Privacy Policy

Data Privacy Policy of Vino Tasting

vino-tasting.com | UK operator with the United States as its primary market

Prepared 1 October 2026

Publication status: complete the bracketed fields and validate the operational statements before publication. The research and implementation appendix is for management and must not be published as part of the customer notice.

1 Who we are and how to contact us

Vino Tasting is the trading name of [FULL UK REGISTERED COMPANY NAME], registered in [ENGLAND AND WALES / SCOTLAND / NORTHERN IRELAND] under company number [NUMBER], with its registered office at [FULL ADDRESS]. This company is the controller responsible for the personal data described in this policy. References to "we", "us" and "our" mean this company.

Privacy enquiries and complaints: [MONITORED PRIVACY EMAIL]. Postal contact: [PRIVACY CONTACT ADDRESS]. Telephone: [CONTACT NUMBER]. EU representative, where required: [NAME, POSTAL ADDRESS AND EMAIL]. Data Protection Officer, only if appointed: [CONTACT DETAILS OR REMOVE THIS SENTENCE].

This policy explains how we use personal data when you browse our website, buy wine, receive a gift, contact us, or use customer accounts and Wine Club services where available. Separate notices apply to recruitment or other activities outside this scope.

Our UK operations are subject to the UK GDPR and Data Protection Act 2018, as amended, including applicable changes made by the Data (Use and Access) Act 2025. These protections can apply to our processing of US customers' data too. EU GDPR and US state privacy laws apply where their respective scope conditions are met. Sections 16 to 18 explain US-specific matters. Reading this notice or using the website does not itself give consent to optional marketing or tracking.

2 Personal data we collect

Identity and contact information: your name, email, telephone number, billing and delivery addresses, and company details where relevant.

Age information: your date of birth where needed, evidence used to establish eligibility, and a limited verification result or reference.

Purchase and account information: account credentials stored in protected form, orders, invoices, delivery instructions, returns, payment status and references, saved wines, preferences, and Wine Club selections, renewals, pauses and cancellations where available.

Communications and device information: messages, support records, reviews you submit, consent choices, IP address, browser and device information, security logs and, where permitted, browsing and interaction information. Please do not put health information, passport copies or payment card details in ordinary messages or delivery notes.

How we use personal data

3 Where information comes from

We receive information directly from you, from website interactions, and from service providers involved in payments, verification, fulfilment and support. A purchaser may provide your name, address, contact details and gift message when sending you wine. Payment providers may return payment status and fraud indicators; couriers may return delivery and age-check results. [IDENTIFY THE ACTUAL AGE VERIFICATION PROVIDER, ITS DATA SOURCES AND ANY OTHER INDIRECT SOURCES BEFORE PUBLICATION].

Where we obtain information about you from someone else, we provide the relevant privacy information within the period required by law, generally no later than one month, or earlier at our first communication with you or first disclosure, unless a lawful exception applies. Gift recipients are not automatically added to marketing lists.

4 Purposes and legal bases

Orders and accounts. We use identity, contact, order and payment information to take steps you request before purchase, process and deliver orders, manage your account, handle returns and administer Wine Club services. The basis is performance of our contract with you. Required checkout fields are marked; without essential details, we cannot complete an order.

Gift deliveries. We use a recipient's contact and delivery information in our legitimate interests in fulfilling the purchaser's gift order and resolving delivery issues. We limit this use to what the recipient would reasonably expect; the recipient is not treated as a party to the purchaser's contract.

Legal responsibilities. We process necessary records for applicable tax, accounting, alcohol age restrictions, regulatory enquiries and other binding obligations. The basis is legal obligation where the relevant obligation meets the requirements of the applicable GDPR regime. Our country-specific age controls are explained in section 5.

Security and disputes. We use relevant account, transaction, device and communication information in our legitimate interests in preventing fraud, protecting the service, investigating misuse and establishing or defending legal claims. We balance these interests against your rights. Where a binding disclosure duty applies, we rely on legal obligation instead.

