The Data Controller is:

The Data Controller is also the Data Processor in the person of Gabriele Seresina. For any requests, you can contact him at the above addresses.

2.1 Identification and personal data

• First and last name of the legal representative and company contacts.
• Company name, legal form, VAT number, and tax code.
• Address of the registered office and place of business.
• Identification data provided during registration via Typeform.

2.2 Contact details

• Email address (personal and/or business), landline and/or mobile phone number, certified email address.

2.3 Financial and transaction data

• Bank details (IBAN) for payments by bank transfer.
• Data relating to transactions made via Stripe (including Stripe Connect), PayPal, and Revolut. Credit/debit card data is managed exclusively by payment gateways and is never stored on the Data Controller's servers.
• Wine Wallet balance, transaction history, wine portfolio, and financial transactions recorded on the Platform.

2.4 Navigation and technical data

• IP address (not anonymized), browser type and version, operating system, and device type.
• Pages visited, session duration, navigation paths.
• Recordings of user sessions via Hotjar.
• Data on interaction with the Platform (clicks, scrolls, mouse movements).

2.5 Profiling data

• Wine preferences (regions, producers, price ranges).
• Purchasing and trading behavior on the Platform.
• Interests and browsing patterns to personalize the experience and offer recommendations.

2.6 Data collected through video calls

The Data Controller uses Zoom, Microsoft Teams, and Google Meet to communicate with Customers. Video calls may be recorded with explicit consent given verbally at the beginning of the call.

3.1 Performance of the contract — Art. 6(1)(b) GDPR

• Manage the Customer's registration and account on the Platform.
• Provide the Services covered by the Subscription, including access to the Liv-Ex marketplace.
• Manage the Wine Wallet and trading operations.
• Process payments via Stripe, PayPal, and Revolut.
• Provide customer assistance and support, manage electronic invoicing and operational communications.

3.2 Compliance with legal obligations — Art. 6(1)(c) GDPR

• Tax and accounting obligations (document retention for 10 years pursuant to Article 2220 of the Italian Civil Code).
• Anti-money laundering obligations (Legislative Decree 231/2007).
• Obligations arising from requests from judicial or administrative authorities.
• Obligations regarding electronic commerce (Legislative Decree 70/2003).

3.3 Legitimate interest — Art. 6(1)(f) GDPR

• Analysis and improvement of the Platform using Google Analytics, PostHog, and Hotjar.
• Fraud prevention and platform security.
• Aggregated and anonymized statistical analyses on the use of the Services.
• SEO analysis using SE Ranking, SEO Zoom, SEMRush, Ahrefs (these tools do not collect users' personal data).

3.4 Consent — Art. 6(1)(a) GDPR

• Automated profiling for personalized wine recommendations and market opportunities.
• Sending newsletters and marketing communications via Mailchimp, HubSpot, and MailUp.
• Installation of third-party profiling and marketing cookies (see Section 8).
• Recording video calls via Zoom, Microsoft Teams, and Google Meet.
• Retargeting and creation of custom audiences via Meta Pixel, LinkedIn Insight Tag, TikTok Pixel.

Consent may be revoked at any time by writing to privacy@finewinetrading.com.

The Data Controller uses third-party suppliers who act as Data Processors pursuant to Art. 28 GDPR, with whom specific Data Processing Agreements (DPAs) have been entered into.

4.1 Payments and financial services

4.2 Analytics and optimization

4.3 Marketing and advertising

4.4 Email marketing and CRM

4.5 Hosting and infrastructure

4.6 Forms, communications, and automation

4.7 SEO and market analysis (internal tools)

The following tools are used exclusively by the Data Controller for internal SEO analysis and do not collect personal data from users of the Platform: SE Ranking, SEO Zoom, SEMRush, Ahrefs.

Several suppliers referred to in Section 4 process data outside the European Economic Area (EEA). Transfers are made on the basis of the following safeguards:

5.1 EU-U.S. Data Privacy Framework (DPF)

For US suppliers certified under the DPF (EC Adequacy Decision of July 10, 2023): Google, Meta, Stripe, Microsoft (LinkedIn, Teams), HubSpot, Mailchimp/Intuit, Zoom, Zapier.

5.2 Standard Contractual Clauses (SCC)

Standard Contractual Clauses (EU Decision 2021/914) have been stipulated for all non-EU suppliers, supplemented by additional technical measures (encryption in transit and at rest, pseudonymization, periodic audits).

5.3 United Kingdom

Transfers covered by the EC Adequacy Decision of June 28, 2021, and the UK International Data Transfer Agreement (IDTA).

5.4 Server location

Primary servers in Italy (Sicily) via VHosting Solution S.r.l. and in the Netherlands via AWS (Region eu-west-1 / eu-central-1). Backups remain within the European Union.

Upon expiration, the data will be securely deleted or irreversibly anonymized.

The Platform uses automated profiling systems for personalized recommendations based on purchase and trading history, expressed preferences, and browsing behavior. Profiling is carried out exclusively with prior consent (Art. 6(1)(a) GDPR) and can be revoked at any time without prejudice to the basic Services.

The Data Controller does not make automated decisions with significant legal effects pursuant to Art. 22 GDPR. All relevant decisions are subject to human supervision.

8.1 Technical cookies (necessary)

Essential for the Platform to function, these cookies do not require consent. They include session cookies for authentication, security, Wine Wallet functionality, and user preferences.

8.2 Analytical cookies

Subject to consent via banner: Google Analytics GA4 (non-anonymized IP), PostHog (product analytics, funnel), Hotjar (heatmap, session recordings).

8.3 Profiling and marketing cookies

Subject to explicit consent (Privacy Authority Guidelines, June 10, 2021, Provision No. 229): Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, Google Tag Manager.

8.4 Managing preferences

When you first access the site, you can accept all cookies, reject unnecessary ones, or customize them by category. You can change your preferences at any time via the "Cookie Preferences" link in the footer.

Pursuant to Articles 15–22 of the GDPR:

To exercise your rights: privacy@finewinetrading.com · villasostaga.gseresina@pec.it. The Data Controller will respond within 30 days (extendable to 60 days in complex cases).

The Data Controller shall take the following measures pursuant to Article 32 of the GDPR:

• SSL/TLS encryption for all communications between browsers and servers.
• Payment management via PCI-DSS certified gateways (Stripe, PayPal), without storing card data on the Data Controller's servers.
• Regular backups on AWS infrastructure with encryption at rest.
• Role-based access control and secure authentication.
• Continuous monitoring of infrastructure to detect threats and anomalies.
• Regular training of personnel on data protection.

In the event of a personal data breach, the Data Controller will notify the Privacy Guarantor within 72 hours of discovery (Articles 33–34 GDPR) and, where necessary, will notify the Data Subjects.

The Data Controller reserves the right to modify or update this Policy at any time. Changes will be published on the Platform with an indication of the date of the last update. Substantial changes will be communicated via email. The Data Subject is invited to consult this page periodically.

For any questions, requests, or complaints regarding the processing of personal data:

Email Privacy

privacy@finewinestrading.com

certified email

villasostaga.gseresina@pec.it

Registered Office

Via Mincio 20/1, 20139 Milan (MI)

Operational Headquarters

Via Sostaga 19, 25084 Gargnano (BS)