Privacy Policy
PRIVACY POLICY
1. ENSURING PRIVACY
The Provider of the website www.winera.com and Winera Application (‘’Winera Platform’’) is WINERA, web portal, d.o.o. . (hereinafter referred to as the "Provider"). At WINERA d.o.o., we value your privacy, so we constantly strive for the highest level of protection for your personal data. This privacy policy is intended only for users of the platform www.winera.com. It sets out the rights and obligations of the controller and processors in managing and processing users' personal data.
When using our Winera Platform or conducting business through telecommunications services, the Provider is obliged to process your data under the currently valid European legislation (General Data Protection Regulation/GDPR) and with following the valid national legislation of the Republic of Slovenia, namely by the Consumer Protection Act (ZVPot-1), the Personal Data Protection Act (ZVOP-2), the Electronic Commerce Market Act (ZEPT), and the Electronic Communications Act (ZEKom-2).
The purpose of this privacy policy is to explain for what purposes your personal data will be collected and how they will be used, as well as what rights the user has regarding the data held by the Provider. In the case of data based on which the user can be identified, the Provider assures the user that this data will be used by this privacy policy. The Provider undertakes not to sell, lend, or otherwise disclose users' personal data to third parties, except in cases provided by law and this policy.
2. DATA CONTROLLER AND DATA PROCESSOR
The data controller and data processor of the personal data of users of the Winera Platform is WINERA, online portal, d.o.o., Dunajska cesta 136, 1000 Ljubljana, email: [email protected], phone number: +386 1 600 14 12
The authorized person of the website Provider regarding the personal data of users is: Djordje Milivojević, email: [email protected].
3. PRINCIPLES REGARDING THE PROCESSING OF USERS' PERSONAL DATA
Both the controller and the processors acting on its behalf respect the general principles of processing users' personal data on the Winera Platform, namely:
- We process users' personal data lawfully, fairly, and transparently.
- We collect personal data for specific, explicit, and legitimate purposes, and we do not process personal data for other purposes unless it is for scientific or historical research purposes or for statistical purposes under certain conditions.
- We process personal data to the minimum extent necessary for the purposes they are processed.
- We ensure that the personal data we process are accurate and regularly updated, and we correct or delete inaccurate data.
- We only retain personal data for as long as necessary for the purposes we process them.
- We use appropriate technical and organizational measures to ensure the appropriate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage.
4. COLLECTION AND PROTECTION OF USERS' PERSONAL DATA
The Provider of the Winera Platform is required to protect the personal data of its users in accordance with the Personal Data Protection Act (ZVOP-2) and the General Data Protection Regulation.
4.a REGISTRATION
On our website, you can register to create a user account and make reservations for services on our platform.
Before the registration of a user account, the collector may collect the following personal data from visitors of the website (hereinafter: “Non-registered users”):
− IP address
− The information on the geolocation of the Non-registered users
For registration of a user account and upon registration or activation of a registered user account, the Provider collects the following personal data voluntarily provided by the user:
- Name and surname
- E-mail address
- Password
- User address
- Phone number
- IP address and information on geolocation
- Personal photo (only if uploaded by the user)
All data voluntarily provided by the user are collected solely for registration on the Winera Platform (i.e., to create a user account) and any communication related to the user account. If you make service reservations through your user account, the data about your orders are stored under the "My reservations" tab in your user account. The provider is not responsible for the accuracy of the data entered by the user.
The provider undertakes not to disclose user data to unauthorized persons and to protect users' personal data by the provisions of the Personal Data Protection Act (ZVOP-2) and the General Data Protection Regulation.
The provider may disclose received data to contractual processors, if any, the external IT provider who maintains Winera Platfom and external marketing service providers who are contractually bound to the same protection personal data protection standards as the provider.
The provider may disclose received data to authorized third parties, as described under point 5 below (Disclosure of data to third parties).