Customer assistance. Contract-related support is necessary to perform the contract. General enquiries and service administration are handled in our legitimate interests in responding to customers and improving support. We do not treat every business purpose as automatically justified by legitimate interests.

Optional marketing and personalisation. Under the approach described in section 6, we use your consent for promotional email, SMS or WhatsApp messages and optional personalised marketing. You can withdraw it without affecting your purchases. Optional tracking and related analytics rely on consent under section 7.

Records of choices and requests. We keep proportionate evidence of consent, withdrawals and responses to rights requests to demonstrate compliance. We retain a minimal suppression record in our legitimate interests in respecting marketing objections. Any new, incompatible purpose requires a fresh assessment and notice before use.

Age checks and your choices

5 Alcohol age restrictions and verification

For United States orders, purchasers and recipients must be at least 21. For orders in the United Kingdom, Italy and France, purchasers must be at least 18 and we require an adult recipient. We apply the threshold appropriate to the transaction and destination. Our service is not directed to children. The age rules for consenting to some online services do not lower the age for buying alcohol.

To prevent underage sales, we verify age through [DESCRIBE ACTUAL CHECKOUT AND DELIVERY PROCESS, PROVIDER AND ACCEPTED EVIDENCE]. We may require further evidence before accepting or delivering an order. If we cannot establish eligibility, we may decline or pause the transaction and explain how to request a review. A payment card or self-declaration is not treated as conclusive proof of age.

We seek to retain only necessary evidence, such as a 21+ or 18+ eligibility result, check date, method and transaction reference, rather than a full identity document. [CONFIRM WHETHER ANY PARTY CAPTURES ID IMAGES, SELFIES OR BIOMETRIC DATA; IF SO, ADD ITS ROLE, PURPOSE, LEGAL BASIS, RETENTION AND SAFEGUARDS BEFORE USE]. Please use only the secure verification channel we identify.

Checks needed to satisfy applicable legal duties rely on legal obligation. Any additional fraud or eligibility checks require a documented lawful basis under the applicable regime. We do not use age-verification information for advertising. If we discover a child's account or an ineligible order, we restrict the activity and remove information that is unnecessary, retaining only records needed for legal or protective purposes.

6 Marketing and recommendations

We send promotional messages only through the channels you have chosen. Consent is optional, specific and separate from acceptance of sales terms. You may unsubscribe using the link in an email, the opt-out method in a message, or our privacy contact. Withdrawal does not affect earlier lawful processing. Essential order, delivery, safety and subscription administration messages may continue.

Where you choose personalised marketing, we may use your stated wine preferences, saved items and purchase history to suggest relevant bottles or offers. Optional browsing-based personalisation requires the relevant tracking choice as well. [CONFIRM ENABLED PERSONALISATION; REMOVE UNUSED FEATURES]. We do not enrol gift recipients or import another business's customer list into marketing merely because the businesses share an owner.

7 Cookies and similar technologies

Necessary technologies support functions such as the basket, sign-in, security and remembering your privacy choices. Under our chosen cross-market approach, optional analytics, advertising pixels and similar tracking remain off until you consent. Rejecting optional tracking does not prevent a purchase. You can change or withdraw choices through [COOKIE SETTINGS LINK].

Our Cookie Policy at [LINK] lists the actual technologies, providers, purposes and lifetimes. Consent controls offer an equally accessible way to accept or reject optional categories. [CONFIRM EMAIL OPEN TRACKING, ADVERTISING AUDIENCES AND EMBEDDED CONTENT; DISCLOSE AND CONFIGURE ANY THAT ARE ENABLED].

Sharing and overseas processing

8 Who receives personal data

We share only information needed for the purposes described here with authorised staff and relevant service providers. These include website hosting and maintenance, payment processing, age verification, warehousing, delivery, customer support, email delivery, accounting and security services. Optional marketing and analytics providers receive information only in line with your choices and the applicable legal basis.

Some providers process information on our documented instructions under data-processing agreements. Others, such as certain payment providers, carriers or professional advisers, may act as independent controllers for their own legal or operational purposes. Their own notices explain those activities. A provider's independent role does not remove our responsibility for disclosures we make.

