Privacy Policy — Moravexi Vineyard

1. Introduction

This Privacy Policy explains how Moravexi Vineyard Limited ("Moravexi", "we", "us", or "our") collects, processes, stores, and protects your personal data when you visit our website at www.moravexi.com, interact with our services, visit our vineyard estate, or communicate with us through any channel. We are committed to respecting your privacy and handling your personal information responsibly and transparently.

Moravexi Vineyard Limited is the data controller for the purposes of the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. Our registered business address is Ballyneale, Carrick-on-Suir, Co. Waterford, E32 KD72, Ireland. If you have any questions about this policy or our data practices, you may contact our data protection officer at [email protected] or by writing to us at the address above.

By using our website or providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy. We encourage you to review it periodically, as we may update it from time to time to reflect changes in our practices or applicable legislation.

2. What Data We Collect

We collect several categories of personal data depending on how you interact with our business. The types of data we may collect include:

Identity data: first name, last name, and title when you fill in our contact form, book a tasting experience, or subscribe to our mailing list.
Contact data: email address, telephone number, and postal address provided through forms on our website or during in-person visits to our vineyard.
Technical data: Internet Protocol (IP) address, browser type and version, operating system and platform, device identifiers, time zone setting, screen resolution, and other technology identifiers on the devices you use to access our website.
Usage data: information about how you use our website, including pages visited, time spent on each page, navigation paths, click patterns, referral source, and exit pages.
Cookie data: information collected through essential, analytics, and marketing cookies placed on your device when you visit our website. See Section 10 for full details on cookies.
Communication data: any information you include in messages sent to us via our contact form, email, telephone, or social media channels.
Booking data: details related to tasting event bookings, including date preferences, group size, dietary requirements, and payment references (we do not store full payment card details on our servers).
Marketing preferences: your preferences regarding receiving marketing communications from us, including newsletter subscription status and communication channel preferences.

3. How We Collect Data

We collect your personal data through the following methods:

Direct interactions: You provide data directly to us when you fill in our contact form, subscribe to our newsletter, book a tasting experience, send us an email, call us by phone, or visit our vineyard and provide your details in person.
Automated technologies: As you navigate our website, we automatically collect technical data and usage data through cookies, server logs, and similar tracking technologies. Our website uses Google Analytics to understand how visitors interact with our pages. If you have consented to marketing cookies, we may also use the Meta Pixel (Facebook Pixel) to measure the effectiveness of our advertising campaigns.
Third-party sources: We may receive personal data about you from third-party analytics providers such as Google, advertising networks, and social media platforms where you have interacted with our content or advertisements.
Server logs: Our hosting provider automatically records certain information in server logs each time you access our website, including your IP address, date and time of access, pages requested, and referring URL.

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data only when we have a valid legal basis to do so. The legal bases we rely on are:

Consent (Article 6(1)(a)): Where you have given clear consent for us to process your personal data for a specific purpose. This applies to newsletter subscriptions, marketing communications, and the placement of non-essential cookies. You may withdraw your consent at any time by contacting us or using the unsubscribe link provided in our emails.
Contract performance (Article 6(1)(b)): Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract. This applies when you book a tasting event or place an order for our wines.
Legitimate interests (Article 6(1)(f)): Where processing is necessary for our legitimate business interests, provided those interests do not override your fundamental rights and freedoms. This applies to website analytics (understanding how visitors use our site so we can improve it), responding to enquiries submitted through our contact form, and maintaining the security and performance of our website.
Legal obligation (Article 6(1)(c)): Where processing is necessary for compliance with a legal obligation to which we are subject, such as tax record-keeping requirements or responding to lawful requests from regulatory authorities.

5. How We Use Your Data

We use the personal data we collect for the following purposes:

Service delivery: To process and manage your tasting event bookings, fulfil wine orders, and provide the services you have requested from us.
Communication: To respond to your enquiries and messages submitted through our contact form, email, or telephone. We aim to respond within 24 hours on business days.
Marketing: To send you our newsletter, updates about new wine releases, seasonal events, and special offers, but only where you have provided your explicit consent to receive such communications. Every marketing email includes a clear unsubscribe link.
Website analytics: To analyse how visitors use our website, identify areas for improvement, understand traffic patterns, and optimise the user experience. This processing is based on our legitimate interest in maintaining and improving our online presence.
Advertising measurement: Where you have consented to marketing cookies, to measure the effectiveness of our advertising campaigns on platforms such as Meta (Facebook and Instagram) and to build audiences for future campaigns.
Legal compliance: To comply with applicable laws, regulations, and legal processes, including tax obligations, consumer protection requirements, and responses to lawful requests from public authorities.
Security: To protect our website, systems, and users from fraud, malicious activity, and security threats.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our specific retention periods are:

Contact form submissions: Retained for 2 years from the date of your last communication with us, after which they are securely deleted.
Newsletter subscriber data: Retained for as long as you remain subscribed. If you unsubscribe, your email address is removed from our active mailing list within 30 days. A hashed record may be retained for a further 12 months to ensure we do not inadvertently re-subscribe you.
Tasting event booking data: Retained for 3 years from the date of the event for operational and financial record-keeping purposes.
Wine order data: Retained for 6 years to comply with Irish Revenue requirements for financial records.
Website analytics data: Google Analytics data is retained for 14 months. IP addresses collected in server logs are retained for 90 days.
Cookie data: Essential cookies expire at the end of your browsing session or after 12 months. Analytics cookies are retained for up to 13 months. Marketing cookies are retained for up to 13 months. See Section 10 for full details.

When data reaches the end of its retention period, it is securely deleted or anonymised so that it can no longer be linked to you.

