Privacy policy

Information about how we process our customers' personal data

We are committed to protecting the privacy of all those who use this website and we treat the personal information our customers provide to us as highly confidential.

This information about personal data processing is provided in accordance with Article 13 of EU Regulation 2016/679 (the "GDPR"), by WBX Srl, owner of the www.xtrawine.com domain and of the "xtraWine" trademark, with registered office at Via Campo dei Fiori n.4, Forlì (FC), tax code 04349010407 and VAT no. 04349010407 (hereinafter referred to as "XTRAWINE"), in its capacity as Data Controller, to explain the purposes and procedures whereby XTRAWINE collects and processes your personal data, which categories of data are processed, what rights you have as a data subject and how theses rights can be exercised.

The information provided relates exclusively to this website ("Site"), therefore XTRAWINE does not assume any responsibility for any other websites that may be accessed via hypertext links on the Site.

Using this Site indicates your acceptance of this policy and you are therefore advised to read it before providing any personal information of any kind.

1. Data controller

WBX Srl, Via Campo dei Fiori n.4, 47122 Forlì (FC) is the data controller of personal data collected through the platform.

7Pixel S.r.l., represented by its pro tempore legal representative, is appointed as the Data Processor of the User's data (email address) for the purpose of managing requests for feedback under the Trusted Program on the www.trovaprezzi.it website.

Data Protection Officer (DPO): dpo-xtrawine@oneseal.eu

2. Categories of personal data

XTRAWINE processes your personal data obtained during the formation of the contract and in the course of the contractual relationship ("Data").

For example, the Data Controller will collect the following types of personal data:

  1. Personal data, such as name and surname, place and date of birth, home address;
  2. Contact data, such as shipping address, telephone number and e-mail address;
  3. Bank details (e.g. IBAN), if provided for potential refunds;
  4. Browsing data, such as IP address, time of access to the site and/or login to the platform, any referrer, server access methods, numeric code indicating the response status given by the server (successful, error, etc.);
  5. Data relating to purchases, such as the average purchase value, the type of product purchased, the frequency of purchases, the total amount purchased over time and the total number of orders placed.

The Data Controller shall not acquire data of a sensitive nature through the Site, nor data belonging to the special categories referred to in Article 9 of the GDPR or data relating to criminal convictions or offences.

Your Data will be processed by XTRAWINE exclusively for the purposes and within the limits stated below.

3. Purposes and legal basis of the Processing

XTRAWINE will use your Data for the following purposes:

a) to fulfil the contract

The Data referred to in paragraph 2, nos. 1-4, will be processed by XTRAWINE in order to allow you to register on the Site and to benefit from the services specifically related thereto. For example, your Data will be processed to handle purchase orders, for technical maintenance and support, as well as to improve the quality of the services offered. The Data will therefore be processed for the purpose of fulfilling the contract in place with the Data Controller.

You must provide your data in order for us to create and manage a contractual relationship with you; if you fail to do so, we will not be able to fulfil the contract and provide you with the service requested.

Scalapay SRL
In order to be able to offer you Scalapay SRL payment options, we will pass to Scalapay certain aspects of your personal information, such as contact and order details, in order for Scalapay to assess whether you qualify for their payment options and to tailor the payment options for you. General information on Scalapay can find be found at www.scalapay.com. Your personal data is handled in accordance with applicable data protection law and in accordance with the information in Scalapay’s privacy policy (www.scalapay.com/en/privacy)

b) for marketing purposes

Direct sales. Subject to your specific consent, XTRAWINE may process your Data in order to send you promotional material or marketing communications or for market research purposes. These communications may be sent through the use of automated systems (e.g. e-mail, SMS, push notifications).

For such processing purpose, the Data referred to in paragraph 2, nos. 1 and 2 will be used.

Consent granted may be revoked at any time, this also applies to any automated contact methods, by writing to info@xtrawine.com.

Newsletter. The Data referred to in paragraph 2, no. 2, provided when signing up for the newsletter, will be used by XTRAWINE for the sole purpose of providing the requested newsletter service. The Data will therefore be processed for the provision of the service you have requested from the Data Controller. You may at any time unsubscribe from the newsletter by following the instructions provided from time to time in any communication sent for the purposes referred to in this point.