Key providers and roles: [INSERT ACTUAL PAYMENT, HOSTING, AGE VERIFICATION, COURIER, CRM, EMAIL AND ANALYTICS PROVIDERS, WITH PRIVACY LINKS; INCLUDE ONLY THOSE USED]. For saved payment methods, explain here whether a provider stores card details and whether we receive only a token and limited card information: [CONFIRM PAYMENT DATA FLOW].

We may disclose relevant information to regulators, law enforcement, courts, insurers and professional advisers where legally required or justified for a specific lawful purpose. If our business is sold or reorganised, limited information may be shared under confidentiality safeguards, and any successor must use it consistently with applicable law and the notices given to you.

Public reviews you choose to submit may be visible to other people under the display name shown to you. [REMOVE IF REVIEWS ARE NOT ENABLED]. We do not give suppliers permission to market unrelated products to you merely because they help fulfil an order. [CONFIRM AND DISCLOSE ANY SEPARATE DATA SALE, ADVERTISING SHARING OR JOINT MARKETING ARRANGEMENTS].

9 International transfers

Our UK company and some service providers may process information in countries other than the one where you live. Overseas remote access can also involve a transfer. Locations and arrangements used by our service providers are: [INSERT ACTUAL COUNTRIES AND APPLICABLE TRANSFER MECHANISMS].

Where the relevant transfer is covered by an applicable adequacy decision or UK adequacy regulations, we may rely on that arrangement. Where it is not, we use an appropriate lawful safeguard, such as European Commission Standard Contractual Clauses for restricted EU transfers or the UK International Data Transfer Agreement or UK Addendum for restricted UK transfers, with required assessments and supplementary measures.

We check that the mechanism covers the particular recipient and transfer. A supplier's general claim to be "GDPR compliant" is not a transfer safeguard. Contact us for information about the safeguards relevant to your data or a copy, subject to lawful redactions. We do not rely on your general acceptance of this policy as consent to unrestricted overseas transfers.

Retention and protection

10 How long we retain information

We retain personal data for the period needed for its stated purpose and applicable legal requirements, then delete or irreversibly anonymise it. The schedule below must reflect our implemented retention controls. A legal hold may extend the relevant period for an investigation or claim; access is then restricted to that purpose.

Retention periods differ by record type and obligation. We do not apply another retailer's seven-year or ten-year rule to every customer record. You can ask us which period applies to a particular item of information.

11 Keeping information secure

We use technical and organisational controls proportionate to the risks, including access restrictions, secure administration, appropriate encryption, staff confidentiality obligations and supplier oversight. [VALIDATE THESE CONTROLS AGAINST THE LIVE SERVICE]. No system can guarantee absolute security. We investigate suspected breaches and notify regulators and affected people where legally required.

Protect your account password and contact us promptly if you suspect unauthorised access. Please do not email complete card numbers, identity documents or sensitive information unless we have specifically arranged a secure method.

Your rights and complaints

12 Your data protection rights

Subject to the conditions and exceptions in the applicable law, you may ask to access your personal data, correct inaccurate or incomplete information, erase information, restrict its use, or receive eligible information in a portable format. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You may object to processing based on legitimate interests because of your particular circumstances. We will stop unless we can demonstrate a lawful overriding reason or need the information for legal claims. Your right to object to direct marketing, including related profiling, is absolute: we will stop that use.

Send requests to [PRIVACY EMAIL] or the postal address in section 1. We may ask for proportionate information to verify identity or clarify the request. We normally respond within one month, subject to applicable timing rules. If a lawful extension is necessary, we explain the reason within the initial period. Requests are normally free; fees or refusals are used only where the law permits, with an explanation and information about challenge rights.

Deletion of an account does not automatically erase invoices or other records we are legally required to retain. Where French law applies, you may also give instructions concerning the retention, deletion and communication of your personal data after death.

13 Automated decisions

[CONFIRM THE ACTUAL POSITION BEFORE PUBLICATION: We do not make decisions with legal or similarly significant effects on you solely through automated processing. Automated age or fraud flags can be referred to a person with authority to reconsider the result by contacting [CONTACT].]