7. Data Sharing

We do not sell, rent, or trade your personal data to any third party. We may share your data with the following categories of recipients, strictly for the purposes described in this policy:

Hosting provider: Our website is hosted on secure servers within the European Economic Area (EEA). Our hosting provider processes technical data and server logs on our behalf under a data processing agreement.
Analytics providers: We use Google Analytics (operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyse website usage. Google processes usage data and technical data on our behalf. Google's privacy policy is available at policies.google.com/privacy.
Email marketing provider: We use a third-party email service provider to manage our newsletter mailing list and send marketing communications. This provider processes your name and email address on our behalf under a data processing agreement and does not use your data for their own marketing purposes.
Payment processors: When you make a payment for a tasting event or wine order, your payment is processed by a PCI-DSS compliant third-party payment processor. We do not have access to or store your full payment card details.
Advertising platforms: If you have consented to marketing cookies, limited data (such as hashed identifiers and browsing behaviour) may be shared with Meta Platforms Ireland Limited for advertising measurement purposes.
Legal and regulatory bodies: We may disclose your data if required to do so by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Moravexi, our users, or the public.

All third-party processors are bound by contractual obligations to process personal data only on our instructions and in compliance with applicable data protection law.

8. International Data Transfers

We primarily store and process your personal data within the European Economic Area (EEA). However, some of our third-party service providers may transfer data to countries outside the EEA, including the United States. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data, including:

Transfers to countries that have received an adequacy decision from the European Commission (confirming that the country provides an adequate level of data protection).
Standard Contractual Clauses (SCCs) approved by the European Commission, which contractually oblige the recipient to protect your data to EEA standards.
Certification under the EU-US Data Privacy Framework, where applicable.

You may request a copy of the specific safeguards applied to your data by contacting us at [email protected].

9. Your Rights Under GDPR

Under the General Data Protection Regulation and the Irish Data Protection Act 2018, you have the following rights regarding your personal data:

Right of access (Article 15): You have the right to request a copy of the personal data we hold about you, along with information about how we process it.
Right to rectification (Article 16): You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
Right to erasure (Article 17): You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected, or when you withdraw your consent.
Right to restriction of processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.
Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller where technically feasible.
Right to object (Article 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop processing your data for that purpose immediately.
Right to withdraw consent (Article 7): Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at [email protected] or write to: Data Protection Officer, Moravexi Vineyard Limited, Ballyneale, Carrick-on-Suir, Co. Waterford, E32 KD72, Ireland. We will respond to your request within 30 days. We may ask you to verify your identity before fulfilling your request.

If you are not satisfied with our response or believe that we are processing your personal data unlawfully, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC). The DPC can be contacted at:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Website: www.dataprotection.ie
Phone: +353 1 765 0100

10. Cookies

Our website uses cookies and similar tracking technologies to distinguish you from other users, provide a smooth browsing experience, and help us understand how our website is being used. A cookie is a small text file placed on your device by a website you visit.

Types of Cookies We Use

Essential cookies: These cookies are strictly necessary for the operation of our website. They enable core functionality such as remembering your cookie consent preference and maintaining session security. Without these cookies, the website cannot function properly. These cookies do not require your consent. Duration: session or up to 12 months.
Analytics cookies: These cookies help us understand how visitors interact with our website by collecting anonymous, aggregated information about page views, traffic sources, time on page, and navigation paths. We use Google Analytics for this purpose. These cookies are placed only if you give your consent through our cookie banner. Duration: up to 13 months.
Marketing cookies: These cookies are used to track visitors across our website and, if you have consented, to display relevant advertisements on other platforms. We use the Meta Pixel for advertising measurement on Facebook and Instagram. These cookies are placed only if you give your consent through our cookie banner. Duration: up to 13 months.

Managing Cookies

When you first visit our website, a cookie consent banner is displayed in the bottom-right corner of your screen. You may choose to accept or reject non-essential cookies. Your preference is stored locally on your device and remembered for future visits. You can change your cookie preferences at any time by clearing your browser's cookies and revisiting our website, at which point the consent banner will appear again.

You can also control cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be alerted when a cookie is being set. Please note that disabling essential cookies may affect the functionality of our website. For more information on managing cookies in your browser, visit www.allaboutcookies.org.

11. Children's Privacy

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16 years of age. Additionally, as our business involves the production and sale of alcoholic beverages, our website is intended for users who are at least 18 years old. If we become aware that we have inadvertently collected personal data from a child under 16, we will take prompt steps to delete that data from our systems. If you believe that we may have collected data from a child, please contact us at [email protected].

12. Third-Party Links

Our website may contain links to third-party websites, social media platforms, and external services that are not operated by Moravexi. We are not responsible for the privacy practices, content, or data collection policies of these third-party sites. We encourage you to read the privacy policy of every website you visit. A link to an external website does not imply our endorsement of that website or its privacy practices.

13. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. These measures include encryption of data in transit using TLS/SSL, access controls limiting data access to authorised personnel only, regular security assessments of our systems, and secure storage of all personal data with our hosting provider within the EEA. While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes that affect how we process your data, we will take reasonable steps to notify you, such as posting a prominent notice on our website or sending you a direct notification if we have your contact details. We encourage you to review this policy periodically.

15. Contact Details

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the following details:

Data Controller: Moravexi Vineyard Limited
Address: Ballyneale, Carrick-on-Suir, Co. Waterford, E32 KD72, Ireland
Privacy email: [email protected]
General email: [email protected]
Phone: +353 51 645 082

We aim to respond to all privacy-related enquiries within 30 days of receipt.