1. Who we are
ITHUBA S.R.L. (Tax ID RO40772158, Trade Register J12/1064/2019, Cluj-Napoca, Romania) ("we", "us") operates Vinar: the website www.vinar.ro and the Vinar apps for iOS and Android. We are the data controller for the personal data described in this policy.
Vinar is a marketplace. Wine is sold and delivered by independent wineries ("Wineries"). We run the platform, the accounts and the checkout.
Contact for privacy questions: [email protected], +40 752 120 310. We have not appointed a Data Protection Officer.
2. Data we collect
2.1 Data you give us
- Account: name, email address, password, phone number.
- Age confirmation: your confirmation that you are at least 18, and when you gave it.
- Delivery: delivery address and delivery instructions.
- Orders: products, quantities, prices, order status and order history.
- Preferences: favourite wine types, reviews, wish lists.
- Messages you send to customer support.
2.2 Payment data
Payments are processed by Stripe. Your full card number, expiry date and security code go directly from the app to Stripe and are never stored on our servers. From Stripe we receive only a payment reference, the payment status, the card brand and the last four digits of the card.
If you pay with Apple Pay or Google Pay, your card details stay with Apple or Google and are passed to Stripe as a secure token. We never receive them.
2.3 Data collected automatically
- Usage data: screens and pages viewed, products viewed, time spent in the app.
- Device data: device type, operating system and version, app version, browser.
- IP address and approximate location.
- Cookies and similar technologies on the website (section 10).
3. Why we use your data and on what legal basis
Each use of your data rests on one of the legal bases in Article 6(1) of the GDPR.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account | Account data | Contract (Art. 6(1)(b)) |
| Take, pay for and deliver your orders | Account, delivery, order and payment data | Contract (Art. 6(1)(b)) |
| Check that you are at least 18 | Age confirmation | Legal obligation (Art. 6(1)(c)) |
| Keep invoices and accounting records | Order and payment data | Legal obligation (Art. 6(1)(c)) |
| Prevent fraud and keep the platform secure | Payment, device and usage data, IP address | Legitimate interest (Art. 6(1)(f)): protecting you, the Wineries and us from fraud |
| Customer support | Messages, account and order data | Contract (Art. 6(1)(b)) |
| Improve the app and fix errors | Usage and device data | Legitimate interest (Art. 6(1)(f)): running a working, reliable service |
| Personalised wine recommendations | Preferences, order history, usage data | Legitimate interest (Art. 6(1)(f)); you can object at any time |
| Marketing emails and push notifications about offers | Email address, device token | Consent (Art. 6(1)(a)) |
| Analytics cookies on the website | Cookie and usage data | Consent (Art. 6(1)(a)) |
Where we rely on consent, you can withdraw it at any time (section 8). Withdrawing does not affect processing done before.
Giving us your account, delivery and payment data is necessary to place an order. Without it we cannot fulfil the order.
4. Who we share your data with
We do not sell your personal data. We share it only with the recipients below, and only what each needs.
Every third party we share data with is bound by contract or by its own published terms to protect your data at least as well as this policy does and as the GDPR requires.
4.1 Wineries
When you place an order, the Winery you order from receives your name, phone number, delivery address, delivery instructions and order details. The Winery uses this to accept, prepare and deliver your order and to meet its own legal obligations, such as invoicing. It does not receive your card details.
4.2 Stripe (payments)
Payments are processed by Stripe Payments Europe, Limited (Ireland). Stripe receives your payment details, name, email address, order amount and device data needed to process the payment and screen it for fraud. Stripe also uses payment data to detect and prevent fraud across its services.
You pay us through Stripe. We then pass each Winery its share of the order value, less our commission. Wineries do not receive your payment details.
If you save a payment method with Link, you are creating an account with Stripe. Your Link account is governed by Stripe's own privacy policy, and Stripe shares the details needed for the payment with us.
Stripe's privacy policy: stripe.com/privacy
4.3 Apple Pay and Google Pay
If you choose Apple Pay or Google Pay, Apple or Google process your payment under their own privacy policies. We receive only the payment result from Stripe.
4.4 Firebase (Google)
We use Firebase Authentication (sign-in), Cloud Firestore (data storage), Google Analytics for Firebase (usage analytics), Crashlytics (crash reports) and Cloud Messaging (push notifications). Firebase processes email addresses, device identifiers, usage data and preferences on our behalf. More information: firebase.google.com/support/privacy
4.5 Others
- Couriers who deliver your order. They receive your name, phone number and delivery address, and check the recipient's ID at delivery.
- Hosting and email providers who process data on our behalf.
- Public authorities, where the law requires it or to protect our legal rights.
- A buyer or successor, if our business is sold or merged. You will be told before your data becomes subject to a different privacy policy.
5. Transfers outside the EU
Some of our providers, including Stripe and Google, are based in or process data in the United States. When your data leaves the European Economic Area, the transfer is protected by one of these safeguards:
- the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified under it; or
- Standard Contractual Clauses approved by the European Commission.
You can ask us for a copy of the safeguards that apply, using the contact details in section 12.
6. How long we keep your data
| Data | How long |
|---|---|
| Account, preferences, age confirmation | While your account is active; deleted within 30 days of account deletion |
| Orders, invoices and payment records | 10 years, as required by Romanian tax and accounting law, even after account deletion |
| Support messages | Up to 2 years after the conversation closes |
| Usage and analytics data | Up to 14 months |
| Marketing consent records | While consent is active, plus the period needed to prove it was given |
Stripe keeps its own payment records under its own legal obligations, as described in Stripe's privacy policy.
7. Security
We protect your data with encryption in transit (TLS), access limited to staff who need it, and hosting with providers that meet recognised security standards. Card data is handled only by Stripe, which is certified to the PCI DSS standard for card payments.
No system is completely secure. If a breach puts your rights at risk, we will notify the authority and, where required, you.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing based on legitimate interest, including personalised recommendations;
- withdraw your consent at any time, for marketing or analytics cookies;
- lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro).
How to use your rights
- Delete your account in the app from your Profile screen. This deletes your account data; order and invoice records are kept as described in section 6.
- Stop marketing: use the unsubscribe link in any email, or turn off notifications in the app or in your phone's settings.
- Anything else: email [email protected]. We reply within one month and may ask you to confirm your identity.
For data held by Stripe in your Link account, contact Stripe directly through its privacy centre.
9. Age requirement and minors
Vinar sells alcohol and is only for people aged 18 or over.
- When you create an account, you must confirm that you are at least 18. We store that confirmation and the date you gave it. You cannot place an order without an account.
- At delivery, the courier checks the recipient's age with a valid ID document and refuses delivery if the recipient cannot prove they are at least 18.
- We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, email [email protected] and we will delete it.
- Our marketing is not aimed at people under 18 and follows the rules on advertising alcoholic beverages.
10. Cookies and analytics
The website uses essential cookies, which it needs to work, and analytics cookies, which we set only with your consent. You can change your choice at any time from the cookie panel on the website or in your browser settings.
The apps use Firebase Analytics to understand how the apps are used. We do not use your data to track you across other companies' apps or websites, and we do not show third-party advertising in the apps.
11. Changes to this policy
We may update this policy. We will tell you about significant changes by email or in the app before they take effect. The date at the top shows the latest version.
12. Contact
ITHUBA S.R.L.
Tax ID: RO40772158
Trade Register: J12/1064/2019
Address: Cluj-Napoca, Romania
Email: [email protected]
Phone: +40 752 120 310