VINHOOD PRIVACY POLICY

TASTE S.r.l., is an Italian company, with registered office in Milan, Piazza della Repubblica 32, (hereinafter “VINHOOD”), owner of the website www.vinhood.com, of mobile applications, or other solutions that you may find on the VINHOOD website or at third parties. This privacy policy refers to the processing of your data when you use the VINHOOD website or app (hereinafter “VINHOOD Platform“).

DATA CONTROLLER

VINHOOD is the controller of personal data (“Controller“) in the person of its legal representative pro tempore with registered office in Milan, Piazza della Repubblica 32.

In carrying out its activity, VINHOOD, in its capacity as “Data Controller”, processes personal data in compliance with the legal provisions in force (Art. 13 of EU Regulation 2016/679, hereinafter referred to as the “GDPR“) and the applicable privacy legislation, in a manner based on the principles of lawfulness, fairness and transparency, protecting your confidentiality and your rights, according to the criteria set out in this document.

WHICH DATA WE PROCESS 

Personal and contact details to create your taste profile, become part of the VINHOOD world and take advantage of our tools and services: At the end of a test, we send you, if you request it in the appropriate section of the Platform, the result by email. This is the beginning of the creation of your taste profile. The data you provide us with to create the profile are: first name, last name, gender, date of birth and e-mail. You may also create your profile using social networks. Depending on the permissions granted to the social network you use, we may have access to personal data in addition to that required for registration on the VINHOOD platform.

  • Data relating to your preferences (e.g. which foods you like to combine with a certain type of product; which fruits or vegetables you prefer, etc.): 
  • when you perform a test on our Platform (taste, expert, or combination with other products), and get a #character matching your taste profile, we collect your answers.
  • In order to get to know more about your taste profile, we will occasionally ask you for some additional information as part of our initiatives. For example, we may ask you if you are a beginner or an expert on a specific product, comments and feedback on our tests, products and events, and if you are interested in other products. We need this information so that we can provide you with an even better experience and keep you entertained. 
  • Personal and contact data in the “Contact Us” section: in order to be able to respond to a contact request you make via the Platform through the “Contact Us” section, we collect and process the following data provided by you: first name, last name, e-mail, and any data and information you have provided in the “message” section.
  • Personal and contact data, for the purpose of sending promotional communications relating to our Services: When you subscribe to our newsletter service, or give your specific consent to receive commercial and promotional communications from VINHOOD, relating to our Services, for the exclusive purpose of sending you such communications by e-mail or regular mail, we collect and process the following data provided by you: first name, last name, e-mail.

If you buy a ticket and attend one of our physical or digital events:

  • Personal data, address, contact details and information about your possible food intolerances/preferences: when you purchase a ticket for one of our events or experiences. This data is necessary to enable you to participate in the event; payment data is not processed by us, but by third-party suppliers we use to process your ticket purchase. 
  • Image and voice of the user collected during participation in an event: data will be collected during registration. The data processed are: image, voice.

We use so-called cookies to collect certain data. To find out more about the different types of cookies and manage your preferences, please read the relevant cookie policy 

  • Data provided and shared on VINHOOD’s social pages: We collect and process personal data provided by you and shared on Vinhood’s social pages (Facebook, Instagram, etc.), for the management of which we refer you to the third parties that provide such services. We collect and process, for example, with the exclusive purpose of improving our communication on social media and providing you with a personalised experience, the following data: likes, comments, images and in general any content and information that may be published in this context.

