Privacy Policy

1. Data controller

The data controller responsible for the personal data collected through this website is:

• Company name: Bodegas Señorío de Líbano, S.A.
• NIF/CIF: A08810400
• Address: Calle del Río, s/n, 26212 Sajazarra, La Rioja, Spain
• Email: bodega@senoriodelibano.com

2. Data we collect and purposes

We collect personal data only when you voluntarily provide it. The main processing activities are:

• Contact form / email enquiries: name and email address, to respond to your query (legitimate interest / performance of a contract).
• Online shop (tienda.senoriodelibano.com): name, delivery address, email and payment data processed by our payment provider (Stripe), to fulfil your order (performance of a contract).

3. Legal basis for processing

Depending on the purpose, the legal basis is one of the following (Article 6 GDPR):

• Performance of a contract (Art. 6.1.b): processing orders and responding to queries.
• Legitimate interest (Art. 6.1.f): fraud prevention and website security.
• Legal obligation (Art. 6.1.c): tax and accounting records.

4. Recipients

Your data will not be sold or rented to third parties. We share data only with:

• Hosting / infrastructure providers (processors under a data processing agreement).
• Stripe, Inc. — payment processing, under their own privacy policy.
• Public authorities, if required by law.

Some providers may be located outside the EEA. Where this is the case, data transfers are covered by Standard Contractual Clauses or an adequacy decision.

5. Retention period

Data is retained only for as long as necessary for the purpose for which it was collected:

• Contact enquiries: up to 3 years from the last communication.
• Orders: 5 years for tax/accounting obligations (Spanish General Tax Law).

6. Your rights

Under the GDPR and Organic Law 3/2018 (LOPD-GDD), you may exercise the following rights at any time by writing to bodega@senoriodelibano.com, enclosing a copy of your ID:

• Right of access — to obtain confirmation of whether we process your data and a copy thereof.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure — to request deletion where data is no longer necessary.
• Right to restriction of processing — to limit processing in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to processing based on legitimate interest.
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.

We will respond to your request within one month.

7. Right to lodge a complaint

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Security

We apply appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Payment data is handled exclusively by our PCI-DSS-certified payment processor (Stripe) and is never stored on our servers.