1. Data controller

The controller of the personal data collected through the Abadía da Cova Wine Club is Adegas Moure, S.A., with tax ID A-27045632 and registered office at Avda. Buenos Aires, 12 — 27540 Escairón (Lugo), España.

You can contact the controller by phone at 982 452 031 or by email at abadiadacova@adegasmoure.com. No data protection officer is currently listed; this email is the channel for privacy queries and data-subject rights requests.

The email abadiadacova@adegasmoure.com is the channel for Club orders, incidents, returns, operational communications, privacy matters and exercising data-protection rights.

This policy applies to club.abadiadacova.com and to the Club subscription service. The corporate website adegasmoure.com and third-party provider websites may have their own privacy policies.

2. Personal data we process

We process the data provided directly by the user or, where applicable, their representative when requesting a subscription: full name, email address, DNI/NIE, mandatory phone number, shipping address, city, postal code, province, selected pack, acceptance of the Privacy Policy and Terms of Sale, and the data needed to manage the contractual relationship.

We also process data generated while providing the service: Stripe customer and subscription identifiers, subscription status, subscription creation, cancellation, successful or failed payment events, transactional communications sent and technical data required for security, error logging and site operation.

Card, bank account or IBAN details are entered and managed directly in Stripe Checkout or the Stripe Customer Portal. The Club does not store bank details or full card numbers on its servers or in Supabase.

Because this service is linked to alcoholic beverages, subscriptions are restricted to persons over 18. The service is not intended to process minors’ data.

The initial age confirmation is stored only in the browser local storage to remember that the access notice has been accepted. No date of birth or copy of an identity document is stored; only the DNI/NIE number provided for the subscription is processed, and this decision is not used instead of any official verification that may be required at sale or delivery.

3. Purposes and legal bases

To handle subscription requests, validate the form, create the payment session, manage the subscription, deliver the contracted packs, handle incidents, and allow cancellation, payment-method updates and invoice access through the Stripe Customer Portal. The legal basis is contract performance or pre-contractual steps requested by the data subject.

To manage recurring payments, billing, accounting, tax obligations, order traceability, returns, refunds, incidents and complaints, and applicable legal obligations. The legal basis is compliance with legal obligations and, where applicable, contract performance.

To send transactional emails related to the subscription, such as welcome messages, subscription confirmation, payment issues, renewal notices, shipping information or communications needed to provide the service. The legal basis is contract performance.

To send Club information, newsletters or own campaigns linked to the subscription and Adegas Moure wines, within the limits allowed by applicable law and with opt-out mechanisms where required. The legal basis will be consent where required or legitimate interest in communications about similar products or services where applicable.

To maintain site security, prevent abuse, debug technical incidents, log errors and keep minimum evidence of webhook, payment and email operation. The legal basis is the controller’s legitimate interest in maintaining a secure and reliable service.

To use non-essential cookies or similar technologies, including analytics if integrated, only after the cookie banner has been accepted. The legal basis is consent, which may be withdrawn as explained in the Cookie Policy.

4. Recipients and providers

Personal data may be accessed by providers required to deliver the service, acting as processors or independent controllers as applicable: Stripe for payments, subscriptions and customer portal; Supabase for database and operational records; Resend for transactional emails and Club communications; MRW for transport and delivery; Cloudflare for hosting and site security; Sentry for error monitoring; and Google Fonts for web font delivery.

Where necessary to deliver the packs, contact and address data may be disclosed to transport or logistics companies. Data may also be disclosed to accounting, tax or legal advisors, banks, public administrations, courts and tribunals where legally required or necessary to bring, exercise or defend claims.

We do not sell personal data or disclose it to third parties for commercial campaigns unrelated to the Club without a valid legal basis.

5. International transfers

Some technology providers may process data from countries outside the European Economic Area or be subject to foreign laws. Where international transfers occur, they will be carried out on the basis of an adequacy decision, European Commission standard contractual clauses or other safeguards recognised by the GDPR.

The project uses Supabase in the EU region (eu-west-1) for the Club database. Even so, global services such as Stripe, Cloudflare, Resend, Sentry or Google may involve technical access or support from outside the EU under their privacy terms and safeguards.

6. Data retention

Data linked to the subscription will be kept while the contractual relationship remains active and, after it ends, for the periods needed to address legal, tax, accounting, consumer or contractual liabilities.

Accounting and billing documentation will be kept for the periods required by applicable commercial and tax rules. Technical records, business events and incident logs will be retained for the time needed to secure the service, debug errors and evidence relevant operations.

Data processed on the basis of consent will be kept until consent is withdrawn, unless another legal basis requires or permits retention. Cookies and similar technologies are governed by the periods stated in the Cookie Policy.

7. Data-subject rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to abadiadacova@adegasmoure.com or to the controller’s postal address, proving your identity where necessary.

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. You may also request additional information about the origin, recipients and safeguards applied to your data.

If you consider that your rights have not been properly addressed or that processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security and confidentiality

The controller applies reasonable technical and organisational measures to protect data against loss, alteration, unauthorised access or improper processing, taking into account the state of the art, the nature of the data and the risks of processing.

Operational access to Club data is limited to the people and providers who need it to provide the service. At this stage there is no proprietary back office: operational management is carried out through the Stripe Dashboard, Supabase and the technical providers defined in the project architecture.

9. Cookies and analytics

The site uses a cookie banner that blocks analytics and non-essential technologies until the user accepts. Acceptance is stored in the browser through localStorage using the cookie-consent key.

The initial age confirmation is stored separately in localStorage using the age-gate key. It only remembers acceptance of the access notice and does not store a date of birth or identity documents.

More information about cookies, consent and how to disable or withdraw acceptance is available in the Cookie Policy.

10. Updates to this policy

This Privacy Policy may be updated to reflect legal, technical or operational changes to the Club. Where changes are material, we will seek to inform users through reasonable means.