VINOSTEPS
Privacy Policy
Last updated 18 October 2026 · In case of any discrepancy between the Greek and English versions, the Greek version prevails.
1. Data Controller
The controller is WINE DIGITAL SERVICES SINGLE MEMBER P.C., trading as “Vinosteps”, registered office Alexandroupoleos 20, 115 27 Athens, Greece, G.E.MI. No. 193875103000 (EUID: ELGEMI.193875103000), Tax No. 803288834. Privacy enquiries: info@vinosteps.com. Booking enquiries: reservations@vinosteps.com. This processing is governed by the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Greek national supplementary framework, Law 4624/2019.
2. Data we collect
Depending on your use of the service, we may collect identity and contact details; booking information (winery, experience, date, time, guest number, amount and status); cancellation and refund information; messages and support requests; corporate or group-booking details; and limited technical data generated through operation of the Website. If you submit a review after your visit, we also process its content as described in the “Reviews” section below. Vinosteps does not offer customer accounts and does not seek to build commercial or advertising profiles of visitors. Vercel, as our hosting, CDN, security, monitoring and, where enabled, cookie-free analytics provider, may automatically process technical and usage data such as IP address, referrer domain, requested page or route, browser or user agent, device type and operating system, approximate geographic location, date and time, CDN or network region, and performance or security data. We do not use these data to identify visitors for marketing or routinely combine them with booking records, except where necessary for security, technical incident investigation, fraud prevention or support relating to a specific booking.
3. Payment information
Payments are processed through Stripe, with Stripe Payments Europe Ltd (Ireland) as the contracting/invoicing entity. Vinosteps does not store full card numbers, CVV codes or complete payment credentials. We may receive payment status, transaction reference, amount, payment-method type and limited card information such as brand and last digits, where provided. Stripe also acts as an independent controller for its own legal obligations, such as fraud prevention, KYC/AML rules and regulatory obligations, under its own Privacy Policy.
4. Sources
We collect data directly from you when you make a booking or contact us, from Stripe for payment processing, from the relevant winery where necessary to manage a booking or complaint, and automatically through Vercel and other essential operational or security systems. The categories of data we receive from these sources include, for example: from Stripe, payment status, transaction reference, amount and limited card information; from the winery, updates relating to the booking, your attendance or any complaint. This information is provided to you no later than the first related communication or handling, in accordance with Article 14 GDPR.
5. Purposes and legal bases
We use data to: (a) perform bookings and provide services, based on contract or pre-contractual steps; (b) process payments, refunds, fraud checks and disputes, based on contract, legal obligations or legitimate interests; (c) provide customer support and handle corporate or group requests, based on contract, pre-contractual steps or legitimate interests; (d) comply with tax, accounting and other legal obligations; (e) host, secure, support, troubleshoot and measure the performance and aggregate use of the Website, based on our legitimate interests; and (f) publish and manage visitor reviews, based on our legitimate interest in operating a reliable review system and informing other users, as described in the "Reviews" section. Where the law requires consent for a particular technology or purpose, processing will take place only after consent has been obtained. For processing based on legitimate interests, a balancing assessment has been carried out, a copy of which may be requested at info@vinosteps.com.
6. Sharing with wineries
To perform a booking, we share only necessary data with the selected winery: name, contact details, date/time, guest number, selected experience, practical requests and relevant booking or payment status. The winery acts as an independent controller for the data it receives, for its own purposes relating to delivery of the experience, venue safety and its own legal compliance. Vinosteps and the winery do not jointly determine the purposes and means of processing and do not act as joint controllers. Vinosteps is responsible for managing the booking, the payment and, where applicable, the refund in case of cancellation; it is not responsible for the winery's actual delivery of the experience, nor for any discrepancy between the booking details and the experience ultimately provided. Each party's obligations are set out in detail in the Winery Partner Terms.
7. Other recipients
Data may be shared with Stripe; Vercel and its authorised subprocessors for hosting, CDN, security, monitoring, logs, performance and, where enabled, cookie-free analytics; email and communication providers; technical partners; accountants; lawyers; advisers; and competent authorities where required. We do not sell personal data.
8. International transfers
Some recipients process data outside the European Economic Area (EEA), specifically: (a) Stripe Payments Europe Ltd (Ireland), as the contracting and invoicing entity for payment processing, which may transfer data to its parent company Stripe, LLC (South San Francisco, CA, USA); (b) Vercel Inc. (Covina, CA, USA), for hosting, CDN, security and monitoring. Transfers to the US are carried out primarily on the basis of the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which Stripe, LLC and Vercel Inc. are actively certified, including for non-HR data (last checked at dataprivacyframework.gov: 8 of August, 2026). In the alternative, and in any event where that adequacy decision ceases to apply or does not cover a particular transfer, transfers are carried out on the basis of the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, as incorporated into our agreements with the above providers, accompanied by a transfer impact assessment where required. You may obtain a copy of the relevant safeguards by sending a request to info@vinosteps.com.
9. Retention
Booking, payment, refund and invoicing records are retained for five (5) years, in accordance with the accounting-record retention rules of Greek Law 4308/2014 and the limitation period for tax assessment under the Greek Tax Procedure Code (Law 4987/2022), subject to any extension provided by law. Support communications are retained for up to 24 months after closure of the request. Unsuccessful corporate or group enquiries are retained for up to 12 months after the last communication. Special-category data is retained in accordance with the "Special-category data" section. Technical data and logs generated through operation of the Website, including IP addresses, are retained for no longer than twelve (12) months, in line with the hosting provider's retention settings. Details of winery representatives and owners entered in the identity-verification form are retained for the duration of the partnership and deleted within three (3) months of its end, unless needed for the establishment, exercise or defence of legal claims. The winery’s billing details are retained for five (5) years, as above. Identity documents are not retained by Vinosteps. After these periods, data is deleted or anonymised, unless retention is necessary for the establishment, exercise or defence of legal claims..