Soft spam. The Data referred to in paragraph 2, no. 2, obtained during the sale of XTRAWINE's products via the platform, may be used for sending marketing communications relating to products similar to those purchased. Such processing does not require your express consent pursuant to Article 130 of Legislative Decree no. of 30 June 2003. 196. You may, however, object to such processing at any time by following the instructions provided from time to time in any communication sent for the purposes referred to in this point.

c) for profiling purposes

XTRAWINE may process your Data in order to understand your purchasing habits and preferences in relation to the products and services offered via the platform in order to offer you products and services in line with your profile.

For this purpose, XTRAWINE may process the Data referred to in paragraph 2, nos. 1-2 and 5.

Such Data will be processed by XTRAWINE based on its legitimate interest in optimising its purchasing procedures, offering products and services that are more suitable and useful for the specific needs of its customers. The legitimate interests of XTRAWINE have been duly balanced with your interests and expectations in the data protection impact assessment, wherein certain technical and legal measures have been laid out in order to minimise the impact of the profiling carried out by XTRAWINE on your personal privacy.

We would like to remind you that, in accordance with Article 21 of the GDPR, you may object at any time to such processing, on grounds relating to your particular situation, by writing to info@xtrawine.com

d) for disclosure of your data to third parties for marketing purposes

Our customer data is an important part of our company assets and therefore will not be sold to third parties.

4. Data retention period and processing duration

Your Personal Data will primarily be stored on the Aruba SPA servers located within the European Union.

Your Data will be stored for the entire duration of your contractual relationship with XTRAWINE. After the contractual relationship ends, the Data will be kept for a period of 10 years exclusively for the purpose of protecting the rights of the Data Controller and for the fulfilment of legal obligations.

With reference to the processing for marketing purposes referred to in paragraph 2, letter b), please note that the Data will be processed for the entire duration of the contract unless you withdraw your consent or exercise your right to object to its processing.

With regard to data processed for profiling purposes, please note that the Data will be processed for a maximum period of 12 months or for a different period as provided for by law or by order of the Supervisory Authority, unless you exercise your right to object to its processing. After this period or in the event of an objection, the data will be held if necessary to serve other purposes or will be permanently deleted.

5. Legal defence

Your data may be used to defend XTRAWINE in legal proceedings or in the preliminary phases of such proceedings.

6. Credit card data

Your credit card data will not be processed by XTRAWINE as such data is processed and/or stored directly by the banking system. XTRAWINE uses professional payment services provided by Braintree, a company in the PayPal, Inc. group, guaranteeing the customer maximum protection and confidentiality.

7. Cookies

XTRAWINE uses cookie technology to make browsing easier and more intuitive. For further information please see our Cookie Policy.

8. Users rights

In accordance with current legislation, you have the following rights:

  • Notification obligation regarding rectification or erasure of personal data or restriction of processing (Article 19 GDPR)
  • The right to data portability, i.e. to request and obtain personal data concerning you in a structured format (Article 20 GDPR)
  • The right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you (Article 21 GDPR)
  • The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR)
  • The right to receive prompt notification in the event of a personal data breach of the data subject's data (Article 34 GDPR)
  • To request and obtain information about the existence of your data in the possession of XTRAWINE and access to such data;
  • For data processed by automated systems, the right to request a transfer to another data controller;
  • The right to request and obtain the amendment and/or rectification of your personal data if you believe it to be incomplete or inaccurate;
  • The right to request and obtain the deletion of your personal data and/or the restriction of its processing if it is not required - or is no longer required - for the above purposes, i.e. once the retention period referred to in the paragraph above has expired.

Such requests may be sent to the Data Controller by writing to info@xtrawine.com or by sending a registered letter with acknowledgement of receipt to WBX Srl, Via Campo dei Fiori n.4, 47122 Forlì (FC).

We would also like to remind you that, in accordance with current legislation, you may file a complaint regarding the processing of your personal data with the Data Protection Authority.

9. Amendments

XTRAWINE reserves the right to modify or simply update the content of this Privacy Policy, in whole or in part. XTRAWINE will inform you of any such amendments as soon as they are made.

10. Data transfer to non-EU countries

XTRAWINE agrees that user data will not be transferred outside of the European Union (EU).