If any significant solely automated decision is used, replace the preceding paragraph with a specific explanation of the system, principal factors, significance, consequences, lawful basis and applicable rights to human intervention, to express your view and to contest the decision. Optional wine recommendations are separate from eligibility or payment decisions.

14 Complaints

You can complain about our handling of your personal data using [PRIVACY EMAIL / COMPLAINT FORM LINK] or the postal contact in section 1. We acknowledge receipt within 30 days, investigate without undue delay, keep you informed of progress and communicate the outcome.

You may also complain to the UK Information Commissioner's Office at ico.org.uk. Where EU GDPR applies, you may complain to the competent supervisory authority, including the authority where you habitually live or work or where the alleged infringement occurred. In Italy this is the Garante per la protezione dei dati personali at garanteprivacy.it; in France it is the CNIL at cnil.fr. Contacting us does not remove your rights to complain to an authority or seek a judicial remedy.

15 Changes to this policy

We update this notice when our practices or legal requirements change. The effective date at the beginning identifies the current version. We notify you appropriately about material changes and obtain fresh consent where required. New wording alone does not authorise a previously undisclosed use of your data.

United States privacy supplement

16 US customer rights and choices

This supplement explains additional rights available where a US state privacy law applies to our activities. Eligibility and exemptions differ by state. It does not limit protections that apply to our UK processing under sections 1 to 15. References to statutory US rights are subject to the law's coverage; they are not a claim that every state law applies to every customer.

Depending on applicable law, you may request confirmation of processing, access to and a portable copy of personal information, correction, deletion, and information about recipients or disclosures. You may also opt out of sales, targeted advertising or sharing for cross-context behavioural advertising, and certain profiling with legal or similarly significant effects. Where applicable, you may limit particular uses of sensitive information or withdraw consent. We will not unlawfully discriminate against you for exercising your rights.

Submit requests through [PRIVACY REQUEST FORM] or [PRIVACY EMAIL]. [ADD TOLL-FREE NUMBER UNLESS A VALID ONLINE-ONLY EXCEPTION APPLIES]. We use proportionate identity checks for requests involving access, correction or deletion; a sale or advertising opt-out does not require a verified account. An authorised agent may act for you, subject to proof of authority and any direct confirmation the applicable law permits.

For covered California requests to know, correct or delete, we acknowledge receipt within 10 business days and normally respond within 45 calendar days; a permitted extension is explained within the original period. Sale or sharing opt-outs and eligible sensitive-information limitations are implemented as soon as feasibly possible and within the applicable limit, generally no later than 15 business days in California. Where UK GDPR also applies, we meet its applicable deadline rather than using a longer US period to delay that response.

If we deny a request, we explain the reason and any applicable appeal right. Submit an appeal to [EMAIL OR FORM] with the subject "Privacy appeal". We review it within the period required by your state law and explain the result and how to contact the relevant state authority if the appeal is denied. [SET AND PUBLISH ANY STATE-SPECIFIC APPEAL PERIODS REQUIRED FOR THE LAUNCH MARKETS].

Sale, sharing and targeted advertising

[COMPLETE FROM THE ACTUAL DATA AUDIT: State whether Vino Tasting sells personal information, shares it for cross-context behavioural advertising, or processes it for targeted advertising; identify the categories, purposes and recipients for each activity.] Advertising disclosures can count as a sale or sharing even if no money changes hands. A statement that we "do not sell data for money" does not answer that question.

Where the relevant activity occurs, exercise your choice through [DO NOT SELL OR SHARE MY PERSONAL INFORMATION / YOUR PRIVACY CHOICES LINK]. We honour qualifying opt-out signals such as Global Privacy Control where required. [CONFIRM SIGNAL IMPLEMENTATION AND EXPLAIN ITS BROWSER, DEVICE AND ACCOUNT SCOPE]. We do not knowingly sell or share information about people under 16. [VALIDATE THIS STATEMENT].