WHAT WE USE YOUR DATA FOR AND HOW LONG WE KEEP THEM

We collect your data for the following purposes:

  • Creating your personal profile on our Platform: We use your data so that you can create your personal profile via the Platform, our services or using an existing social network account. The legal basis for the processing is Art. 6 para. 1, b) of the GDPR, the performance of a contract to which the data subject is party. The provision is necessary in order to process the request. The Data will be kept as long as the account is active. For technical reasons, the data may be kept for up to 30 days following the deletion of the account.
  • Handling your contact requests: your personal data will be processed to handle all requests you send us. The legal basis for such processing is Art. 6 para. 1, b) of the GDPR, GDPR, the performance of a contract to which the data subject is party. The provision is necessary to fulfil the request. The data will be retained for 12 months from the handling of the contact request.
  • Sending you commercial/promotional communications and invitations to our events/workshops: your personal data will be processed, where you have given your consent, to send you invitations and notifications of our events, to send you promotional communications of our activities (including new studies, surveys, etc.) to recommend products that are similar to your #character and to send you market research and statistical surveys. The legal basis for the processing is Art. 6, para. 1, a) of the GDPR, i.e. the consent. The provision is optional, in case you fail to provide it, the Controller will not be able to regularly update you on its news and events. You may withdraw your consent at any time by clicking on the “unsubscribe” link included in the marketing e-mail you receive or by writing to the following e-mail address privacy@vinhood.com. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The data shall be retained as long as the data subject is subscribed to the newsletter service, unless the consent is withdrawn. The Controller will regularly check your interest in receiving the newsletter and will proceed to delete your data both in the event of withdrawal of consent and in the event of non-interaction for an extended period of not less than 24 months.

Create your personalized profile based on your #character and/or business category (e.g. manufacturers or retailers) and the preferences you show when interacting with us in order to suggest products in line with your preferences, including by means of personalized email communications: Profiling activity may also be carried out using proprietary and third-party cookies (Cookie Policy linkable). The legal basis for the processing is Art. 6, para. 1, a) of the GDPR, i.e. the consent. The provision is optional, in case of failure to provide it, the Controller will not be able to suggest products in line with the preferences shown and update you with personalized commercial communications. You may withdraw the consent given at any time by clicking on the “unsubscribe” link included in the marketing e-mail received or by writing to the following e-mail address privacy@vinhood.com. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The data will be retained as long as the data subject is subscribed to the VINHOOD service, unless consent is withdrawn.

If you buy a ticket and attend one of our physical or digital events:

  • Allowing you to book and purchase an event: your personal data will be processed to: allow you to book and purchase a ticket for our physical or digital experiences. The legal basis for the processing is Art. 6, para. 1, b) of the GDPR, i.e., the performance of a contract to which the data subject is party. The provision of the data is necessary to fulfil the request. The data will be retained for 12 months from the purchase of the event, unless a longer period is necessary to exercise or defend a right or the different retention period is necessary for legal, accounting and tax purposes. Any processing of special data relating to allergies and intolerances to finalize the booking and purchase of an event is based on your explicit consent pursuant to Art. 9 par. 2, a) of the GDPR.
  • In the case of digital events: allow live interaction with questions and keep the recording of the debate for the creation of content for VINHOOD’s internal use. In the balancing of interests, VINHOOD has taken into account the technical relevance of the topics addressed, as well as the fact that the events are carried out by videoconference in order to be interactive and encourage debates and questions; therefore it has considered that anyone participating can legitimately expect the events to be recorded and the contents made available to VINHOOD for internal use and the creation of an archive, for educational purposes, allowing the analysis of the events’ progress and their subsequent improvement. The legal basis of the processing is according to art. 6, par. 1, f) of the GDPR the legitimate interest pursued by VINHOOD in the success and improvement of the events, also through the structuring of an internal didactic archive. You may at any time disable or ask VINHOOD to disable the possibility of being seen and/or heard by videoconference during the event. You will also be able to request the removal of the interventions concerning you from the content by writing to VINHOOD by email at privacy@vinhood.it. In both cases, the lawfulness of the processing carried out up to that point remains unaffected. The data will be retained for 5 years from the conclusion of the event, without prejudice to the right to object to the processing.
  • Publication of the content recorded during the event: the Controller may take videos and/or photos of the event and publish the content, including images and voices of the interested party, on social media channels (Facebook, Instagram and LinkedIn) owned by VINHOOD, as well as on VINHOOD presentations for both promotional (company profile) and commercial purposes (commercial offer to a client). In the event of registration VINHOOD will warn the user in advance, also during the event. The legal basis for the processing is art. 6 para. 1, f) of the GDPR, the legitimate interest pursued by VINHOOD. In the balancing of interests, VINHOOD has considered the fact that the events are reserved for users who purchase tickets, who are informed in advance of the content being filmed. Furthermore, the areas subject to filming are identified. You may at any time object to the processing and request the removal of the published content. During the event you may contact the VINHOOD staff present and ask not to be filmed and/or object to such treatment by sending an email to the address privacy@vinhood.it. The data will be retained for 5 years after the conclusion of the event, without prejudice to your right to object to the processing.
  • Communication of data to third party partners: We may communicate the data you provide with third parties, private individuals or companies, who collaborate with VINHOOD from time to time identified, belonging to the following categories GDO (large-scale retail trade); wine cellars; producers of alcoholic beverages; coffee producers for commercial and marketing purposes only if you have given your explicit consent to the transfer. The Partner or category of partners to whom the data will be disclosed will be identified on a case-by-case basis prior to the request for consent. The legal basis for such processing is Article 6(1)(a) of the GDPR, i.e. the consent. The provision is optional; in the event of failure to provide Personal Data, the Data Controller will not be able to regularly update the data subject on news and events to third-party partners. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. 

