Privacy Policy

Last updated: March 26, 2026

How to contact us

Adega de Penalva can be contacted using the contact information provided on this website. Adega de Penalva is responsible for the processing of personal data it collects and processes, in compliance with the requirements set forth in Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (General Data Protection Regulation — GDPR), and by Law No. 58/2019 of August 8, which ensures the implementation of the GDPR in the national legal system.

Why We Process Your Personal Data

The personal data we process is always collected for a specific purpose, in accordance with Article 5 of the GDPR, and for a specific processing operation, after which it is anonymized or destroyed. The purposes of the processing are as follows:

1. Compliance with legal obligations applicable to us, whether regarding customers and suppliers or our employees, pursuant to Article 6(1)(c) of the GDPR;
2. The performance of contracts or for pre-contractual measures within the scope of our business, pursuant to Article 6(1)(b) of the GDPR;
3. To perform the services we provide, upon obtaining the data subject’s consent, pursuant to Article 6(1)(a) of the GDPR;
4. Based on legitimate interest, pursuant to Article 6(1)(f) of the GDPR, specifically in communicating with customers and potential customers, suppliers, and in recruiting employees.

Lawfulness of the Processing of Your Personal Data

Adega de Penalva’s business activities involve the processing of personal data whenever it provides services. The lawfulness of such processing is ensured in accordance with Article 6 of the GDPR and may take the following forms:

1. As a processor acting on behalf of a client, where the client, as the data controller, provides us with personal data so that we may contact you;
2. In cases where Adega de Penalva is itself the data controller, obtaining the data subject’s prior and recorded consent.

What we do with your data once processing is complete

The personal data used is intended solely for the purposes described; therefore, once the processing operation is complete, we anonymize the records or destroy them entirely, in accordance with Article 5(1)(e) of the GDPR.

Retention Period

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, in accordance with Article 5(1)(e) of the GDPR. In cases where a longer retention period is required by law, the data will be anonymized.

Security

Information security and the protection of personal data are a priority for Adega de Penalva, in accordance with Article 32 of the GDPR. We ensure appropriate safeguards and guarantee that third parties we engage are contractually bound and ensure adequate data protection. Access to personal data is limited to employees directly involved in processing operations. All personal data is stored in secure systems that are audited and subjected to periodic testing.

In the event of a personal data breach, Adega de Penalva will notify the National Data Protection Commission (CNPD) within a maximum of 72 hours after becoming aware of the incident. Whenever the breach is likely to result in a high risk to data subjects, they will also be informed without undue delay, in accordance with Article 34 of the GDPR.

Confidentiality

We respect the confidentiality of the personal data we process, ensuring that we do not disclose, distribute, or make it available to third parties, except when specifically required to provide a contracted service in support of the services we offer.

Exercising Data Subject Rights

Pursuant to Articles 15 through 22 of the GDPR, as a data subject, you may exercise the following rights:

• Access — you may request access to the information we hold about you;
• Rectification — you may request the correction of inaccurate or incomplete information;
• Erasure — you may request the erasure of your data when it is no longer necessary for the purpose for which it was collected, pursuant to Article 17 of the GDPR;
• Withdrawal of consent — you have the right to withdraw your consent at any time, without this affecting the lawfulness of the processing carried out prior to such withdrawal;
• Restriction and objection to processing — pursuant to Articles 18 and 21 of the GDPR, you may request the restriction of or object to the processing of your data under certain circumstances.

The data subject may also, at any time, request the deletion of their user account, which will result in the erasure of all associated personal data, except for data that must be retained by law.

Requests may be submitted via the contact information available on this website and will be processed within a maximum of 30 days, as provided for in Article 12 of the GDPR; this period may be extended by an additional two months in cases of particular complexity. You may be asked to provide proof of identity to ensure that data is shared only with the data subject.

You also have the right to file a complaint with the National Data Protection Commission (CNPD), located at Rua de São Bento, No. 148-3º, 1200-821 Lisbon, via the website www.cnpd.pt.

Cookies

This section of the policy is prepared in accordance with Law No. 41/2004 of August 18, as amended by Law No. 46/2012 of August 29, which transposes the ePrivacy Directive into national law, as well as the GDPR.

What are cookies?

Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. These files allow the site to recognize your device on future visits and store certain information about your browsing, such as preferences or items added to your shopping cart. Cookies do not contain viruses and cannot access other files on your device.

What types of cookies are there?

Cookies can be classified based on their origin, duration, and purpose:

By origin:

• First-party cookies — installed directly by the website you are visiting;
• Third-party cookies — installed by external entities, such as analytics platforms or social media sites, through the website you are visiting.

By duration:

• Session cookies — temporary; they are automatically deleted when you close your browser;
• Persistent cookies — remain on your device for a set period, even after you close your browser, until they expire or are manually deleted.

Regarding purpose:

• Strictly necessary cookies — essential for the basic functioning of the website, such as maintaining your session or shopping cart. Do not require consent under Law No. 41/2004;
• Preference (functional) cookies — allow the website to remember your choices, such as language or region, to provide a personalized experience;
• Analytical or performance cookies — collect anonymous information about how users navigate the website, with the aim of improving its functionality;
• Marketing and advertising cookies — used to display relevant ads based on the user’s interests and to measure the effectiveness of advertising campaigns;
• Social media cookies — allow you to share content on social media and may record your visit to the website for advertising purposes.

Cookies We Use

Strictly necessary cookies — do not require prior user consent under Law No. 41/2004:

• Session (login) cookies — keep the session active across pages and are deleted when the session ends, ensuring the security of restricted areas;
• Shopping cart cookies — ensure that items added to the cart are retained during navigation, allowing for the correct processing of the order;
• Form cookies — temporarily store information submitted in forms, preventing data loss in case of an error;
• User account cookies — manage the registration process, authentication, and general administration of the user’s account;
• Security cookies — used to detect and prevent fraudulent or malicious activity, protecting both the user and the website.

Non-essential cookies — require your prior, express, and informed consent, in accordance with Article 5 of Law No. 41/2004 and Article 6(1)(a) of the GDPR:

• Google Analytics — we use Google Analytics to understand how the website is used and to improve the user experience. These cookies may record, for example, the time spent on the site or the pages visited. The data collected is anonymous and aggregated. For more information, see Google’s privacy policy at policies.google.com;
• Newsletter cookies — used to manage the subscription status for newsletters and email communications, showing or hiding notifications based on the user’s subscription status;
• Preference cookies — store user preferences, such as language or content layout, to provide a personalized experience on future visits;
• Conversion and performance cookies — collect statistics related to purchases and browsing behavior to support marketing, advertising, and pricing decisions;
• Testing and improvement cookies — used during testing of new features or design changes, ensuring a consistent experience and allowing us to measure which changes are most valued by users;
• Survey cookies — used to remember who has already responded to satisfaction surveys or to ensure consistent results when navigating between pages.

How to Manage Cookies

You can manage or disable cookies at any time through your browser settings. Please refer to your browser’s “Help” section for specific instructions. Please note that disabling certain cookies may limit the functionality of this website, particularly regarding authentication, the shopping cart, or the personalization of your browsing experience.

You can also opt out of being tracked by Google Analytics by visiting https://tools.google.com/dlpage/gaoptout.

Final Considerations

This Privacy and Cookies Policy may be updated at any time, with changes published on this page along with the date of the last update. We recommend reviewing this document periodically. For any questions regarding the processing of your personal data or the use of cookies, you may contact Adega de Penalva using the contact information available on this website.