Privacy Policy

Last updated on 16 October 2026.

1. Data controller

The website www.cavesdomjosepacheco.pt (the “website”) is run by Caves D. José Pacheco, Lda. (“Caves D. José Pacheco”, “we”), company registration no. 508587735, with registered office at Rua General Torres, n.º 1220, Piso -1, Lojas 15/16, 4400-164 Vila Nova de Gaia, Portugal, which is the controller of the personal data collected through the website.

For any question about this Policy or about your personal data, you can contact us by email at [email protected].

This Privacy Policy explains what personal data we collect, for what purposes, on what legal basis, how long we keep it, who we share it with and what your rights are, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Portuguese Law no. 58/2019 of 8 August.

2. Definitions

For the purposes of this Policy, “personal data” means any information relating to an identified or identifiable natural person, such as a name, an email address or an IP address. “Processing” means any operation performed on personal data, such as collection, recording, storage, consultation, use, disclosure or erasure. “User” or “data subject” means the person browsing the website or whose data is processed. “Processor” means an entity that processes personal data on our behalf and according to our instructions.

3. Principles we follow

We process personal data lawfully, fairly and transparently, only for specified, explicit and legitimate purposes. We collect only the data needed for each purpose, keep it accurate and up to date, store it only for as long as necessary and protect it with appropriate technical and organisational measures.

We only process personal data when there is a legal basis for doing so, namely your consent, the performance of a contract or of steps taken at your request before entering into a contract, compliance with a legal obligation or our legitimate interest, provided your interests, rights and freedoms do not override it.

When processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out before that date.

4. What data we collect and why

The website has no customer area or online shop and does not allow comments. We only collect the data you give us directly in the forms and the technical data generated by your visit, as follows.

Before entering the website, we ask whether you are of legal drinking age. Your answer is stored only in your browser, so that the question is not repeated, and is not sent to us.

At the end of the periods above, the data is erased or anonymised, unless the law requires us to keep it for longer or it is needed to establish, exercise or defend legal claims.

5. Who we share data with

We do not sell or transfer your personal data. We only disclose it to third parties when required by law, when necessary to reply to your request or when we use service providers acting on our behalf.

5.1. Processors

To run the website we use the following providers, who process data only according to our instructions and are bound by confidentiality and security obligations.

• DigitalOcean, for hosting the website and the data collected in the forms.
• Cloudflare, for delivering the website and protecting it against malicious traffic.
• Brevo, for sending emails generated by the website, such as contact form messages.
• Our email service provider, where we receive and reply to messages.
• Google, through Google Analytics, only when you accept statistics cookies.

5.2. Other recipients

Data may also be disclosed to public authorities, such as the Tax and Customs Authority, the courts or the police, when required by a legal obligation or an order from a competent authority.

6. International transfers

Some of the providers listed above belong to groups based outside the European Economic Area, in particular in the United States. Where data is transferred to those countries, this is done with the safeguards provided for in the GDPR, such as the adequacy decision on the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

7. Security

We take appropriate technical and organisational measures to protect your data against destruction, loss, alteration, disclosure or unauthorised access. These include an encrypted connection (HTTPS) across the whole website, protection of the administration area with two-step verification and limited login attempts, filtering of malicious traffic and access to data restricted to the people who need it.

8. Minors

The sale of alcoholic drinks to minors is prohibited and the website is not intended for anyone under 18. We do not knowingly collect data from minors. If you become aware that a minor has given us personal data, please contact us so that we can delete it.

9. Cookies

The website uses cookies and similar technologies. Cookies that are not strictly necessary are only used with your consent, which you can give, refuse or change at any time through the cookie banner. You can find all the details in our Cookie Policy.

10. Your rights

Under the GDPR, you have the following rights over your personal data.

• Right of access, to know whether we process your data and obtain a copy.
• Right to rectification, to correct inaccurate data or complete incomplete data.
• Right to erasure, to ask for your data to be deleted when there is no longer a reason to keep it.
• Right to restriction of processing, to ask for processing to be suspended in certain situations.
• Right to data portability, to receive the data you gave us in a structured, machine-readable format, or to ask for it to be sent to another organisation.
• Right to object, to object to processing based on our legitimate interest.
• Right to withdraw consent, at any time, for processing that depends on it.

To exercise any of these rights, send an email to [email protected], stating your name, your contact details and the right you wish to exercise. We will reply within one month of receiving your request, a period that may be extended by up to two further months for particularly complex requests, in which case we will let you know. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, through its website www.cnpd.pt.

11. Personal data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours of becoming aware of it. If the risk is high, we will also inform you without undue delay.

12. Changes to this Policy

We may update this Privacy Policy whenever necessary, for example because of changes in the law or in the services we use. The date of the last update is shown at the top of this page. If a change is significant, we will highlight it on the website.

13. Governing law

This Policy is governed by the GDPR and the applicable Portuguese law. The courts of the district of Porto have jurisdiction over any dispute relating to it, without prejudice to any mandatory legal provisions.