Privacy Policy

Who is the controller

The controller of your personal data is TO BE COMPLETED — registered name of the operator (TO BE COMPLETED — sole trader / company), tax identification number TO BE COMPLETED — NIF / VAT number, registered at TO BE COMPLETED — registered address, Portugal, trading as “Raru”.

For any question about this policy or to exercise your rights, write to hi@raru.wine or call +351 915 397 411. We have not appointed a Data Protection Officer, as we are not required to.

What we collect and why

We only collect what a request actually needs. Each purpose below has its own legal basis under Article 6 of the GDPR.

• Request handling — name, email, phone, delivery country and address, the bottles on your list and any notes or gift message. Legal basis: performance of a contract or pre-contractual steps at your request (Art. 6(1)(b)).
• Invoicing and tax — name, address and tax identification number (NIF) where an invoice requires it. Legal basis: compliance with a legal obligation (Art. 6(1)(c)). We do not ask for a NIF unless you request an invoice that carries one.
• Age verification — your confirmation that you are of legal drinking age and, only where a carrier or the law requires proof, your date of birth. Legal basis: compliance with a legal obligation and our legitimate interest in not selling alcohol to minors (Art. 6(1)(c) and (f)).
• Member List emails — your email address, and only if you tick the box yourself. Legal basis: consent (Art. 6(1)(a)), withdrawable at any time.
• Security and abuse prevention — server logs including IP address and timestamp. Legal basis: our legitimate interest in keeping the site available and secure (Art. 6(1)(f)).

How long we keep it

Requests that do not lead to a purchase: 12 months from the last contact, so we can pick up a conversation where you left it.

Completed orders and invoicing records: 10 years, the retention period Portuguese tax law imposes on accounting documents.

Member List: until you unsubscribe, plus a minimal record of the unsubscribe itself so we do not contact you again.

Server logs: up to 12 months.

Who else processes your data

We do not sell personal data and we do not share it for third-party advertising. We use a small number of processors, each bound by a data processing agreement and acting only on our instructions:

• Application hosting, database and authentication (Lovable Cloud, built on Supabase) — stores request and account data.
• Object storage and content delivery for bottle images (Cloudflare R2 and CDN).
• Email delivery for transactional and Member List messages.
• Google Fonts, which serves the typefaces used on this site and receives your IP address as part of that request.
• Carriers and insurers, who receive the name, address and phone number needed to deliver and insure your shipment. Where a bottle is brokered, the third-party seller receives only what is strictly necessary to fulfil the order.

International transfers

Our infrastructure is hosted in the European Union wherever the provider offers it. Where a provider processes data outside the EEA, the transfer relies on an adequacy decision of the European Commission or on the European Commission's Standard Contractual Clauses together with supplementary measures. You can ask us for a copy of the safeguards in place for any specific transfer.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data where one of the grounds in Article 17 applies.
• Restrict processing while a dispute about accuracy or legitimate interest is resolved.
• Data portability — receive the data you gave us in a structured, machine-readable format.
• Object to processing based on our legitimate interests, and object at any time to direct marketing.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Exercising your rights and complaining

Write to hi@raru.wine with the subject “Data request”. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need that extension.

If you are not satisfied, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) (https://www.cnpd.pt), or with the supervisory authority of your country of residence.

Marketing emails

The Member List is opt-in only. The box on the request form is never pre-ticked, and joining is never a condition of placing a request. We send occasional updates about new bottles and nothing else. Every message carries an unsubscribe link, and you can also unsubscribe by replying to any email.

Cookies and tracking

This website uses no advertising cookies, no analytics cookies and no third-party trackers. We store a small amount of data in your browser's local storage to remember the bottles on your list between visits; that is strictly necessary for the feature to work, stays on your device and is never sent to a third party. If we ever introduce analytics or marketing cookies, we will ask for your consent first through a banner and update this section.

You can clear that stored data at any time through your browser's site settings, which will empty your list.

Security

Data is transmitted over encrypted connections and stored on access-controlled infrastructure with row-level access rules. Access to order data inside Raru is limited to the people who need it to fulfil orders. No system is perfectly secure, but if a breach ever affects your rights we will notify you and the supervisory authority as the GDPR requires.

Changes to this policy

We update this policy when our processing changes. Material changes are announced on this page before they take effect.