VINOS
Privacy Policy
Last updated: 2 September 2026.
1. Data controller
The data controller is Zimbro Guloso, tax number 519 558 650, with registered office at Sítio dos Virgílios, Caixa Postal 321 A, 8005-540 Faro, Portugal. For privacy matters: escola@vinosdanos.pt.
2. Data processed
Depending on how the site is used, we may process your name, username, email, phone number, tax number, billing address, enrolment and payment details, messages, consent/acceptance records and technical security data such as IP address, date, time and access attempts.
3. Purposes and legal grounds
- Creating and managing accounts when requested, answering enquiries and processing enrolments with or without an account: pre-contractual steps and performance of a contract.
- Processing payments, invoices and accounting or tax duties: compliance with legal obligations.
- Protecting the site, preventing abuse and maintaining technical records: legitimate interests in service and user security.
- Sending messages strictly related to accounts, enrolments or courses: contract performance and delivery of the requested service.
4. Recipients and providers
Data is shared only where necessary with providers supporting hosting, databases, email delivery, security and legal compliance. The site uses PTisp for infrastructure and email and Cloudflare Turnstile for anti-bot protection. These providers process only the data needed for their respective services under their contracts and policies.
Some providers may process data outside the European Economic Area. Where applicable, legally recognised safeguards such as adequacy decisions or standard contractual clauses are used.
5. Retention
Data is kept while an account or enrolment is active and afterwards only for the time needed to manage requests, establish or defend legal claims and comply with accounting, tax and legal duties. Enrolment confirmation links expire after 24 hours, unpaid reservations after 48 hours, and management links have limited validity. Technical security records are periodically deleted.
6. Your rights
You may request access, correction, erasure, restriction, portability or objection, where applicable, using the email above. You may also lodge a complaint with the Portuguese Data Protection Authority (CNPD). Exercising these rights does not affect data that must be retained by law.
7. Security and automated decisions
Appropriate technical and organisational measures are used, including HTTPS, hashed passwords, access control, request validation and anti-bot protection. No decisions producing legal effects are made solely by automated processing.