Privacy Policy

Data controller

The controller is the legal person identified above.

Data we collect

• Identity and contact details supplied during enquiries, registration, checkout or customer service.
• Order, delivery, payment status, invoice and transaction information.
• Age-confirmation and verification records where required, without retaining more identity data than necessary.
• Technical data such as IP address, browser/device information, security logs and cookie identifiers.
• Marketing preferences and communications where a lawful basis applies.

Purposes and legal bases

• Process orders, payments, deliveries, collections, returns and support — performance of a contract.
• Meet tax, accounting, consumer-protection and age-restriction obligations — legal obligation.
• Prevent fraud, secure the website and manage legitimate operations — legitimate interests balanced against user rights.
• Send optional electronic marketing — consent or another lawful basis where available.

Recipients and processors

Hosting and email services: Hostinger and the website’s transactional email services.

Website and ecommerce services: WordPress, WooCommerce, Elementor, Jetpack/Automattic, Complianz, Age Gate, WP Rocket, Google Site Kit, Filter Everything and OceanWP.

Payments: payment gateway and banking providers selected at checkout; cash on collection where offered.

Delivery: Albert’s Vinoteca staff and local delivery providers where required to fulfil an order.

Analytics and advertising, subject to consent where required: Google Analytics, Google Site Kit, Google Ads, Google for WooCommerce and Automattic/WooCommerce Analytics.

We may also share data with accountants, professional advisers, insurers, fraud-prevention providers and public authorities where necessary or legally required. We do not use a separate newsletter provider unless a marketing service is later activated.

International transfers

Some service providers, including Google, Automattic and hosting or technology suppliers, may process data outside the European Economic Area. Where required, transfers are protected by an applicable European Commission adequacy decision, Standard Contractual Clauses and supplementary safeguards.

Retention

We retain personal data only for as long as necessary. Invoices and accounting records are normally kept for 6 years, and tax records for at least 4 years. Order, contract and customer-service records may be kept for up to 5 years after completion, or longer where a dispute or legal duty requires it. Enquiries that do not result in an order are normally kept for up to 12 months. Account data is retained while the account remains active and is then deleted or anonymised, except for records we must retain. Marketing data is retained until consent is withdrawn or the customer objects, with a minimal suppression record retained where necessary. Consent evidence and security logs are kept only as long as needed; routine security logs are normally retained for up to 12 months unless an incident requires longer retention.

Your rights

Where applicable, individuals may request access, rectification, erasure, restriction, portability or objection, and may withdraw consent. Contact sales@albertsvinoteca.es. Complaints may be made to the Agencia Española de Protección de Datos at www.aepd.es.

Security and updates

We use proportionate technical and organisational measures, although no internet service can guarantee absolute security. This policy will be updated when services or legal requirements change.

Last updated: 14 August 2026