Privacy notice

Who is responsible

Vinakademin Media Edu Sverige AB (organisation number 559392-4607), Ringgatan 22 B lgh 1203, 752 17 Uppsala, Sweden, operates winetaster. We are responsible for our own optional winetaster emails and for operating and securing the service.

The named winery decides why and how information is used for its tasting and its own marketing. winetaster processes that information to provide the tasting service for the winery. The winery's privacy notice is linked where you join. Contact the winery about its own use; you may also contact us and we will help route your request.

Information and purposes

We record your email address, the winery and tasting you joined, your language, join time, any wine scores from 1 to 5 and any note you write on a wine. Your notes are for you: we send them back to you in the email you get after the tasting, and we do not show them to the winery. We record each separate marketing choice, the wording shown, and when you made or withdrew it. We also keep recap delivery status, limited security and access information, and tasting-level counts of clicks on wine, shop and review links.

The tasting information provides the wine list, ratings and recap you request. The winery explains the legal basis for this in its notice. We rely on your separate consent for winetaster news and tips on wine tastings sent in separate emails. We use legitimate interests to secure the service and prevent misuse, balanced against your rights. We do not use your ratings or tasting history for winetaster marketing unless a separate choice clearly covers that use.

Your email choices

The recap does not require marketing permission. At a tasting you are asked one optional question: whether you want emails from the winery you are visiting. The box is unticked by default, and the choice covers only that named winery's news about wines, tastings and offers. winetaster's own emails are not offered at the tasting table. If you chose winetaster emails earlier, that choice stays valid until you withdraw it. It covers separate winetaster news and tips on wine tastings. winetaster emails are not based on which winery you visited or how you rated its wines, and we never use one winery's guests to promote another winery. We do not sell guest email addresses, and we do not give winetaster's own email list to wineries or other companies.

You can withdraw either choice independently through the preferences link in the recap or by contacting the relevant organisation. Withdrawal stops future use for that purpose. When a winery has exported an address to its own email tool, we provide suppression updates so it can honour a later withdrawal there.

Recipients and locations

Authorised winery staff see their tasting activity, aggregate ratings and only the guests with current permission in their own marketing export. They do not see individual guests' ratings or notes. winetaster's own marketing audience includes only guests who chose winetaster emails.

Railway hosts the application and database, Resend delivers service emails, and Cloudflare provides domain infrastructure and private logo storage. Their authorised personnel and subprocessors may have access as needed. We do not currently run behavioural analytics or session replay on guest tasting pages.

The application runs in a European Railway region and logos are stored in an EU-restricted Cloudflare R2 bucket. Railway and Resend may process or support personal data from the United States. Before real guest collection we will complete the applicable data-processing and transfer arrangements. Where required, transfers outside the EEA will use an applicable adequacy decision or the European Commission's standard contractual clauses. Contact us for details of the mechanism relevant to your data.

Retention

Identifiable tasting participation, ratings, notes and recap records are kept for up to 24 months after the tasting or fair (or registration, for visitors registering after a fair ends), unless a shorter winery instruction or an earlier valid deletion request applies. Recovery links expire after 20 minutes and guest access tokens after 90 days. A marketing address is kept while its permission remains current. After withdrawal, only the minimum suppression and consent evidence needed to respect the choice and resolve disputes is retained, for up to three years. Local delivery event records are removed after 90 days. Provider records follow the provider’s retention terms.

Expired event history is removed by a scheduled cleanup. Deletion requests are handled by an operator after identity verification, including follow-up for provider records and exported copies. A keyed email fingerprint and limited consent evidence may remain for up to three years to record the request and preserve delivery suppression; this does not permit marketing. A winery may have its own justified retention requirements, which it must explain in its notice. Limited information may be kept longer where law or a specific claim requires it.

Your rights

You can request access, correction, deletion, restriction and, where applicable, a portable copy. You may object to processing based on legitimate interests and to direct marketing at any time. You can withdraw consent at any time. We may verify that you control the email address before disclosing or changing information.

Contact the winery about its guest and marketing records, or winetaster about our service and messages. You can complain to the Swedish Authority for Privacy Protection (IMY) or your local data-protection authority. We do not make solely automated decisions about you with legal or similarly significant effects.

Access and changes

The tasting page uses a necessary access cookie so your device can return to your ratings. It is not a marketing or analytics cookie. We may update this notice as the service or suppliers change. We will explain a material new purpose for winetaster emails before relying on an earlier choice for it.