US collection and disclosure notice

17 Categories and retention

The completed table describes information collected during the preceding 12 months, or since launch if shorter. Sources are described in section 3, purposes in section 4 and retention in section 10. Confirm every category and its disclosure, sale and sharing status before publishing. Do not label data "not collected" merely because a service provider collects it on our behalf.

Sensitive information is used for [INSERT ACTUAL LIMITED PURPOSES]. [CONFIRM WHETHER ANY USE TRIGGERS A RIGHT TO LIMIT; IF SO, ADD THE REQUIRED LINK AND EXPLANATION]. We seek to minimise identity evidence and do not require a Social Security number for an ordinary wine purchase. [VALIDATE].

We provide a short notice at or before collection, with a link to this policy, the relevant categories and purposes, retention information, and sale or sharing choices where required. [CONFIRM LEGACY DO NOT TRACK RESPONSE AND ANY THIRD-PARTY CROSS-SITE COLLECTION; DISTINGUISH THIS FROM GLOBAL PRIVACY CONTROL].

US fulfilment and communications

18 Delivery partners and marketing

US orders involve [IDENTIFY SELLER OF RECORD, LICENSED IMPORTER OR RETAILER, FULFILMENT COMPANY AND COURIER, AS APPLICABLE]. We disclose necessary identity, contact, order and delivery information for authorised fulfilment, import formalities, tax records and age checks. The relevant partners' roles and notices are listed in section 8. Where a partner is an independent controller, it is responsible for its own stated processing; this does not exclude our responsibilities.

US delivery requires a recipient aged 21 or over under our delivery terms, with [DESCRIBE ACTUAL ID CHECK AND ADULT SIGNATURE SERVICE]. We receive [SPECIFY SIGNATURE, DELIVERY RESULT AND VERIFICATION DATA ACTUALLY RETURNED]. Shipping availability is determined by destination and the authorised fulfilment arrangement, not solely by the age or location of the purchaser.

Our promotional email approach uses the consent choices in section 6. Messages identify the sender, provide a valid postal address and a clear unsubscribe method. We honour US commercial email opt-outs within 10 business days and sooner where another applicable rule requires it. Essential transaction notices are kept distinct from promotional campaigns.

If US promotional text messaging is introduced, we obtain any required prior express written consent through a separate enrolment process and provide channel-specific terms and opt-out instructions. Consent to marketing texts is not a condition of purchase. [REMOVE UNTIL ENABLED OR INSERT THE ACTUAL PROGRAM DETAILS].

If a loyalty offer or discount involves a financial incentive connected to collecting, selling or retaining personal information, we provide any required separate notice explaining the terms, relevant data, participation and withdrawal, and valuation method before enrolment. [CONFIRM WHETHER ANY SUCH PROGRAM EXISTS].

Review of US supplement

We review this supplement at least annually where required and sooner if material practices change. Last reviewed: [PUBLICATION REVIEW DATE]. California residents may also contact us about any applicable rights concerning disclosures to third parties for their own direct marketing. [CONFIRM SUCH DISCLOSURES AND THE RELEVANT RESPONSE PROCESS].

Research and implementation appendix

Management and legal review only | Research checked 1 October 2026

Age restrictions for online wine purchases

Recommended operating standard: use a destination-aware 21+ US / 18+ UK Italy France checkout statement, reliable purchase-age checks and age-checked delivery. Agree refusal and return handling; avoid unattended delivery where it defeats the control. This is not a claim that every market mandates the same process. Challenge 25 is a checking threshold, not a purchase age of 25.

Privacy framework for the UK operator

GDPR is a regulation, not one universal "GDPR Act". The UK framework includes UK GDPR, the Data Protection Act 2018 and PECR, as amended by applicable provisions of the Data (Use and Access) Act 2025. EU GDPR can also apply when a UK business offers goods to people in the EEA. Italy supplements it with its Privacy Code; France with the Loi Informatique et Libertés. [4–8]

For regular sales into Italy and France, assess the need for an EU representative under Article 27; a UK company without an EEA establishment generally needs one unless a narrow exception applies. A representative is not the same as a Data Protection Officer. Do not assume an Italian supplier or the founder's residence establishes an EU office for the UK company. [9]

The draft deliberately uses consent for electronic promotions and optional tracking across these markets. Some local exemptions exist, but they should be adopted only after their conditions are checked. Privacy policy acceptance must not be used as blanket marketing consent. [10–12]

Alcohol licensing, excise, VAT, customs, destination restrictions and advertising require separate review. This notice does not authorise international alcohol sales. The USA is the primary market for this draft; the applicable state list must match the actual seller and shipping arrangement, not a generic list of places where wine delivery exists.

