Privacy Policy UK

• first name, surname;
• telephone number;
• e-mail address;
• address for dispatch;
• payment methods and details;
• billing address;
• billing data.

• the processing is necessary to perform a contract between the data subject and the Controller.

• The registration data will be kept until the account is deleted by the person to whom it relates.
• Data relating to purchases made will be kept for a maximum of 10 years from the date of purchase. This storage period may be extended where necessary to comply with a legal obligation to which xtraWine UK Ltd is subject, or to protect a right before a competent authority.

Through the Site it is possible to purchase Vouchers entitling the holder to enjoy wine tourism experiences (e.g. tastings, winery visits) organised and provided by partner wineries (“Partner Wineries”). The data collected pursuant to this paragraph will be processed in order to manage the order, issue and send the Voucher with its unique code and the booking instructions, handle any exercise of the right of withdrawal and prevent fraud.

For the issue and management of the Voucher, xtraWine UK Ltd communicates to the Partner Winery only the order number, the order date and the Voucher code, without any data allowing the purchaser to be directly identified. The Partner Winery only informs xtraWine UK Ltd that the Voucher has been used. The Partner Wineries may be established in Italy or in other countries of the European Economic Area, which are covered by UK adequacy regulations under section 17A of the Data Protection Act 2018.

Booking and enjoyment of the experience take place directly with the Partner Winery, which processes any personal data collected at that stage (e.g. participants’ data, any food allergies or intolerances) as an independent data controller, providing its own privacy notice. xtraWine UK Ltd does not receive such data.

The Voucher may be transferred to third parties outside the Site: xtraWine UK Ltd does not collect the beneficiary’s data. The page of the Site that allows the instructions to be viewed by entering the Voucher code does not require any personal data to be entered.

• first name, surname;
• e-mail address;
• telephone number;
• billing address and billing data;
• payment methods and details;
• order number and date, Voucher code and its usage status;
• declaration of legal age.

• the processing is necessary to perform a contract between the data subject and the Controller (Article 6(1)(b) UK GDPR), for the management of the order and the issue of the Voucher;
• the processing is necessary to comply with a legal obligation to which the Controller is subject (Article 6(1)(c) UK GDPR), e.g. tax and accounting obligations under UK law;
• the legitimate interests of the Controller (Article 6(1)(f) UK GDPR) in preventing fraud and protecting its legal rights.

• Data relating to Voucher purchases will be kept for a maximum of 10 years from the date of purchase. This storage period may be extended where necessary to comply with a legal obligation to which xtraWine UK Ltd is subject, or to protect a right before a competent authority.

• Personal data provided voluntarily;
• first name, surname;
• contact details;
• telephone number;
• e-mail address;
• address.

• The data subject has given consent to the processing of his or her personal data for one or more specific purposes.

In particular, the fact that the data subject decides to contact us by submitting a request will be considered an unequivocal positive action equivalent to written consent.

• the legitimate interest of the Controller, in the case of communications to customers regarding products or services similar to those already purchased, in accordance with the soft opt-in exemption under Regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 (PECR), provided a simple means of opting out is offered with each communication; or
• the consent of the data subject (Article 6(1)(a) UK GDPR), expressed by means of a dedicated checkbox at the time of sign-up.

• The data is retained until consent is withdrawn, which can be exercised through the opt-out option provided at the bottom of each communication sent.
• In the event of continuous inactivity for 90 days (no opening of, or interaction with, communications), the data subject is automatically excluded from further mailings, without prejudice to the possibility of reactivation in the event of a new purchase or new consent.

• personal identification data;
• purchase frequency and behaviour;
• product preferences;
• data relating to the Newsletter sign-up.

• personalisation of Newsletter content;
• internal commercial analysis;
• customer care assistance.

• Specific consent of the data subject (Article 6(1)(a) UK GDPR), expressed by means of a dedicated checkbox at the time of sign-up.

• The data is retained until consent is withdrawn, which can be exercised through the opt-out option provided at the bottom of each communication sent.
• In the event of continuous inactivity for 90 days (no opening of, or interaction with, communications), the data subject is automatically excluded from further mailings, without prejudice to the possibility of reactivation in the event of a new purchase or new consent.

Where data subjects use the “Sommelier & Help” chatbot – a tool based on Artificial Intelligence – the personal data provided in the chat may be processed in order to:

• verify the status of an order, where the user spontaneously provides their e-mail address and order number in the chat;
• put the user in contact with a customer care operator, upon explicit request or when necessary;
• answer frequently asked questions (FAQs) relating to the website and the services offered;
• provide wine-related suggestions and food-pairing advice;
• share general information about the products and services offered by the Controller.

The chatbot replies automatically, without human intervention; a customer care operator monitors the conversations and intervenes, in particular when the user explicitly requests human support.

Where an operator is not available, the request is forwarded to the general mailbox info@xtrawine.com.

• identification data voluntarily provided by the user (e.g. name, e-mail address, order number)
• free-text content typed in the chat window, which may contain personal data or references to orders
• contact details (e.g. e-mail)
• order-related data
• information relating to wine preferences
• essential technical data (e.g. date and time of the interaction, referring URL)

• performance of a contract, where the request is functional to the management of an order;
• implicit consent, where the user interacts with the chatbot to obtain general information or voluntary support.

• Chats are retained for a period of 3 years, for the purpose of responding to user requests.
• Technical logs relating to the operation of the system (e.g. times, interactions, errors) may be retained for a period of 4 weeks, for security, auditing and monitoring purposes.

The computer systems and software procedures used to operate this site acquire, in the course of their normal operation, some personal data whose transmission is implied by the use of Internet communication protocols.

These data, necessary for the use of web services, are also processed for the purpose of:

• obtaining statistical information on the use of services (most visited pages, number of visitors per time or day, geographical areas of origin, etc.);
• checking the proper functioning of the services offered.

• IP addresses or domain names of the computers and terminals used by users;
• the addresses in URI/URL (Uniform Resource Identifier/Locator) notation of the resources requested;
• the time of the request;
• the method used to submit the request to the server;
• the size of the file obtained in response;
• the numerical code indicating the status of the response given by the server (successful, error, etc.);
• other parameters relating to the user’s operating system and computer environment.

• the processing is necessary to fulfil a legal obligation to which the Controller is subject;
• the processing is necessary to pursue the legitimate interest of the Controller in ensuring the security and usability of the website.