email, address or anything from the order.
For each form we also keep the date and the exact text you accepted, as proof of consent. The website does not profile you or make automated decisions.
Legal basis
Your consent for contact, visits, the quiz and the newsletter (art. 6.1.a GDPR), which you can withdraw at any time; performance of the contract for orders and for booking a visit with a deposit (art. 6.1.b); and the legal obligation to keep invoices (art. 6.1.c). To publish a rating, the express consent you give on the form; you can withdraw it by writing to us and we take it off the website.
Retention
Enquiries, visits and quiz: 12 months from submission, then deleted automatically. Visits with a paid deposit: 6 years, like orders. Orders: as long as tax and commercial law requires (up to 6 years for invoices). Newsletter: until you unsubscribe. Ratings: published ones, for as long as they are on the website or until you ask us to remove them; those never published, 12 months. Backups are kept for 35 days (daily) and 12 months (monthly): anything deleted from the website also disappears from the backups within that period at most.
Processors and transfers
Cloudflare, Inc.: website hosting and the database for forms and orders, with data stored in the European Union.
Resend (Plus Five Five, Inc.): sending the website's emails. It is based in the United States: the transfer relies on the standard contractual clauses approved by the European Commission.
Backblaze, Inc.: encrypted backups of the database (orders, visits and forms), on a server in the United States. The transfer relies on the standard contractual clauses approved by the European Commission.
Sentry (Functional Software, Inc.): detecting errors on the website, with the data in the European Union (Germany). It receives the technical error, never what you type in the forms or the order. The company is US-based and relies on the European Commission's standard contractual clauses.
Umami, the visit statistics, installed by Pablo Pedrosa Manchón on servers in the European Union (Render, in Frankfurt, and Supabase, in Ireland): only if you accept statistics in the cookie notice, with no cookies of its own and without storing your IP address.
Stripe Payments Europe, Ltd. (Ireland): card payments for orders and visit deposits. It receives your name, email, the amount and order or visit number, and your card details, which you enter directly on its payment page. Stripe may transfer data to Stripe, Inc. (United States) under the European Commission's standard contractual clauses and the EU-US Data Privacy Framework. For fraud prevention and its own financial obligations, Stripe also processes the data as a controller: stripe.com/privacy.
Pablo Pedrosa Manchón: website development and maintenance, with access to data only when needed to maintain it.
For orders, the delivery address is shared with the courier. We do not share data with third parties for advertising. The Google map only loads if you ask for it with a click.
Your rights
You can access, rectify or erase your data, object to or restrict processing, request portability and withdraw consent by writing to info@enlairevins.cat. If you feel we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).