1. Introduction
Protecting your personal data is a priority for Not Only Wine. This privacy policy (the “Policy”) transparently describes how we collect, use, share and protect your personal data when you visit our online shop at www.notonlywine.lu (the “Site”), create a customer account, place an order or communicate with us.
Our processing operations are carried out in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (the “GDPR”) and with the Luxembourg Law of 1 August 2018 on the organisation of the National Commission for Data Protection and the implementation of the GDPR.
2. Controller
The controller of your personal data is:
Not Only Wine S.à r.l., a private limited liability company governed by Luxembourg law
Registered office: 24, Rue Jacques Santer, L-6139 Junglinster, Grand Duchy of Luxembourg
RCS Luxembourg: B 221858 – VAT: LU 30029408
Data protection contact: info@notonlywine.lu – Tel.: (+352) 691 262 210
The company is not required to appoint a data protection officer (DPO) within the meaning of Article 37 GDPR. Any question relating to personal data may be addressed to the contact point above.
3. Personal data we process
We collect only data that is adequate, relevant and limited to what is necessary in relation to the purposes pursued (data minimisation principle). Depending on how you use the Site, this covers the following categories:
Identification and contact data: surname, first name, postal address, e-mail address, telephone number;
Order and invoicing data: products ordered, amounts, purchase history, invoices;
Payment data: processed directly by our secure payment service providers; we never store full bank card numbers;
Delivery data: delivery address, delivery instructions, tracking information;
Declaration of majority: confirmation that you are at least 18 years old and, where applicable, verification of an identity document on handover of alcoholic beverages;
Customer account data: login credentials, password (stored in encrypted/hashed form), preferences;
Browsing data: IP address, device and browser type, pages viewed, connection logs, cookies and similar technologies (see our Cookie Policy);
Communications: the content of your exchanges with our customer service (e-mails, forms);
Marketing data: newsletter subscription, preferences and consent history.
We do not collect any “special category” data (Article 9 GDPR). We ask you not to disclose such data in the free-text fields of our forms.
4. Purposes, legal bases and retention periods
The table below sets out the purposes of our processing operations, their legal basis within the meaning of Article 6 GDPR and the applicable retention periods:
| Purpose | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|
| Management of orders, payments and deliveries | Performance of the contract (Art. 6(1)(b)) | Duration of the contractual relationship, then archiving for the statutory limitation periods |
| Accounting, invoicing and tax obligations | Legal obligation (Art. 6(1)(c)) | 10 years (Art. 16 of the Luxembourg Commercial Code) |
| Compliance with alcohol sales legislation (age verification) | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) | Duration of order processing and evidence of the check |
| Creation and management of the customer account | Performance of the contract (Art. 6(1)(b)) | Until the account is deleted or 3 years after the last activity |
| Customer service, complaints and legal warranties | Performance of the contract / legitimate interest | 3 years after closure of the request; duration of the legal warranties where applicable |
| Fraud prevention and security of the Site | Legitimate interest (Art. 6(1)(f)) | Technical logs: 12 months |
| Newsletter and commercial prospecting | Consent (Art. 6(1)(a)); for existing customers and similar products: legitimate interest with a right to object | Until consent is withdrawn or 3 years after the last contact |
| Cookies and audience measurement | Consent (except strictly necessary cookies) | See the Cookie Policy |
| Management of disputes and defence of the company’s rights | Legitimate interest (Art. 6(1)(f)) | Duration of the applicable statutory limitation periods |
On expiry of the periods indicated, the data is deleted or irreversibly anonymised. Certain data may be kept for longer in intermediate archiving, with restricted access, where a legal obligation or litigation justifies this.
5. Mandatory or optional nature of the data
Data marked as mandatory in the forms on the Site (in particular when ordering) is necessary for the conclusion and performance of the contract or for compliance with our legal obligations. Without it, we would be unable to process your order. The remaining data is optional.
6. Recipients of your data
Your data is accessible, within the limits of their respective remits and on a need-to-know basis, to authorised staff of Not Only Wine as well as to the following categories of recipients:
Hosting and infrastructure provider for the Site: the Site and the online shop data are hosted on infrastructure located within the European Economic Area, operated by a processor bound by a contract compliant with Article 28 GDPR. The identity of this provider will be disclosed to you on simple request sent to info@notonlywine.lu;
Payment service providers: Stripe Payments Europe, Limited (One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland), for the secure processing of card transactions and fraud prevention;
Carriers and logistics providers: POST Luxembourg or equivalent carriers, for the delivery of orders;
E-mailing and marketing providers: Mailchimp (The Rocket Science Group LLC, Intuit group, United States), for sending the newsletter, subject to your consent;
IT and security providers operating on our systems;
Professional advisers (accountant, lawyers, auditors), bound by professional secrecy;
Public and judicial authorities, where we are required to do so by law.
