1. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?
The company responsible for the collection and processing of personal data is:
WDXPERIENCE, Lda.
Registered office:
Edifício NERE, Parque Industrial e Tecnológico de Évora
Rua Circular Norte
7005-841 Évora
Portugal
Share capital: €5,000.00
Tax identification number (NIF): 516.115.677
For any questions concerning the processing of personal data or the exercise of your rights, you may contact us at info@winexp.pt.
Wine XP processes personal data in accordance with Regulation (EU) 2016/679 (“GDPR”) and other applicable Portuguese and European data protection laws.
2. WHAT PERSONAL DATA DO WE COLLECT?
Depending on how you interact with Wine XP, we may collect different categories of personal data.
- name;
- country of residence;
- date of birth;
- tax identification number (TIN/NIF), where required;
- email address;
- telephone number;
- IP address;
- account login and registration information;
- booking and transaction information;
- payment-related information necessary to process a transaction;
- information required to provide or manage a Wine Experience;
- communications exchanged with Wine XP;
- information contained in customer reviews or feedback;
- information relating to preferences and interests where voluntarily provided;
- technical information relating to the use of our website or application;
- information collected through cookies and similar technologies, subject to applicable cookie rules; and
- information voluntarily provided by users when interacting with Wine XP customer support or virtual assistant.
Wine XP only requests personal data that is reasonably necessary for the relevant purpose.
Where certain information is mandatory for the provision of a service or completion of a booking, this will be indicated to the user. Failure to provide mandatory information may prevent Wine XP from providing the requested service.
3. PERSONAL DATA PROVIDED THROUGH THE WINE XP VIRTUAL ASSISTANT
Wine XP may provide a virtual assistant or chatbot on its website, application or other digital services to help users find information, explore Wine Experiences, obtain assistance and, where applicable, support the booking process.
The virtual assistant is based on an artificial intelligence (“AI”) system and users may therefore interact directly with an AI-based agent rather than exclusively with a human representative.
Users will be informed in a clear and distinguishable manner that they are interacting with an AI-based system at the beginning of the interaction, where required by applicable law.
When interacting with the virtual assistant, users may voluntarily provide information contained in their messages. Depending on the nature of the interaction, this information may include questions, preferences, travel plans, location-related information, booking requirements or other information necessary to provide the requested assistance.
Users should avoid providing sensitive personal data or information that is not necessary for the purpose of their interaction with the virtual assistant.
AI PROCESSING AND MODEL TRAINING
Personal data submitted through the Wine XP virtual assistant may be processed by Wine XP and/or by technology providers engaged by Wine XP to operate the service.
Personal data processed through the Wine XP virtual assistant is not used for training the underlying artificial intelligence model.
The AI system is used to generate responses and assist users with their requests. The processing of information submitted through the virtual assistant is limited to the purposes described in this Privacy Policy and to the operation, security, maintenance and improvement of the service, subject to the contractual arrangements and data protection obligations applicable to Wine XP and its service providers.
Customer conversations are not used by Aimage for training, retraining or fine-tuning AI models. Aimage states that its platform performs inference only. When Azure OpenAI is used, the provider documentation states that customer API data is not used for training or model improvement and is not shared with OpenAI. Any temporary abuse-monitoring retention by the remote model provider is subject to the applicable contractual configuration.
4. WHY DO WE PROCESS YOUR PERSONAL DATA?
Wine XP processes personal data only where there is an appropriate legal basis under applicable data protection legislation.
4.1 Performance of a contract
We process personal data where this is necessary to enter into or perform a contract with you, including creating and managing your Wine XP account, processing bookings and orders, providing Wine Experiences, communicating with wineries in connection with your booking, processing payments, managing cancellations and refunds, and providing customer support relating to services requested by you.
4.2 Compliance with legal obligations
We may process personal data where necessary to comply with legal obligations, including accounting, tax, invoicing, regulatory, fraud prevention and other applicable legal requirements.
4.3 Legitimate interests
We may process personal data where this is necessary for our legitimate interests, provided that those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests may include improving and maintaining our services, managing customer relationships, preventing fraud and misuse, maintaining system security, responding to requests, analysing service performance, managing reviews, defending or exercising legal claims, and improving the user experience.