We cannot guarantee that your data, when deleted from our social profiles, will not still be available online, because someone else may have shared it in the meantime – even you yourself!

In any case, we undertake to base our data processing on the principles of accuracy and data minimization (we only process the data that we really need to achieve the purposes of the processing that we have explained to you above), and to review annually the necessity of retaining the data for no longer than is necessary to achieve the purposes for which the data was collected and processed.

We may retain your data to comply with regulatory obligations, or to establish, exercise or defend a legal claim against us.

Once the purposes for which your personal data was collected and processed have been fulfilled, we will take appropriate steps to make your data anonymous so that it cannot be identified.

HOW YOUR DATA IS PROCESSED

The processing of your Data will be carried out both on paper and by digital means, with the aid of computer systems, and manually, solely by authorized persons expressly appointed for this purpose. The processing will take place using logics and forms of organization of the data strictly related to the obligations, tasks or purposes that we have explained to you in detail in the preceding points.

We use precise technical and organizational measures to protect your data against possible manipulation, loss, destruction and against access by unauthorized persons. These security measures are constantly reviewed and improved in line with technological developments.

WITH WHOM AND IN WHAT AREAS WE SHARE YOUR DATA 

Your personal data will only be processed by individuals, duly appointed as data processors or persons in charge of the processing, who are authorized to perform these tasks and have security measures in place to ensure your confidentiality and to prevent undue access by third parties or unauthorized personnel. This includes third party payment service providers that we use to enable you to purchase our experiences.

Your personal data, where applicable and always with your consent and to the extent strictly relevant to the obligations, tasks or purposes specified above, may be shared with companies, organizations or individuals outside VINHOOD. We undertake, where you have given your consent, to share your image only on platforms that are compliant with the GDPR, but we invite you in any case to read the specific privacy policies for each social network.

Your personal data may be disclosed to the competent authorities for the purposes of preventing, investigating or prosecuting criminal offences, in accordance with the relevant GDPR.

The updated list of all data processors is available at VINHOOD’s headquarters and can be requested at the following e-mail address: privacy@vinhood.com. This list may subsequently be supplemented and/or updated as necessary.

In addition, we may proceed to disclose data in anonymous and aggregate form to third party partners relating, for example, to the age and/or gender of users using the Platform. Such data will not include personal data.