Our processors are bound by contracts compliant with Article 28 GDPR and may process your data only on our documented instructions. We never sell or rent your personal data to third parties.
7. Transfers of data outside the European Union
Your data is stored within the European Union / the European Economic Area: the Site and the online shop are hosted on infrastructure located in the EEA, in a region selected by us and from which data is not transferred to another region. Some of our providers are nevertheless established outside the EEA, or belong to a group with companies established there, and may on that basis access data from a third country, in particular the United States, in the context of administration, technical support or security functions. This applies to our hosting provider, to Mailchimp (sending of the newsletter) and, where applicable, to companies within the group of our payment service provider.
These transfers are governed by appropriate safeguards within the meaning of Chapter V GDPR: certification of the US providers concerned under the EU–U.S. Data Privacy Framework and/or standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures identified following a transfer impact assessment. You may obtain information about these safeguards, and where applicable a copy, by writing to info@notonlywine.lu.
8. Data security
We implement appropriate technical and organisational measures to protect your data against unauthorised destruction, loss, alteration, disclosure or access: encryption of communications (TLS/HTTPS), use of PCI-DSS certified payment providers, access control and restriction, passwords stored in hashed form, backups and logging. In the event of a data breach likely to result in a risk to your rights and freedoms, we will make the notifications required by Articles 33 and 34 GDPR.
9. Your rights
In accordance with Articles 15 to 22 GDPR, you have the following rights over your personal data:
Right of access: obtain confirmation that your data is being processed and receive a copy of it;
Right to rectification: have inaccurate or incomplete data corrected;
Right to erasure: obtain the deletion of your data in the cases provided for by law;
Right to restriction of processing in the cases set out in Article 18 GDPR;
Right to portability: receive the data you have provided to us in a structured, commonly used and machine-readable format;
Right to object: object, on grounds relating to your particular situation, to processing based on our legitimate interest, and object at any time, without giving reasons, to processing for direct marketing purposes;
Right to withdraw your consent at any time, without affecting the lawfulness of prior processing (for example via the unsubscribe link in each newsletter).
To exercise your rights, write to us at info@notonlywine.lu or by post at the company’s registered office. Where there is reasonable doubt as to your identity, proof of identity may be requested. We will reply within one (1) month, extendable by two (2) months where the request is complex or where a high number of requests is received, in which case you will be informed.
10. Complaint to the supervisory authority
If you consider that the processing of your data does not comply with the applicable rules, you may lodge a complaint with the Luxembourg supervisory authority:
National Commission for Data Protection (CNPD) – 15, Boulevard du Jazz, L-4370 Belvaux, Grand Duchy of Luxembourg – www.cnpd.lu
You may also refer the matter to the supervisory authority of the Member State of your habitual residence or place of work.
11. Automated decisions and profiling
We do not take any decision based solely on automated processing producing legal effects concerning you or significantly affecting you. The fraud prevention system of our payment service provider may rely on automated analyses; any block may be reviewed with human intervention on request addressed to our customer service.
12. Minors
The Site is intended exclusively for persons of full age. We do not knowingly collect personal data from minors. If you believe that a minor has provided us with data, please contact us at info@notonlywine.lu so that we may delete it.
13. Cookies
The use of cookies and similar technologies on the Site (purposes, durations, consent management) is described in our Cookie Policy, which is available at all times on the Site and forms an integral part of this Policy.
14. Amendments to this Policy
We may amend this Policy at any time, in particular to take account of legal or technical developments or of changes to our processing operations. The version in force, bearing a date, is published on the Site. In the event of a substantial amendment, we will inform you by any appropriate means (for example by e-mail or by a notice on the Site).
15. Contact
For any question relating to this Policy or to the processing of your personal data: Not Only Wine S.à r.l., 24, Rue Jacques Santer, L-6139 Junglinster, Grand Duchy of Luxembourg – info@notonlywine.lu – Tel.: (+352) 691 262 210.