Privacy Policy

Privacy Policy

This Privacy Policy explains how WineMine processes personal data of visitors and customers of winemine.bg, in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act (Закон за защита на личните данни, ЗЗЛД).

1. Controller

The data controller is CSM DISTRIBUTION EUROPA OOD, EIK 208086149, registered seat 85 Ekzarh Yosif Str., Oborishte district, Sofia 1000, Bulgaria, represented by Sebastian Daniel Klaus Wahl.

Contact: bar@winemine.bg · +359 88 728 8992 · Bar: ул. „Свети Климент Охридски“ 33, София 1504.

Data Protection Officer (DPO): WineMine has not appointed a DPO as it is not required under GDPR Art. 37.

2. Categories of personal data

  • Account data: name, email, password (hashed), shipping/billing address, phone.
  • Order data: order history, products purchased, order total, invoicing details.
  • Payment data: handled by our payment processor; we receive only a transaction reference and the last 4 digits of the card.
  • Reservation data: name, email, phone, party size, date and time, booked via the Reservation.Tools widget on /pages/reservations.
  • Marketing data: email address, communication preferences, engagement metrics (open/click).
  • Support data: content of emails, calls, chats and complaints.
  • Technical data: IP address, device, browser, pages visited, cookies (see Cookie Policy).

3. Purposes and legal bases (GDPR Art. 6)

  • To perform the sales contract: Art. 6(1)(b): processing account, order, payment, delivery and reservation data.
  • To comply with legal obligations: Art. 6(1)(c): tax and accounting (Accountancy Act, retention of invoices and primary documents), age verification under the Health Act and the Wine and Spirit Drinks Act, consumer-protection obligations.
  • Legitimate interests: Art. 6(1)(f): site security, fraud prevention, defence of legal claims, basic analytics, internal reporting.
  • Consent: Art. 6(1)(a): marketing emails, non-essential cookies, marketing/analytics tracking. Consent can be withdrawn at any time.

4. Recipients

We do not sell your personal data. We share it only with the following categories of recipients, who act as processors or independent controllers:

  • Shopify Inc. (e-commerce platform and Shopify customer accounts).
  • Payment processor: Shopify Payments.
  • Shipping carrier: Speedy.
  • Reservation provider: Reservation.Tools (booking widget).
  • Email and marketing service provider: Shopify Email.
  • Analytics: WineMine does not currently use third-party analytics tools.
  • Accountant / auditor, public authorities (NAP, KZP, KZLD, courts) when required by law.

5. International transfers

Shopify Inc. is established in the United States, and some of the processors listed above may also process data outside the EEA. Where this happens, the transfer is protected by Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or other safeguards permitted by Chapter V GDPR. A copy of the relevant safeguards is available on request.

6. Retention periods

  • Account data: until the account is closed plus 1 year.
  • Order, invoicing and accounting data: 10 years from the end of the financial year (Accountancy Act, art. 12).
  • Tax-relevant documents: 5 to 10 years per the Tax-Insurance Procedure Code.
  • Reservation data: 12 months from the booked date.
  • Marketing data: until you withdraw consent or after 24 months of inactivity.
  • Support correspondence: 3 years.
  • Cookies: see Cookie Policy.

7. Your rights

Under the GDPR you have the right to:

  • access your personal data;
  • rectify inaccurate or incomplete data;
  • erasure (“right to be forgotten”);
  • restriction of processing;
  • data portability;
  • object to processing based on legitimate interests, including profiling;
  • withdraw consent at any time, without affecting prior lawful processing;
  • not be subject to solely automated decisions producing legal effects.

To exercise your rights, please contact us at bar@winemine.bg. We will respond within one month, in line with GDPR Art. 12(3).

8. Supervisory authority, KZLD

If you believe your rights have been infringed, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД):

  • Address: гр. София 1592, бул. „Проф. Цветан Лазаров“ 2
  • Website: cpdp.bg
  • Email: kzld@cpdp.bg

9. Children

The Site is not intended for persons under 18 years of age and we do not knowingly collect personal data from minors. If we become aware that personal data of a person under 18 has been collected, we will delete it without undue delay.

10. Cookies

The Site uses cookies and similar technologies. Detailed information about the cookies in use, their purposes and how to manage them is available in our Cookie Policy.

11. Changes

We may update this Privacy Policy from time to time. The current version is always available on the Site, with the “Last updated” date below.

Last updated: 16 June 2026