The user has the right to free access, copy, supplement, or correct their personal data that we have, as well as the deletion of personal data related to them. In case of deletion, processing, or use of your personal data, please get in touch with us at: [email protected] or send your request in writing to: WINERA d.o.o., Dunajska cesta 136, 1000 Ljubljana.
4.b CONCERNING THE PROTECTION OF CHILDREN'S PERSONAL DATA
The Winera Platform does not collect children’s personal data and does not allow users under 21 age to register user accounts.
4.c SERVICE RESERVATION
The Winera Platform enables users to make service reservations 24 hours a day, every day of the year. Registration is required for service reservations.
Services are detailed in the offer available on the Winera Platform. The provider defines the characteristics and price of the service, any discounts and promotions, reservation and payment methods, and User rights on the winera.com platform. Before confirming the order, the User is informed of the terms of service and agrees to them upon reservation.
Registered users can make service reservations on the website, providing the following information:
- Name and surname
- E-mail address
- Password
- User address
- Phone number
- Personal photo (only if uploaded by the user)
- Credit card details
The data collected during service reservations is used to fulfill our contractual obligations and enforce rights arising from the contractual relationship. Processing this data is necessary for executing service reservations on our website and is carried out upon entering into a contractual relationship with us. The provider cannot guarantee the service reservation if the required data is not provided.
4.d CONFIRMATION OF RESERVATION
After submitting a service reservation, the provider checks availability with the artners and informs the User of the reservation's confirmation or rejection by sending a message to the User's email inbox, notifying them that their service reservation was successful. Further steps regarding the service reservation will be communicated via email.
The distance contract between the User and the Provider is concluded when the User confirms the service reservation and pays for it.
A confirmation of the service reservation with all the details regarding the reserved service will be sent to the provided email address (user's email address). By submitting the service reservation, the User confirms agreement with the general terms of use and unconditionally accepts them in full.
The service reservation is kept in the provider's archive for up to 10 years in physical form. The Provider is not liable for any loss caused by interruption, alteration, deletion, or unavailability of electronic trading services in the electronic trading system.
4.e SUBSCRIPTION TO E-NEWSLETTERS
Under the Electronic Communications Act, the provider may send e-newsletters containing information, updates on offers, and additional benefits to the email address provided by the user during registration, with the user selecting this option. E-newsletters are sent occasionally and as needed.
By entering the user's email address and clicking on "Subscribe," the user expressly consents to receiving the desired newsletters at the provided email address. The site provider handles the user's personal data responsibly and respectfully. Additionally, the site Provider emphasizes that, in addition to the input field data, the user's computer's IP address from which the user registered will also be recorded, and data on the time of opening the sent messages will be collected.
The site Provider collects the user's personal data for the purpose of direct marketing, informing about news, and special offers. The site Provider will retain the received personal data until the user requests deletion or until the user unsubscribes from the e-newsletters.
By selecting the e-newsletter option, the user allows the processing of their personal data to send e-newsletters(from which the user can unsubscribe at any time by sending an email to: [email protected] or by sending a written request to: WINERA d.o.o., Dunajska cesta 136, 1000 Ljubljana), for statistical purposes, sending advertisements and promotional materials, prize contests, administering the subscribed services, and incident management.
4.f FACEBOOK, YOUTUBE, AND INSTAGRAM, TIKTOK
The Provider of the Winera Platform enables users to directly contact the provider via the Provider's accounts on social media platforms such as YouTube, Facebook, and Instagram, through functions provided by these social networks, such as commenting, messaging, and chatting. All information received by the Provider from users on this basis will be processed by the Provider and processors exclusively for the purpose of addressing the user's question, request, or inquiry.
At this point, the Provider expressly and additionally notes that they do not have any influence over the scope, nature, and purpose of processing your personal data carried out by the social media service provider. Therefore, we direct you to the privacy policies of the social media service providers.