4.4 Consent
Where required by law, Wine XP will process personal data on the basis of your consent. This may include certain marketing communications, optional analytics, cookies or other processing activities for which consent is legally required. Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. PURPOSES OF PROCESSING
Wine XP may process personal data for the following purposes:
- managing customer accounts and user registrations;
- processing shopping carts, bookings and orders;
- providing and managing Wine Experiences;
- processing and administering payments;
- communicating with customers regarding bookings, cancellations, refunds and other service-related matters;
- communicating with wineries and other relevant partners where necessary to provide a requested service;
- providing customer support;
- operating and providing the Wine XP virtual assistant and other digital services;
- responding to enquiries and requests submitted through the virtual assistant;
- improving the quality and usability of Wine XP services;
- measuring customer satisfaction and managing reviews;
- preventing fraud and other unlawful or abusive activities;
- maintaining the security and integrity of Wine XP systems;
- analysing website and application usage, where permitted by applicable law;
- sending marketing communications where applicable legal requirements have been met;
- complying with legal and regulatory obligations; and
- establishing, exercising or defending legal claims.
6. HOW DO WE USE INFORMATION PROVIDED TO THE VIRTUAL ASSISTANT?
Information provided through the virtual assistant may be used to understand and respond to the user's request; recommend relevant Wine Experiences; provide information about wineries, regions, activities and services; assist users in navigating the Wine XP website; support users during the booking process; provide customer service; and maintain the security and reliability of the service.
The virtual assistant may process the content of a conversation in order to generate a response.
The virtual assistant does not make decisions producing legal effects or similarly significant effects concerning users.
Recommendations or suggestions generated by the virtual assistant are intended to assist users and do not constitute a binding decision, professional advice or a guarantee that a particular Wine Experience is suitable for the user.
The assistant is informational only and does not make or trigger automated decisions producing legal or similarly significant effects concerning users.
7. SHARING OF PERSONAL DATA
Wine XP may share personal data with third parties where this is necessary for the purposes described in this Privacy Policy and where there is an appropriate legal basis.
- wineries and Wine Experience providers, where necessary to provide a booked or requested service;
- payment service providers;
- IT, hosting and infrastructure providers;
- customer support and communication providers;
- analytics and technology providers;
- providers of artificial intelligence and virtual assistant technology;
- professional advisers, including legal, accounting and financial advisers;
- public authorities, courts, regulators or other entities where required by law; and
- other service providers acting on behalf of Wine XP.
Where third parties process personal data on behalf of Wine XP, Wine XP will take appropriate steps to ensure that such processing is governed by appropriate contractual arrangements and complies with applicable data protection legislation.
Third parties will only receive the personal data reasonably necessary for the relevant purpose.
8. AI AND TECHNOLOGY SERVICE PROVIDERS
To provide certain digital services, including the Wine XP virtual assistant, Wine XP may use third-party technology providers acting as processors or, where applicable, independent controllers.
The relevant provider(s) may process information submitted through the virtual assistant for the purpose of generating responses and operating the service.
Wine XP will select service providers that provide appropriate guarantees regarding data protection and security and will enter into appropriate contractual arrangements where required by applicable law.
AI service provider: Aimage S.r.l.
Registered office: Via Confienza 10, 10121 Turin (Torino), Italy
Role under GDPR: Processor (data processor under Article 28 GDPR)
Relevant data processing agreement: Data Processing Agreement / Article 28 GDPR contractual arrangement with Wine XP
Sub-processors: Wholesale Italia S.r.l. and, where the remote Azure OpenAI configuration is used, Microsoft Ireland Operations Ltd.
9. INTERNATIONAL TRANSFERS OF PERSONAL DATA
Some of our service providers may process personal data outside the European Economic Area (“EEA”).
Where personal data is transferred outside the EEA, Wine XP will ensure that the transfer is carried out in accordance with the GDPR and that an appropriate legal transfer mechanism and safeguards are in place, where required.
Such safeguards may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism.
The documented AI service operates on infrastructure in Italy and, where applicable, Azure OpenAI in European regions. Any future change affecting international transfers will be assessed and reflected where required.
10. MARKETING COMMUNICATIONS
Where permitted by applicable law and, where required, on the basis of your consent, Wine XP may use your personal data to send marketing communications by email, SMS or other mobile messaging, push notifications, social media or other permitted digital communication channels.
Marketing communications may include information about Wine Experiences, destinations, promotions, news and other Wine XP services.
You may withdraw your consent or opt out of marketing communications at any time by following the unsubscribe instructions included in the communication or by contacting Wine XP at info@winexp.pt.
Withdrawal from marketing communications will not affect your ability to use Wine XP services.
11. COOKIES AND SIMILAR TECHNOLOGIES
Wine XP uses cookies and similar technologies on its website and application.
Cookies may be used for purposes including enabling essential website functionality, remembering user preferences, improving navigation, measuring website usage, analysing performance and supporting marketing activities, where permitted and subject to applicable consent requirements.