10. Your rights
Subject to GDPR conditions, you may request access, correction, deletion, restriction, portability, object to legitimate-interest processing and withdraw consent. Contact info@vinosteps.com. We may request identity verification.
11. Complaints
You may lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 115 23 Athens, Greece, www.dpa.gr.
12. Special-category data
Vinosteps does not request and does not wish to receive special categories of data within the meaning of Article 9 GDPR, including health data. Please do not enter such information in free-text fields. Where an experience requires disclosure of allergies, dietary restrictions or accessibility needs, this is provided in a dedicated optional field and only after your separate, explicit consent under Article 9(2)(a) GDPR, requested at the point of entry. A booking can be completed without providing such information. Consent may be withdrawn at any time at info@vinosteps.com, without affecting the lawfulness of processing carried out before withdrawal. This information is shared solely with the selected winery to fulfil the request and is deleted within 12 months of the visit date.
13. Data about other individuals
When you book for more than one person or on behalf of a company, you may provide us with third-party data. You confirm you are authorised to do so and undertake to inform those persons of this Policy by sharing its link with them. Vinosteps processes such data solely to perform the booking.
13A. Data of representatives and beneficial owners of partner wineries
This section concerns natural persons connected with a partner winery, namely legal representatives, directors and beneficial owners. To create the winery’s payment account, the winery completes an identity-verification (KYC) form on the “Billing” page of the Vinosteps dashboard with those persons’ details: name, date of birth, nationality, email, telephone, residential address, role/title and ownership percentage, together with the settlement IBAN and its account holder, and, where required, uploads identity documents and other supporting evidence. The form data is transmitted to Stripe for verification and is also stored by Vinosteps, so that the winery can view and update it through the dashboard. Identity documents and other supporting evidence are transmitted directly to Stripe and are not stored by Vinosteps. Stripe acts as an independent controller for identity verification and its compliance with anti-money-laundering legislation, under its own Privacy Policy. Vinosteps processes the form data to create and maintain the winery’s payment account, settle bookings and issue invoices, based on its and the winery’s legitimate interest in performing the contract between them (Article 6(1)(f) GDPR). Access to this data is limited to the winery’s authorised users and to the necessary Vinosteps staff. From Stripe we receive only the account identifier and the verification status. The data is obtained from the winery and not directly from the persons concerned; the winery must inform them of this Policy. Retention periods are set out in the “Retention” section.
14. Minors and alcohol
Bookings must be made by an adult with legal capacity. Minors may attend only where permitted by the winery. Alcohol is served only to persons meeting the legal drinking-age requirement. Where a minor attends a booking, we may process limited data about them (e.g. name, dietary needs) in the context of the contract entered into by the adult who made the booking, rather than on the basis of the minor's own consent. Article 21 of Law 4624/2019, which sets age 15 as the age of valid consent for a minor in relation to information-society services, does not apply here, as this processing is not based on the minor's consent.
15. Automated decision-making
We do not make decisions producing legal effects concerning you, or significantly affecting you, based solely on automated processing, nor do we carry out profiling within the meaning of Article 22 GDPR. Should this change, this Policy will be updated before such processing begins.
16. Mandatory nature of providing data
Information marked as mandatory during booking is necessary to enter into and perform the contract. If it is not provided, the booking cannot be completed. Other information is optional and its omission has no consequences.
17. Reviews
If you submit a review after your visit, we publish its content, the date and your first name with the initial of your surname (for example "Andreas P."), based on our legitimate interest in operating a reliable review system and informing other users. We do not publish your email address or other contact details. We publish only reviews linked to a confirmed and completed booking. You may object to publication, or request correction or deletion of your review, at any time at info@vinosteps.com. The winery is entitled to publish one public reply per review.
18. Commercial communications
If you choose to subscribe to a newsletter or other commercial communications, these are sent based on your consent, in accordance with Article 11 of Greek Law 3471/2006. Existing customers may receive commercial communications about similar products or services without prior consent (“soft opt-in”), with an explicit right to object in every message, free of charge. You may unsubscribe at any time via the unsubscribe link in each message or at info@vinosteps.com.
19. Security
We apply appropriate technical and organisational safeguards against unauthorised access, loss, alteration or disclosure. No internet transmission can be guaranteed to be completely secure.
20. Cookies
The Website uses necessary cookies and technologies, placed without prior consent under Article 4(5) of Greek Law 3471/2006, as well as statistics and marketing cookies, placed only with your consent. Full details of the categories, the consent mechanism and the cookie table are set out in the separate Cookie Policy, accessible from every page of the Website.
21. Data Protection Officer
Vinosteps has assessed the criteria of Article 37 GDPR and is not required, as at the date of this Policy, to appoint a Data Protection Officer. For any data-protection matter: info@vinosteps.com.
22. Language precedence
This Policy is drawn up in Greek and English. In the event of any discrepancy between the two versions, the Greek version shall prevail.
23. Changes
We may update this Policy when services, providers or legal requirements change. The current version will be published on the Website.