US launch assessment

Coverage does not depend only on company size

The CCPA as amended applies to qualifying businesses doing business in California when a revenue, data-volume or sale-and-sharing revenue threshold is met; it can also cover certain related entities. Assess the current inflation-adjusted revenue threshold and all alternative tests. Being below the revenue threshold alone does not prove exemption. [27]

Other states apply different thresholds and exceptions. Colorado provides access and opt-out rights and universal opt-out mechanisms. Texas has a different scope model, including provisions affecting certain small-business sensitive-data sales. Assess each actual destination and audience; California-only analysis is insufficient. General privacy notices, security, breach response and marketing obligations may remain even where a comprehensive state law does not apply. [28–30]

Advertising requires an explicit decision

For a lean launch, the recommended approach is to leave cross-site advertising pixels, customer-list audience uploads, session replay and unnecessary profiling disabled until mapped and reviewed. If enabled, identify whether each transfer is a sale, sharing or targeted advertising, implement opt-outs and qualifying browser signals, and update the notice. Consent-only cookies do not automatically satisfy every US opt-out duty. [27–29]

Confirm the actual import and delivery chain

Obtain the shipping partner's legal name, licensed importer and seller roles, permitted destination states and ZIP codes, licence conditions, adult-signature service and data practices. Establish who accepts the order, receives payment, imports, invoices and fulfils it. A courier's ability to move a parcel is not proof that Vino Tasting can lawfully sell to that destination. TTB directs businesses to check individual state shipping laws. [26]

Additional US retailer benchmarks

Wine.com publishes a state-rights process including appeals, and its shipping page calls for a recipient aged 21 or over to sign. Total Wine's indexed notice links privacy choices and a sale-or-sharing opt-out. These are useful design examples, not evidence that Vino Tasting has the same legal coverage or processing practices. [31–33]

Priority implementation work

Before accepting US orders, validate the permitted-state matrix, 21+ verification and delivery controls, named controller and vendor disclosures, and payment and shipping records. Before paid advertising, test sale-and-sharing opt-outs, Global Privacy Control and deletion propagation. Before SMS campaigns, review TCPA and state messaging requirements. US email must also meet CAN-SPAM rules. [26–30, 34–35]

The policy remains a review draft until the bracketed facts are completed. A US privacy and alcohol-commerce legal review should cover the chosen states and fulfilment structure. The policy cannot compensate for a checkout or delivery process that contradicts it.

Retailer comparison and launch checks

Representative public website review

Together with the US examples, this review covers seven retailers across four markets. It is not exhaustive or a checkout test. Tannico's policy URL was found, but substantive text was not retrievable and is not used as evidence. Laithwaites and Total Wine observations are limited to indexed extracts.

Complete before publishing

1. Company owner: insert the UK legal name, registration details, address, monitored privacy contact and effective date. Confirm EU representative arrangements and whether a DPO is required or appointed.

2. Developer and suppliers: map actual data flows, vendors, remote support access and hosting countries. Confirm payment tokens, Wine Club functionality, tracking, AI tools and automated decisions. Execute appropriate processor contracts and transfer safeguards. Remove unused features from the notice.

3. Operations: agree checkout and courier age checks and evidence retention. A self-declared birthday is not a complete assurance process. Assess privacy risks before any ID scanning, facial estimation or biometric identification. [18]

4. Privacy owner and accountant: approve retention periods and deletion jobs. Set up rights-request handling and the complaint process, including acknowledgement within 30 days. Test marketing withdrawals and suppression. [19–21]

5. Legal reviewer: validate the completed notice against the implemented service. Publish consistent Italian and French versions for those audiences, a separate accurate Cookie Policy and age/delivery terms. Test that optional trackers stay blocked until consent and remain blocked after rejection.

