Privacy policy

PRIVACY POLICY

1. Data controller
The controller responsible for the processing of personal data collected through the website www.cavetirsense.com is:

CT TIRSENSE - VINHOS, LDA
Corporate Tax Identification Number (NIPC): 519 533 232
Rua Dr. Raúl Augusto Castro Fernandes 17, 4780-712 Santo Tirso, Portugal
Email: geral@cavetirsense.com
Telephone: +351 913 784 962

2. Personal data processed
Depending on the user’s interaction with the website, we may process:

  • name, address, email address and telephone number;
  • tax identification number and billing information;
  • customer account information and, in the case of professional customers, company details and associated locations;
  • information regarding orders, products purchased, payments, returns and communications;
  • technical data, such as IP address, browser, device, language, pages visited and cookie identifiers;
  • marketing preferences and records of consent;
  • information submitted through forms, contact requests or complaints.

Cave Tirsense does not receive or retain complete bank card details. Payments are processed by the payment service providers made available during checkout.

3. Purposes and legal grounds
Personal data may be processed in order to:

  • create and manage customer accounts;
  • process orders, payments, deliveries, returns and after-sales support;
  • issue invoices and comply with tax, accounting and legal obligations;
  • manage the Professional Area, catalogues, prices and B2B commercial terms;
  • respond to requests for information, complaints and the exercise of rights;
  • prevent fraud, abuse, security incidents and unlawful use of the website;
  • improve the operation, security and user experience of the website;
  • send marketing communications where consent or another applicable legal basis exists.

Depending on the circumstances, processing is based on the performance of a contract or pre-contractual measures, compliance with legal obligations, the data subject’s consent and the pursuit of legitimate interests, including security, fraud prevention, customer relationship management and service improvement.

4. Recipients and service providers
Personal data may be disclosed, to the extent strictly necessary, to:

  • Shopify, as the e-commerce platform and store hosting provider;
  • payment service providers;
  • carriers and logistics operators;
  • providers of IT, hosting, security, communications and marketing services;
  • accountants, auditors, consultants and insurers;
  • public, tax, judicial or law enforcement authorities, where legally required.

These recipients process personal data subject to appropriate contractual and legal obligations.

5. International transfers
Some technology service providers may process personal data outside the European Economic Area. Where applicable, such transfers are carried out on the basis of an adequacy decision, standard contractual clauses or another legally recognised mechanism that ensures an appropriate level of protection.

6. Data retention
Personal data is retained only for as long as necessary for the purposes for which it was collected and for the periods required by legal, tax, accounting and contractual obligations or for the establishment, exercise or defence of legal claims.

Data used for marketing purposes is retained until consent is withdrawn or the data subject objects, without prejudice to retaining the records necessary to demonstrate compliance with the request.

7. Rights of data subjects
In accordance with applicable law, the data subject may request:

  • access to their personal data;
  • rectification of inaccurate or incomplete data;
  • erasure, where applicable;
  • restriction of processing;
  • data portability, where applicable;
  • objection to processing based on legitimate interests;
  • withdrawal of consent, without affecting the lawfulness of processing carried out before its withdrawal;
  • objection, at any time, to direct marketing.

Requests must be sent to geral@cavetirsense.com, clearly identifying the right the data subject wishes to exercise. Additional information strictly necessary to confirm the identity of the applicant may be requested.

The data subject may also lodge a complaint with the Portuguese National Data Protection Commission — CNPD.

8. Marketing communications
Marketing communications are sent only where legally permitted. Recipients may unsubscribe using the link included in each communication or by contacting geral@cavetirsense.com.

9. Cookies
The website uses cookies and similar technologies that are necessary for the operation of the store, authentication, shopping cart, security and checkout. Subject to consent, analytics, personalisation and marketing cookies may also be used.

Users may manage their preferences through the website’s cookie banner or privacy panel and through their browser settings. Refusing non-essential cookies does not prevent general access to the website, although certain features may be limited.

10. Minors and alcoholic beverages
The store is not intended for the purchase of alcoholic beverages by persons under the age of 18. We do not knowingly collect data from minors for this purpose. Cave Tirsense may request proof of age and refuse a sale or delivery where it is not possible to confirm that the purchaser or recipient is of legal age.

11. Security
We implement appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised access or disclosure. No system is completely secure, and users must also protect their login credentials and report any suspected unauthorised use of their account.

12. Amendments
This Privacy Policy may be updated to reflect legal, operational or technological changes. The current version will be published on the website together with the date of its latest update.