Privacy Policy

Vivino ApS

This policy is effective from 27 January 2025.

Data controller

VIVINO ApS (hereinafter “Vivino”, “we”, “our”, “us”) provides a platform that enables registered users (hereinafter “User”, “you”, “your”) to buy, rate and review wine ratings and wine information (hereinafter the “Services”) via our website or mobile applications. It also enables Users to follow other Users to see their ongoing reviews and connect with other Users from their social media accounts.

Vivino is registered as a private limited company in Denmark under company registration number (CVR) 32081193. Our contact details are:

This privacy policy (hereinafter “Privacy Policy”) applies to all use of our website; www.vivino.com, (hereinafter “Web”), and all uses of our applications for mobile devices (hereinafter “App”). The Web and the App together form our Services (hereinafter “Platform”).

We will process your personal data in compliance with European General Data Protection Regulation (Hereinafter “GDPR”). This Privacy Policy covers our processing of personal data collected when you register and access the Platform and use our Services.

Vivino is the data controller of the personal data we collect from our Users in accordance with GDPR. This Privacy Policy describes how and when Vivino collects, processes, discloses and shares your personal data when you use our Platform. If you have any questions or comments about this Privacy Policy, please contact us using one of the methods provided above..

Please note, that website visitors may use our Platform without signing up, in which case we will only collect data based on the visitors consent in accordance with the information provided by our Consent Management Platform.

Purpose and legal basis

User Relationship Management

We process your personal data to manage our user relationship with you, including managing your account, providing you with access to our Platform and communicating with you in regard to updates, policies and updated terms and conditions.

As part of this activity, we process personal data, which includes:

• Identification and contact information such as name, email address, and postal address, country of origin, username, and preferred language.
• Information related to our relationship, including correspondence.
• Ratings – A "rating" is a User's ability to evaluate a wine by assigning it a score from 1 to 5 stars.

If you choose to register or sign in via a third-party application (Facebook, Apple and Google), you authorize us to access and collect certain account information, including your name, profile picture, and optionally, your email address and current city.

The processing of your personal data is performed on the legal basis of:

• Fulfilling our contractual obligations when delivering the Platform to you cf. Article 6(1)(b) of the GDPR on processing necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.

Your personal data is stored for as long as your account is active. Upon deletion of your profile, the identification and contact information will be stored for 6 months after the date of deletion. The ratings will not be deleted as they form part of the overall evaluation of the wines, which is essential for the Services and the Platform. Vivino will retain the User's rating based on Vivino's commitment to providing a credible and factually accurate service.

Disclosure of Wine Reviews for User Interaction

We process and disclose your wine reviews and included ratings to enable other Users to follow your reviews. As part of this processing activity, we process personal data, which includes:

• Username
• Review - A "review" is a User's written evaluation or commentary about a Wine, providing detailed feedback and personal insights.

The disclosure is carried out on the legal basis of:

• Your freely given consent, as provided when signing up to the Platform, in accordance with GDPR Article 6(1)(a).

You may withdraw your consent at any time in your profile settings. This will disable the ability for other users to follow you and will anonymize your username, which would otherwise be displayed on your reviews.

Users who request the deletion of their review can ask to have their username removed, ensuring the review remains anonymous. However, the original text of the review will be preserved. If the review is otherwise accurate and the User does not provide compelling individual reasons for deletion, Vivino will retain the user's review based on Vivino's commitment to providing a credible and factually accurate service. Therefore, Vivino generally does not delete reviews, as they do not want reviews to be subject to manipulation or threats from producers – regardless of whether the review is positive or negative. The review may already have been used in other contexts, and we always aim for Vivino to maintain the original text to preserve our credibility as a service and in accordance with the Consumer Ombudsman's Guidelines on the Publication of User Reviews from May 1, 2015.

Purchase of wine

To facilitate your purchase of wine via the Platform, we process your personal data necessary for fulfilling our or a third-party merchants contractual obligations. This includes collecting the following personal data when you place an order:

• Contact information such as first name, surname, and email address and phone number, for notifications and contact in case of order-related changes
• Billing information
• Shipping information, if different from your billing information

Our legal basis for processing this personal data is:

• Fulfilling Vivino’s or third-party merchants’ contractual obligations when delivering the products cf. GDPR Article 6(1)(b), which permits processing necessary for the performance of a contract to which you are a party or for taking steps at your request prior to entering into a contract.

Your personal data is stored for up to 2 years after the purchase to comply with the legal deadline for warranty claims under Danish law. Any personal data processed for bookkeeping purposes is stored with the bookkeeping material for the current year plus 5 years, in accordance with Section 12 of the Danish Bookkeeping Act.

Analysis and Development

When visiting our Platform, cookies are collected in the same way as they apply elsewhere on the internet.

All information related to our use of cookies is provided by our Consent Management Platform. Our basis for processing is consent in accordance with the cookie regulation.

We also process your personal data to deliver, develop and improve the Platform. This includes enhancing our offerings, developing new features and updates, and creating personalized services. Additionally, we implement algorithms and machine learning for these purposes to optimize our business and Services.

This data is used for routine analysis, audits, development, identifying popular products, assessing the effectiveness of marketing campaigns, and planning operational activities. As part of this processing activity, we process ordinary personal data, which includes:

• User activities on our Platform
• IP-address
• Areas of interest
• Purchase history
• Location of your device/you. If you have given permission to collect your device location.

Our legal basis for processing personal data for these statistical and analytical purposes is:

• Our legitimate interest in improving our platform and services cf. GDPR Article 6(1)(f), which allows processing necessary to pursue a legitimate interest. As a company, we have a legitimate interest in developing our Services. We balance these interests by employing the best practice anonymization techniques to protect your personal data to the greatest extent possible.