Source register

Primary rules and guidance support the legal framework. Retailer pages are comparison material only. URLs were researched on 1 October 2026; where access was limited, this is stated in the comparison.

1 UK purchase age GOV.UK Alcohol and young people
https://www.gov.uk/alcohol-young-people-law

2 Italy purchase age Polizia di Stato guidance on the under-18 sales ban and identity checks
https://questure.poliziadistato.it/it/Teramo/articolo/5730de66bd36e794658214

3 France purchase age Code de la santé publique Article L3342-1
https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000031927682

4 EU framework Regulation EU 2016/679 Articles 3 6 12 to 22 27 and Chapter V
https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

5 UK reforms ICO Data Use and Access Act 2025
https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/

6 UK and EU scope ICO Receiving personal information from the EEA
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/

7 Italy privacy and cookies Garante Linee guida cookie e altri strumenti di tracciamento
https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876

8 France privacy framework CNIL La loi Informatique et Libertés
https://www.cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes

9 EU representative ICO territorial scope guidance including EU representatives
https://ico.org.uk/media2/migrated/4031113/ic-327905-y2y5-knowledge-hub-territorial-scope.pdf

10 Marketing ICO Guidance on direct marketing using electronic mail
https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/

11 Cookie choices CNIL Refuser les cookies doit être aussi simple qu'accepter
https://www.cnil.fr/fr/refuser-cookies-doit-etre-aussi-simple-accepter-cnil-poursuit-action-adresse-mises-en-demeure

12 Lawful basis ICO A guide to lawful basis
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/

Further sources

13 Majestic Wine UK Privacy policy and age processing
https://www.majestic.co.uk/information/privacy-policy

14 Laithwaites UK Privacy and cookies indexed notice
https://www.laithwaites.co.uk/help/privacy-and-cookies

15 Callmewine Italy Privacy policy
https://www.callmewine.com/privacy

16 Vinatis France Personal data protection policy
https://www.vinatis.com/protection-des-donnees

17 Millésima France Terms including privacy and protection of minors
https://www.millesima.fr/cgv.html

18 Age assurance EDPB Statement 1 of 2025 on age assurance
https://www.edpb.europa.eu/system/files/2025-04/edpb_statement_20250211ageassurance_v1-2_en.pdf

19 Retention ICO Storage limitation
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/

20 Rights response periods ICO A guide to subject access
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

21 Complaints ICO How to deal with data protection complaints
https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/

22 Transparency ICO What privacy information should we provide
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/

23 Transfers ICO International transfers
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/

24 French posthumous rights CNIL Mort numérique
https://www.cnil.fr/fr/mort-numerique-effacement-informations-personne-decedee

United States sources

25 US purchase age FTC 21 is the Legal Drinking Age
https://consumer.ftc.gov/articles/0386-21-legal-drinking-age

26 Shipping compliance TTB Maintaining compliance as an alcohol importer exporter or wholesaler
https://www.ttb.gov/business-central/maintaining-compliance-as-an-alcohol-importer-exporter-or-wholesaler

27 California coverage and rights California Privacy Protection Agency FAQs
https://cppa.ca.gov/faq.html

28 California privacy California Attorney General CCPA guidance
https://oag.ca.gov/privacy/ccpa

29 Colorado privacy Colorado Attorney General Colorado Privacy Act
https://coag.gov/resources/colorado-privacy-act/

30 Texas privacy Texas Attorney General Data Privacy and Security Act
https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act

31 Wine.com privacy Privacy policy and state request appeals
https://www.wine.com/content/colophon/privacy-policy

32 Wine.com delivery Adult signature and shipping practices
https://www.wine.com/content/customer-care/shipping

33 Total Wine privacy Indexed privacy notice and privacy choices
https://www.totalwine.com/customer-service/privacy-policy

34 US email FTC CAN-SPAM compliance guide
https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business

35 US text messages FCC Stop unwanted robocalls and texts
https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts