Privacy Policy

Last updated: 9 October 2026

Note: indicative document pending legal review by a professional.

1. Data controller

ROWAN S. COOP GALEGA XUVENIL (Tax ID F26697466), registered at Calle Cesáreo González 25, Pta. A, 36210 Vigo (Pontevedra), Spain. Contact: info@wines-qr.com.

2. Data we process

• Account data: name, email and password (encrypted).
• Winery and product data: the data the user enters to generate their labels.
• Payment data: when you purchase additional licences, the payment is processed through Stripe. Your card details are entered and handled within Stripe’s systems: we never receive or store them. For each purchase we keep the amount, date, description and transaction reference, together with any billing details you provide.
• Scan analytics: anonymous, aggregated data (country and language). We do not record the full IP address, precise location or user-agent.

3. Purpose and legal basis

We process data to provide the service (performance of the contract), manage payments (legal and contractual obligation) and produce anonymous usage statistics (legitimate interest). No automated decisions with legal effects are made.

4. Retention

We retain data while the account is active and, thereafter, for the legally required periods. Scan data is kept in anonymous form.

5. Recipients

We do not transfer data to third parties except where legally required or to providers delivering necessary services, under the corresponding data processing agreements: Stripe Payments Europe, Ltd. to process payments, our email provider, and ipapi.co to determine a scan’s country of origin from its IP address.

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@wines-qr.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

7. Security

We apply technical and organisational measures to protect data (encrypted passwords, secure connections, access control).

8. International data transfers

Payments are processed by Stripe Payments Europe, Ltd., based in Ireland (European Union), which may share data with its parent company Stripe, Inc. in the United States. Those transfers rely on the standard contractual clauses approved by the European Commission and on the EU-U.S. Data Privacy Framework. You can find the details in Stripe’s privacy policy.