We store analyses in a depersonalized form.

Marketing and Advertising

We use your personal data to display personalized marketing messages and advertising on our Platform. As part of this processing activity, we process personal data, which includes:

• Contact information such as first name, surname, username and email

Our legal basis for processing your personal data is:

• Your freely given consent to receive marketing communications via email and push notifications, provided when signing up to the Platform cf. GDPR Article 6(1)(a), which allows processing based on consent, in accordance with section 10 of the Danish Marketing Practices Act (opt-in rule).

You can withdraw your consent at any time through your Profile Settings, by clicking the “Unsubscribe” button in any marketing email, or by contacting us using the details provided above.

Your email address will be removed as soon as possible after you unsubscribe.

Children's privacy

The Platform is intended for use by adults of legal drinking age in the jurisdiction in which you reside. If we receive notice or reasonably believe that someone under the legal drinking age has provided us with personal information, we will promptly delete the account and all personal information that has been provided to us.

Sharing of data

Personal data about our users is an essential part of our business. To run the Services and infrastructure we are depending on multiple security-approved data processors for storing and processing personal data.

When we use data processors, a data processing agreement has been entered determining the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects as well as our obligations and rights.

Your Personal Data is only being passed onto third party processors when it is necessary for us to provide and run a specific part of our service – e.g. when fulfilling orders or sending email newsletters.

We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so.

We use different types of payment providers for our checkout. The payment providers are considered independent data controllers. Your personal data is processed in line with the payment provider’s own privacy notice.

Transfer of data to third countries

In connection with IT operations, including hosting, development and support, we may in certain cases transfer personal data to companies established in a country outside the EU/EEA. When Vivino transfers your personal data to third parties outside the EU and EEA, we ensure that your personal data and data protection rights are adequately protected by ensuring either:

• The European Commission has taken an adequacy decision;
• standard contractual clauses approved by the European Commission or the Danish Data Protection Agency are used;
• the implementation of additional measures for those third countries where the legislation of the country concerned so requires.

You can obtain further information about our transfer of your personal data to third countries by writing to us.

Security

In order to prevent unauthorized access or disclosure, we have put in place technical and organizational procedures to safeguard the information we collect.

User accounts including personal data are protected by a password for your privacy and security. You should ensure no unauthorized access to your account and personal data by choosing and protecting your password appropriately, and by signing off when finishing accessing your account. When signing in via a third-party application provider your password is solely managed by such third-party.

We do our best to ensure that User accounts are kept private. However, various instances such as unauthorized entry/use, hardware or software failure, and other factors, may compromise the security of the personal data.

This Privacy Policy only governs information collected on the Platform.

Your rights as a User

As provided by the GDPR, you have the right to:

• Right of Access – the right to be informed of and request access to the Personal Data we process about you;
• Right to Rectification – the right to request that we amend or update your Personal Data where it is inaccurate or incomplete;
• Right to Rectification – the right to request that we amend or update your Personal Data where it is inaccurate or incomplete;
• Right to Restrict – the right to request that we temporarily or permanently stop processing all or some of your Personal Data;
• Right to Object – the right, at any time, to object to us processing your Personal Data on grounds relating to your particular situation; the right to object to your Personal Data being processed for direct marketing purposes;
• Right to Data Portability – the right to request a copy of your Personal Data in electronic format and the right to transmit that Personal Data for use in another party's service; and
• Right not to be subject to Automated Decision-making – the right to not be subject to a decision based solely on automated decision making, including profiling, where the decision would have a legal effect on you or produce a similarly significant effect.

When we receive a request to access, rectify, erase or port data, we may ask you for additional information in order to confirm your identity and ensure data security. You can send a request at the contact details presented in the section “Data Controller”

You have the right to complain regarding the processing of personal data concerning you to the supervisory authority, which in Denmark is the Danish Data Protection Agency:

California Privacy Rights Addendum

This California Privacy Rights Addendum (“Addendum”) supplements the Privacy Policy of Vivino ApS and applies solely to California residents, as required by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Any terms defined in the CCPA/CPRA have the same meaning when used in this Addendum.

Your Rights Under CCPA/CPRA

As a California resident, you have the following rights regarding your personal information:

• Right to Know and Access:
  • You have the right to request:
    • The categories of personal information we collect.
    • The specific pieces of personal information we have collected about you.
    • The categories of sources from which we collect personal information.
    • The purposes for collecting, selling, or sharing personal information.
    • The categories of third parties with whom we share personal information.
• Right to Delete:
  • You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out:
  • You have the right to opt-out of the sale or sharing of your personal information. We do not sell your personal information, but we may share certain categories of personal information for targeted advertising purposes.
• Right to Correct:
  • You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to Limit the Use of Sensitive Personal Information:
  • You have the right to request that we limit the use of your sensitive personal information to what is necessary to provide our services.
• Right to Non-Discrimination
  • We will not discriminate against you for exercising your rights under CCPA/CPRA.

Submitting Requests

To exercise your rights, you may contact us by:

• Email: [email protected]

Do Not Sell or Share My Personal Information

Vivino does not sell your personal information. However, if we share personal information for targeted advertising purposes, you can opt-out by contacting us using the methods outlined above.

Categories of Personal Information We Collect

The categories of personal information we collect and use include:

• Identifiers (e.g., name, email address, IP address).
• Commercial Information (e.g., purchase history).
• Internet or Other Electronic Network Activity (e.g., browsing behavior on our website or app).
• Geolocation Data (e.g., precise location, with your consent).

Retention of Personal Information

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting obligations. For more details, see the “Data Retention” section of our Privacy Policy.

We may update this Addendum from time to time. When we do, we will notify California residents in accordance with applicable laws.