Where consent is required, non-essential cookies will only be activated after the user has provided the relevant consent.
Users may manage or withdraw cookie preferences through the cookie management tools made available by Wine XP or through their browser settings.
For further information, please refer to the applicable Cookie Policy.
12. HOW LONG DO WE KEEP YOUR PERSONAL DATA?
Wine XP retains personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.
The retention period may depend on the duration of the contractual relationship, completion of a booking or service, applicable accounting, tax or legal obligations, the need to establish, exercise or defend legal claims, applicable limitation periods, and the purposes for which the information was collected.
Customer accounts that have remained inactive for more than four (4) years may be deactivated and associated personal data erased, unless retention is required by law or is otherwise necessary for a legitimate purpose.
Virtual assistant conversations
Information submitted through the Wine XP virtual assistant may be retained for the period necessary to provide the service, maintain security, resolve disputes, comply with legal obligations and operate the service.
For the Wine XP virtual assistant, personal data will not be retained longer than necessary and, according to Aimage's privacy-governance documentation, will not exceed 12 months from acquisition unless a longer period is required by law or specifically justified. Technical logs are retained for 30 days, audit logs for 5 years and daily database backups for 30 days.
Where personal data is no longer necessary for the relevant purpose and there is no legal basis requiring its continued retention, it will be deleted or appropriately anonymised.
13. SECURITY OF PERSONAL DATA
Wine XP takes appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures may include access controls, authentication mechanisms, security procedures, data protection agreements with service providers and other appropriate technical and organisational safeguards.
However, no transmission or storage system can be guaranteed to be completely secure.
Wine XP therefore cannot guarantee absolute security of information transmitted over the internet or stored through third-party systems, although it will take reasonable and appropriate measures to protect personal data.
14. YOUR DATA PROTECTION RIGHTS
Subject to the conditions and limitations established by applicable law, you may have the following rights:
- Right of access — to obtain confirmation as to whether your personal data is being processed and, where applicable, access to that data;
- Right to rectification — to request correction of inaccurate or incomplete personal data;
- Right to erasure — to request deletion of your personal data in circumstances provided by law;
- Right to restriction of processing — to request restriction of processing in circumstances provided by law;
- Right to data portability — to receive certain personal data in a structured, commonly used and machine-readable format and, where legally applicable, request its transmission to another controller;
- Right to object — to object to certain processing activities, including processing based on legitimate interests and, where applicable, direct marketing;
- Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time; and
- Rights relating to automated decision-making — where applicable under Articles 21 and 22 of the GDPR, to object to or request appropriate safeguards in relation to certain automated decision-making and profiling.
Wine XP does not intend to use the virtual assistant to make decisions producing legal effects or similarly significant effects concerning users.
15. HOW CAN YOU EXERCISE YOUR RIGHTS?
You may exercise your data protection rights by contacting Wine XP at info@winexp.pt or by sending a registered letter to:
WDXPERIENCE, Lda.
Edifício NERE, Parque Industrial e Tecnológico de Évora
Rua Circular Norte
7005-841 Évora
Portugal
When submitting a request, Wine XP may ask for additional information reasonably necessary to verify your identity and protect against unauthorised disclosure of personal data.
Wine XP will respond to requests within the time limits established by applicable law.
16. RIGHT TO LODGE A COMPLAINT
If you believe that Wine XP has processed your personal data unlawfully or has not adequately addressed your request, you have the right to lodge a complaint with the competent data protection supervisory authority.
In Portugal, the competent authority is:
Comissão Nacional de Proteção de Dados (CNPD)
Website: https://www.cnpd.pt/
You may also have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement, where provided by applicable law.
17. DATA RELATING TO CHILDREN
Wine XP's services are not specifically directed at children.
Where a service requires personal data relating to a child, such processing will be carried out in accordance with applicable legislation and appropriate safeguards.
If you believe that a child has provided personal data to Wine XP without the required authorisation, please contact us at info@winexp.pt.
18. CHANGES TO THIS PRIVACY POLICY
Wine XP may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or data processing practices.
When material changes are made, Wine XP will take appropriate measures to inform users where required by applicable law.
The date of the latest revision will always be displayed at the beginning of this Policy.
19. APPLICABLE LAW
This Privacy Policy is governed by applicable Portuguese and European data protection legislation, including Regulation (EU) 2016/679 (GDPR).
Any matters not specifically addressed in this Privacy Policy shall be governed by the applicable legislation.
Last updated: August 2026
WDXPERIENCE, Lda.
info@winexp.pt
Edifício NERE, Parque Industrial e Tecnológico de Évora
Rua Circular Norte
7005-841 Évora
Portugal
