Privacy Policy

1. Data Controller

Bodegas Trenza S.L.
Partida Canor, 19, 03720 Benissa (Alicante), España
Email: david@bodegastrenza.com
Phone: +34 965 790 012

2. Data We Collect

• Account data: name, email, phone, password (hashed).
• Order data: shipping address, purchase history, amounts.
• Event bookings: name, email, phone, number of guests.
• Communications: contact messages, newsletter subscriptions.
• Technical data: essential cookies, language, age verification.

3. Purpose & Legal Basis

• Contract performance (GDPR Art. 6(1)(b)): manage orders, bookings and accounts.
• Consent (Art. 6(1)(a)): newsletter, marketing, non-essential cookies.
• Legal obligation (Art. 6(1)(c)): invoicing, Spanish tax law.
• Legitimate interest (Art. 6(1)(f)): security, fraud prevention.

4. Retention Periods

Order data: 6 years (tax obligation). Account data: until deletion is requested. Newsletter: until you unsubscribe. Technical logs: 12 months.

5. Recipients & Processors

We share data only with processors necessary to provide the service:

International transfers are made under EU Commission Standard Contractual Clauses (SCCs).

6. Platform & Hosting

This site is built and deployed using Lovable (Lovable AB, Sweden), which provides the hosting infrastructure, deployment pipeline and managed backend ("Lovable Cloud", powered by Supabase). Lovable acts as a data processor under GDPR Art. 28. Data is hosted in the EU region (Frankfurt).

You can review Lovable's security measures, compliance certifications (SOC 2, GDPR, encryption in transit and at rest) and up-to-date sub-processor list at the Lovable trust centre: trust.lovable.dev.

7. Your Rights

Under GDPR, you have the right to: access, rectification, erasure, objection, restriction, portability and not to be subject to automated decisions. Exercise them by emailing david@bodegastrenza.com or from your account at /account/profile.

You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

8. Security

We apply appropriate technical and organisational measures (TLS encryption, hashed passwords, role-based access control, database RLS) to protect your data.

9. Automated Decision-Making & Profiling

Bodegas Trenza does not carry out automated decision-making or profiling that produces legal or similarly significant effects on users (GDPR Art. 22). Should we introduce recommendation or segmentation logic with such effects in the future, it would only run with your explicit consent and would always guarantee your right to obtain human intervention, express your point of view and contest the decision.

10. Data Breach Notification

In the event of a personal data breach, we will notify the Spanish Data Protection Agency (AEPD) within 72 hours of becoming aware of it, in accordance with GDPR Art. 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay (GDPR Art. 34), describing the nature of the incident, the measures taken and our recommendations to mitigate any potential consequences.

11. Minors

This site applies a dual age restriction: Spanish law on the sale of alcoholic beverages requires a minimum age of 18 to purchase or consume our products; additionally, under Art. 7 of the Spanish LOPDGDD, minors under 14 cannot give valid consent to the processing of their data without authorisation from their parents or legal guardians.

We do not knowingly collect data from minors. If we become aware that data has been collected from a minor without proper authorisation, we will delete it immediately. Our shipping carrier verifies the recipient's age via national ID at the point of delivery.

Parents or guardians can contact us at david@bodegastrenza.com to request access, rectification or deletion of a minor's data.

12. Changes

We may update this policy. Substantial changes will be notified by email or on the site.