The privacy policies are available at the following links:
Facebook: https://www.facebook.com/about/privacy/
Instagram: https://help.instagram.com/519522125107875/
YouTube: https://www.youtube.com/howyoutubeworks/user-settings/privacy/
TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en
5. LEGAL BASIS FOR PROCESSING
The legal basis for processing the personal data listed under point 4.a, 4.c and 4.d of this Privacy Policy is that the processing of personal data is necessary for the performance of a contract, specifically to finalize and administer your service reservation. If the required personal data is not provided, we may be unable to finalize the service reservation.
Also, to process personal data under article 4 of this Privacy Policy, the legal basis relies on the unambiguous consent expressed by the user when the user registers an account, by which the user accepts the terms of this Privacy Policy, or when the user subscribes to receive e-newsletters and/or other promotional messages.
The controller also has a legitimate interest in continuing and improving its business, expanding the network of users, informing users about news, offers, actions, and other promotions, and protecting the business.
6. DISCLOSURE OF DATA TO THIRD PARTIES
The controller may disclose the user’s personal data to third parties to fulfill its contractual and legal obligations. These third parties include:
− the Partners (as defined in our General Terms of Use), who would require the user’s personal data to organize the wine tour or note the reservation that was made through our website;
− payment service providers;
− IT companies maintain the website
− marketing agencies and advertising partners;
− other professional third parties, such as law firms and auditors;
− competent authorities, when it is required by law;
7. DATA RETENTION PERIOD
The Provider and processors of the winera.com website assure users that personal data is retained for as long as necessary to fulfill the purpose for which the individual personal data was collected and used. Upon expiry of the retention period, the Provider and processors effectively and permanently erase or anonymize your data so that user identification is no longer possible.
However, personal data processed by the Provider and processors based on the law is retained for the period prescribed by legislation. All personal data processed by the Provider and processors for the execution of a contractual relationship with the user is retained for the period necessary for the execution of the contract and for the duration of the statute of limitations for claims arising from the concluded contract, except in cases of disputes regarding contractual relationships.
All contractual documentation, including invoices, credit notes, confirmed offers, orders, and similar, is retained for up to 10 years. In cases of different legal retention periods, such as accounting and tax data, the retention period for these documents is 10 years, during which time the processing of this data is restricted.
All personal data received by the Provider and processors based on the user's consent for purposes such as newsletter subscriptions and similar cases are retained for up to 10 years or until revoked and the user withdraws consent. The Provider undertakes to regularly verify the existence of the purpose of processing personal data at regular intervals, and data will only be deleted before the expiry of the 10 years or before the user revokes consent if the purpose of processing personal data has already been achieved or if required by law.
The Winera Platform's data controller commits to carefully safeguarding all collected personal data and will not disclose them to third parties without the explicit consent of the user, except in cases where competent government authorities request data from the controller based on legal grounds and in cases where there is suspicion of misuse by the user of the winera.com website.
In addition to the above, the controller informs all users of the winera.com website that their personal data may be entrusted to our business partners (data processors), who process the entrusted personal data of users solely on behalf of the controller and within the limits of the controller's authorization and by the purposes defined in this privacy policy. Processors carefully protect and retain the received personal data for as long as necessary to achieve the purpose for which the data was collected, and they must not use them for their own purposes.
The controller may only transmit or transfer users' personal data (e.g., name, surname, and details of the reserved service) to a third country outside the European Union or to an international organization with an adequate level of personal data protection.
8. USER RIGHTS
Every user of the Winera Platform has the following rights:
8.a RIGHT TO WITHDRAW CONSENT
Every user who has given explicit consent to the processing of personal data (regardless of the purpose) has the right to withdraw their consent at any time without affecting the lawfulness of the processing based on the consent before its withdrawal.
The withdrawal of consent for processing personal data does not have any negative consequences or sanctions for the user. However, it is possible that after the withdrawal of consent to process personal data, the controller may be unable to provide individual or multiple services if they cannot be provided without personal data.