WE USE AUTOMATED DECISION-MAKING PROCESSES

As mentioned above, we define a low-level profiling of our users to provide you with a personalized service. 

The profiling is based on parameters such as #taste characteristics, product knowledge, the actions you take on our platform, your business category.

Taste profiling is done through our algorithms that use predictive capabilities to identify, for example, your #taste character regarding a certain product category (e.g. wine, coffee, beer, bitter, …) and be able to give you recommendations in line with your preferences on a given product. 

As a result of these analyses, you will be able to take advantage of the Platform’s services personalized for you and receive personalized communications from us that we consider to be in line with your tastes and preferences (#character).

We have positively conducted a balancing test in order to determine that the processing related to your categorization is conducted on the legal basis of the legitimate interest pursued by the Controller to achieve maximum efficiency in the creation of a unique “taste passport” and marketing activities.  

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

The entire processing of your data takes place in Italy and in countries within the European Union.

Should there be a need to transfer data to Third Countries, we undertake to:

  • Ensure that the Country to which the Data provided by you will be sent guarantees an adequate level of protection, as provided for in Article 45 GDPR; 
  • Check and carry out the transfer only where we or the data controller provide adequate safeguards providing you with enforceable rights and effective remedies (in accordance with Article 46 of the GDPR).

YOUR RIGHTS: YOU CAN KNOW AND MANAGE YOUR DATA AT ANY TIME 

You may at any time exercise the following rights under the conditions and within the limits provided for in Articles 12-22 of the GDPR by sending an email to privacy@vinhood.com: 

  • Right of access: the data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her is being processed and, if so, to obtain access to the personal data (Article 15 GDPR);
  • Right to rectification of inaccurate personal data and to obtain supplementation of incomplete personal data (Article 16 GDPR);
  •  Right to erasure of personal data: the data subject may request that his or her data be erased if it is no longer necessary for the purposes mentioned above, in case of withdrawal of consent or his or her objection to the processing, in case of unlawful processing, or if there is a legal obligation to erase (Article 17 GDPR);
  • Right to restriction of processing: the data subject has the right to obtain the restriction of processing when one of the following cases occurs: the data subject disputes the accuracy of the personal data, for the period necessary for the Controller to verify the accuracy of such personal data; the processing is unlawful and the data subject opposes the erasure of the personal data and instead requests that its use be restricted although the Controller no longer needs the personal data for the purposes of the processing, the personal data are necessary for the data subject to establish, exercise or defend a right in court; the data subject has objected to the processing, pending verification as to whether the Controller’s legitimate reasons prevail over those of the data subject (Article 18 GDPR);
  • Right to object to the processing: the data subject may object to the processing of his or her data at any time, unless the data Controller demonstrates the existence of compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims, pursuant to Article 6(1)(e) or (f) of the GDPR, including profiling (Article 21 GDPR);
  • Right to portability: the data subject has the right to receive in a structured, commonly used and machine-readable format personal data concerning him or her provided to a data controller and has the right to transmit such data to another data controller without hindrance from the data controller to whom he or she has provided it where: the processing is based on consent, or on a contract (Article 20 GDPR);
  •  Right to lodge a complaint with the supervisory authority (Article 77 GDPR).

In the event that the data subject considers that the processing of personal data carried out by the Controller is in breach of the provisions of Regulation (EU) 2016/679, the data subject has the right to lodge a complaint with the Supervisory Authority, in particular in the Member State where he or she normally resides or works, or in the place where the alleged breach of the Regulation occurred (in Italy, the Garante per la Protezione dei Dati Personali https://www.garanteprivacy.it/ ), or to take the matter to the appropriate judicial instances.

HOW YOU CAN EXERCISE YOUR RIGHTS

To exercise the above rights, you may send a communication to the email address privacy@vinhood.com, indicating in the subject line “Privacy – exercise of rights“.

*** *** ***

This Privacy Policy was published on September 2024. Any updates will always be published on this page