Privacy Policy
In force from 5 October 2026
What personal data SearchWinery handles, why, for how long, and what you can do about it — under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Spain's Ley Orgánica 3/2018.
1. Who is responsible
The controller is Marc Artigas Sanchez, sole trader, tax ID (NIF) 38837917W, Can Guardiola, sn, 08339 Vilassar de Dalt, Barcelona. Write to hola@searchwinery.com about anything in this policy. We have not appointed a data protection officer; the law does not require one for a service of this kind.
2. If you scanned a wine's QR code
We collect nothing about you. An e-label page sets no cookie, stores nothing in your browser, loads nothing from any other site, runs no analytics and no script, and we do not record your IP address or device when it is served. The regulation that requires e-labels forbids collecting or tracking the data of the people who read them, and the service is built so that it cannot.
3. What we handle, why, and on what basis
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Your account: name, email address, password (stored only as a one-way hash), role, the language you read the service in, and when the account was created, approved, deactivated and accepted the terms | To give you the back office, sign you in, approve your account before it publishes, and show that you accepted the terms | Contract (6.1.b) |
| Winery details: name, town, region, bottler's name and address, website — personal data when the business is a person | To print them on your e-labels and winery page, where the wine labelling rules require them | Contract (6.1.b) |
| The name of the person who confirmed each published e-label, and when | To keep an unalterable record of what each bottle displayed and who declared it, which you or an authority may need | Legitimate interest (6.1.f) — ours and the producer's — in proving what was declared |
| Your plan: the payment provider's customer and subscription references, plan, status and renewal dates. We never see your card. | To apply your plan's limits and keep billing in step with the payment provider | Contract (6.1.b) |
| Server logs for the website and back office (not for e-labels): IP address, time, address requested and response | To keep the service secure — throttling sign-in attempts, investigating abuse — and to fix faults | Legitimate interest (6.1.f) in a secure, working service |
| Messages you send us | To answer them, and to handle reports of illegal content | Legitimate interest (6.1.f); legal obligation (6.1.c) for reports under the Digital Services Act |
We make no decisions about you by automated means alone, and we do not profile anyone. We do not sell personal data or use it for advertising. You do not have to give us any of it, but we cannot open an account without a name, an email address and a password.
4. Cookies
SearchWinery uses one cookie, sw_session, and only after you sign in. It keeps you signed in to the back office, is sent only to /admin, cannot be read by scripts, and expires after 12 hours or when you sign out. Because it is strictly necessary for a service you asked for, it needs no consent (Directive 2002/58/EC, article 5(3); LSSI-CE, article 22.2). There are no analytics, advertising or third-party cookies, and the home page, winery pages and e-labels set none at all.
5. Who else receives it
- Our hosting and database providers, which store and run the service for us as processors, under contracts that bind them to our instructions and to the GDPR.
- Creem, our payment provider and merchant of record, which receives your email address and plan to sell you the subscription, take payment and issue invoices. Creem decides how it processes payment data as a controller in its own right; its own privacy policy applies to that.
- Scaleway, which sends our emails — the link to confirm your email address when you register, and the link to set a new password when you ask for one — as our processor, from its data centres in France. It receives your name, email address and the message.
- The public, for what you publish: your e-labels and winery page, including the bottler's name and address. The name of the person who confirmed an e-label is not published.
- Authorities, when the law requires us to disclose data.
We keep personal data in the European Economic Area. If a provider ever needs to process it elsewhere, we will do so only with the safeguards GDPR chapter V requires, such as the European Commission's standard contractual clauses, and update this policy.
6. How long we keep it
- Account data: while your account is open. When it closes we remove or anonymise your name and email address within one month, except where the law requires us to keep them.
- Published e-labels, including the bottler's details and the name of the person who confirmed each version: at least 10 years after the e-label's most recent publication, as the Terms of Service promise, because bottles in the market still point to them.
- Billing records: six years, as Spanish commercial law requires (Código de Comercio, article 30). Creem keeps its own records as its policy says.
- Password reset and email confirmation links: a reset link works for 30 minutes and a confirmation link for 24 hours; our record of either is deleted seven days after that.
- Server logs: at most 30 days, unless one is needed to investigate a specific security incident.
- Messages and reports: as long as needed to deal with them, and then for the time a claim about them could be brought.
7. Your rights
You may ask us for access to your personal data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable form (GDPR articles 15 to 22). Write to hola@searchwinery.com from your account's email address, or tell us how we can confirm who you are. We answer within one month.
Some data we cannot erase while the law or another person's interest needs it — for example, a published e-label's record of who confirmed it, which stays with the e-label for the period in section 6.
If you think we have not respected your rights, you may complain to the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or to the data protection authority where you live or work.
8. Security
Connections are encrypted. Passwords are stored only as bcrypt hashes. Sign-in attempts are throttled, sessions can be ended on every device, and only accounts we have approved can publish. If a breach puts your data at risk, we will tell the authority within 72 hours and tell you without undue delay where the law requires.
9. Changes
When this policy changes we will update the date above and, for a change that matters to you, tell you in the back office or by email before it applies.
This policy is available in English, Catalan and Spanish. If the versions differ, the English version prevails.