8.b RIGHT TO ACCESS PERSONAL DATA
Every user of the winera.com platform has the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to personal data and certain information related to the data processing, such as the purposes of the processing, the types of personal data, the users, the storage periods or criteria for determining the periods, the existence of the right to rectification or erasure of data, the right to restriction of processing and the right to object to processing, the right to complain with a supervisory authority, the source of data if the data were not collected from you, the existence of automated decision-making, including profiling, the reasons for it, and the significance and consequences of such processing for you, and other information by Article 15 of the General Data Protection Regulation.
8.c RIGHT TO RECTIFICATION OF PERSONAL DATA
Every user of the winera.com platform has the right to request the controller to correct inaccurate personal data concerning them without undue delay. Considering the purposes of the processing, the user has the right to have incomplete personal data completed, including utilizing providing a supplementary statement.
8.d RIGHT TO ERASURE OF PERSONAL DATA ("RIGHT TO BE FORGOTTEN")
Every user of the winera.com platform has the right to request the controller to erase personal data concerning them without undue delay. The controller must erase the personal data of the user without undue delay if one of the following grounds applies:
- the personal data are no longer necessary about the purposes for which they were collected or otherwise processed,
- the user withdraws consent on which the processing is based and where there is no other legal ground for the processing,
- the user objects to the processing, and there are no overriding legitimate grounds for the processing,
- the personal data have been unlawfully processed,
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject,
- the personal data have been collected in relation to the offer of information society services.
8.e RIGHT TO RESTRICTION OF PROCESSING
Every user of the winera.com platform has the right to request the controller to restrict processing where one of the following applies:
- the user contests the accuracy of the data, for a period enabling the controller to verify the accuracy of the personal data,
- the processing is unlawful, and the user opposes the erasure of the personal data and requests the restriction of their use instead,
- the controller no longer needs the personal data for the purposes of the processing, but the user requires them for the establishment, exercise, or defense of legal claims,
- the user has objected to processing pending the verification of whether the legitimate grounds of the controller override those of the user.
8.f RIGHT TO DATA PORTABILITY
Every user of the winera.com platform has the right to request to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
- the processing is based on consent or on a contract, and
- the processing is carried out by automated means.
At the same time, each user, in exercising the right to data portability, has the right for their personal data to be transmitted directly from one controller to another, where technically feasible.
8.g RIGHT TO OBJECT TO PROCESSING
In cases where the processing of personal data is based on the controller's legitimate interests, each user has the right, for reasons related to their particular situation, to object to the processing of personal data at any time. In such cases, the controller and processors will only continue processing the user's personal data if they can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the user, or for the establishment, exercise, or defense of legal claims.
8.h RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY
In cases where a user suspects that there has been a breach of data protection legislation in the processing of their personal data, they have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, Republic of Slovenia, or by telephone: +386 (0)1 230 97 30, or by email: [email protected].
In the event of a complaint, the controller may request additional information from the user for the purpose of reliable identification when exercising rights related to personal data. The controller may only reject the user's request if they can demonstrate that the individual cannot be reliably identified.
The controller undertakes to respond to the user's request concerning their rights related to personal data without undue delay and no later than one month from the receipt of the user's request.
9. DATA SECURITY
The controller applies various technical, administrative, and organizational security measures, including encrypted databases, SSL certificates, and firewalls, to protect your personal information. Please be aware that despite our efforts, no data security measures can guarantee security.
In case a personal data breach that is likely to result in a risk to the rights and freedoms of a user that is a natural person has occurred, the controller will notify the personal data breach supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it.
10. ADDITIONAL INFORMATION
For any additional information regarding these Terms of Use, users can contact WINERA d.o.o. by regular mail at the address WINERA d.o.o., Dunajska cesta 136, 1000 Ljubljana, or by email at [email protected].
11. PUBLICATION OF CHANGES TO THE PRIVACY POLICY
The Provider of the Winera Platform undertakes that any changes to the privacy policy will be published on this website. By using the winera.com platform, the user confirms that they accept and agree to the entire content of the privacy policy.
September 1st 2024