1. Data controller
"VINUM" S.R.L., IDNO 1017600042210, registered office s. Sociteni, Raionul Ialoveni, MD-6826. Contact for personal-data matters: info@vinum.md.
Processing is carried out in accordance with Law of the Republic of Moldova no. 133/2011 on the protection of personal data; for visitors from the European Union, the rights provided by the GDPR also apply.
2. What data is collected
| Data | Source | Required |
|---|---|---|
| First name and surname (in full) | entered at registration | required |
| Email address | entered at registration | required |
| Interface language | user's choice | required |
| Confirmation of being 18+ | tapped on entry | required |
| Acceptance of the rules and the policy, with date and time | tapped at registration | required |
| Consent to marketing email, with date and time | a separate checkbox, unticked by default | optional |
| Wine ratings (15 values per tasting), accuracy scores, tier, start and completion times | the participant's actions | follows from taking part |
| A free-text comment on a tasting, where the participant left one | entered by the participant | optional |
| Vouchers: code, value, minimum basket, dates of issue, expiry and redemption, redeeming shop | created by the system | follows from taking part |
| Technical web-server logs (IP address, request time, User-Agent) | automatic | follows from running the site |
What the system does not collect: payment data (purchases are paid for outside the Site), precise geolocation, social-network data, advertising identifiers.
3. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Registration, sign-in, account management | performance of a contract (taking part in the competition on the terms of the rules) |
| Accuracy calculation, standings, determining winners | performance of a contract |
| Issuing, checking and redeeming vouchers | performance of a contract |
| The email to a winner and handing over the prize | performance of a contract |
| Publishing the first name and the initial of the surname in the standings | performance of a contract; the format minimises the data (see §6) |
| Checking that participation was in good faith before a prize is awarded | legitimate interest — the integrity of the competition |
| Technical security, server logs | legitimate interest — protection of the service |
| News about wines and competitions | separate consent, withdrawable at any time |
Consent to marketing email is not a condition of taking part: declining it affects neither the result nor the prize.
4. Who the data is shared with
- The email provider Resend — the address and the contents of the message,
in order to deliver the sign-in link and notifications. Messages are sent from
no-reply@vinum.estate. - The hosting provider TopHost.md — as the operator of the infrastructure on which the site and the database run.
- A partner shop, when a voucher is redeemed, sees the voucher code, its value and the minimum basket, but not the participant's name, email address or results.
- Public authorities — where there is a lawful request.
Data is not sold and is not passed to advertising networks.
5. Retention periods
- The account and the data attached to it — for as long as the account exists; on deletion (see §7) the personal fields are anonymised.
- Ratings, scores and vouchers are retained after the account is anonymised, by then with no link to an identity: they are needed for the reproducibility of the season's results and for financial reporting on the discounts issued.
- Web-server logs — 6 months.
- Test records from the pilot tasting may be deleted at any time.
6. The public standings
The public standings show the first name and the surname shortened to an initial (for example, "Dan U."). Where two participants would have the same shortened form, the initial is extended by as many letters as needed until the entries are distinguishable (for example, "Dan Uzh." and "Dan Ud."). This is a deliberate compromise: without it, two different entries would look identical and the standings would become unreadable.
A name in this form remains personal data, and the participant may request deletion (§7) — after anonymisation, that participant's entries disappear from the standings.
Winners of layers 2 and 3 are published in the same format, unless otherwise agreed.
7. Participants' rights and how they are implemented
| Right | How it is implemented |
|---|---|
| Access and portability | The dashboard offers the export GET /api/me/export — JSON containing the profile (first name, surname, email, language), every tasting (status, dates, accuracy, wine), every voucher (code, value, minimum basket, dates of issue, expiry, redemption) and the survey answers |
| Rectification | By request to info@vinum.md |
| Erasure | POST /api/me/erase in the dashboard. The first name and surname are replaced with "Deleted User", the email address with a technical invalid one, sign-in links and active sessions are deleted, and free-text answers are wiped. Ratings, scores and vouchers are retained in anonymised form — see §5. The action is irreversible |
| Withdrawal of consent to marketing email | A link in the message, or a request to info@vinum.md |
| Objection and complaint | A request to the controller; thereafter to the National Centre for Personal Data Protection of the Republic of Moldova |
The wording above describes what the code does, not what is planned:
app/api/me/export/route.ts and app/api/me/erase/route.ts.
8. Cookies
The Site uses only strictly necessary cookies:
| Cookie | Purpose | Lifetime |
|---|---|---|
sid |
the participant's session after sign-in by link | 30 days, rolling |
asid, psid |
administrator and partner-shop sessions | the same, for the back-office accounts only |
All of them are HttpOnly, Secure and SameSite=Lax. There are no
advertising or analytics cookies, pixels or trackers on the Site, so no cookie
consent banner is required. If analytics is introduced, this policy will be
extended before it is connected.
9. The pilot tasting
The data of pilot-tasting participants is processed on the same bases and in the same way. The differences: their results are marked as test data, do not take part in the standings or the prizes, and may be deleted by the organiser together with the test codes.
10. The sommelier group's data
The ratings of the sommelier group's members are stored under a sommelier number, not under a name; the group's members' names are kept separately, in the organisational documents, and are not published alongside the ratings. Filming of the tasting evening takes place with the group members' written consent to the use of their image.
11. Changes to this policy
A new edition is published on the Site with its date. Changes that materially affect participants' rights are notified by email.