1. Introduction
This Privacy Policy explains how Vinatrex Artisan Farm ("Vinatrex", "we", "us", or "our") collects, processes, stores, and protects the personal data of individuals ("you" or "your") who visit our website at www.vinatrex.ie, purchase our products, subscribe to our communications, or otherwise engage with our business.
Vinatrex Artisan Farm is the data controller responsible for your personal data. We are a sole trading entity registered in Ireland and operating from 12 Main Street, Clonakilty, Co. Cork, P85 HX67, Ireland. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018, and the ePrivacy Directive (2002/58/EC) as transposed into Irish law.
By using our website or providing personal data to us, you acknowledge that you have read and understood this policy. If you do not agree with any aspect of this policy, please refrain from using our website or submitting personal data to us. We encourage you to read this document carefully, as it contains important information about your rights and our obligations regarding data protection.
2. What Data We Collect
We may collect and process the following categories of personal data, depending on how you interact with our website and services:
- Identity Data: Your first name, last name, and any title or prefix you provide when filling out forms on our website.
- Contact Data: Your email address, telephone number, and postal address, provided when you place an order, make an enquiry, or subscribe to our newsletter.
- Technical Data: Your Internet Protocol (IP) address, browser type and version, operating system, device type, screen resolution, time zone setting, and browser plug-in types.
- Usage Data: Information about how you use our website, including pages visited, time spent on each page, navigation paths, click patterns, and referring URLs.
- Communication Data: The content of messages you send us through our contact form, by email, or by telephone, along with metadata such as date and time of the communication.
- Transaction Data: If you purchase products from us, we may collect details about the transaction including items ordered, quantities, delivery address, and order history. Payment card details are handled exclusively by our third-party payment processor and are never stored on our servers.
- Cookie Data: Information collected through cookies and similar technologies, including session identifiers, preferences, and browsing behaviour. See Section 10 for full details.
We do not collect any special category data (also known as sensitive personal data), such as information about your health, ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or biometric data.
3. How We Collect Data
We collect personal data through the following methods:
- Direct interactions: When you fill out our contact form, subscribe to our email updates, place an order for cheese products, enquire about wholesale opportunities, or request a farm visit, you provide us with identity and contact data directly.
- Automated technologies: As you navigate our website, we automatically collect technical data and usage data through cookies, server logs, and similar tracking technologies. Our web server records standard log information including your IP address, the pages you request, and timestamps for each visit.
- Analytics tools: We use Google Analytics to understand how visitors use our website. Google Analytics collects data about your device, browser, location (at city level), and browsing behaviour on our site. This data is aggregated and anonymised where possible. Google Analytics sets cookies on your device to facilitate this data collection.
- Social media: If you engage with our content on social media platforms or follow links from those platforms to our website, the relevant platform may share limited data with us such as your profile name or the fact that you clicked a link. We may also use Meta Pixel on our website to measure the effectiveness of our advertising campaigns on Facebook and Instagram. The Meta Pixel collects data about your browsing actions on our website and sends this to Meta Platforms Ireland Limited.
- Email communications: If you subscribe to our newsletter, we may track whether you open our emails and which links you click, using standard email tracking technologies. This helps us understand which content is most relevant to our subscribers.
4. Why We Collect Data (Legal Basis)
Under Article 6 of the GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases depending on the specific purpose of processing:
- Consent (Article 6(1)(a)): We rely on your explicit consent to send you marketing emails, set non-essential cookies on your device, and use analytics and advertising tracking tools such as Google Analytics and Meta Pixel. You may withdraw your consent at any time, and we provide clear mechanisms for doing so.
- Contract performance (Article 6(1)(b)): Where you place an order for our cheese products or request a service from us, we process your identity, contact, and transaction data as necessary to fulfil that contract, including processing your order, arranging delivery, and handling returns or complaints.
- Legitimate interests (Article 6(1)(f)): We process certain data based on our legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include improving our website and services, understanding customer preferences, maintaining the security of our website, and responding to enquiries submitted through our contact form.
- Legal obligation (Article 6(1)(c)): We may process your data where necessary to comply with a legal obligation, such as maintaining financial records for tax purposes under Irish Revenue requirements or responding to lawful requests from regulatory authorities.
5. How We Use Data
We use the personal data we collect for the following purposes:
- Service delivery: To process and fulfil orders for our artisan cheese products, manage your account if applicable, arrange delivery, and provide post-purchase support including handling questions about our cheeses or resolving any issues with your order.
- Communication: To respond to enquiries submitted through our website contact form, by email to [email protected], or by telephone. We aim to respond to all enquiries within one business day.
- Marketing: To send you newsletters, product updates, and promotional offers about our cheese varieties, farm events, and seasonal specials, but only where you have given us your explicit consent to do so. Every marketing email includes an unsubscribe link, and you can opt out at any time.
- Website improvement: To analyse how visitors use our website, identify popular content, detect technical issues, and improve the overall user experience. This processing typically involves aggregated and anonymised data.
- Advertising measurement: To measure the performance of our advertising campaigns on platforms such as Facebook and Instagram, understand which advertisements lead to visits or purchases, and optimise our marketing spend.
- Security: To protect our website against fraud, unauthorised access, and other security threats. This includes monitoring for suspicious activity and maintaining server logs.
- Legal compliance: To comply with applicable laws, regulations, and legal processes, including maintaining financial records and responding to lawful data access requests.
6. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The specific retention periods for different categories of data are:
- Contact form submissions: We retain the data you provide through our contact form for a period of 2 years from the date of your enquiry, after which it is securely deleted.
- Order and transaction data: We retain records of purchases and transactions for 7 years from the date of the transaction, as required by Irish tax and accounting regulations.
- Newsletter subscriber data: We retain your email address and subscription preferences for as long as you remain subscribed. If you unsubscribe, we delete your data within 30 days, retaining only a record of your email address on our suppression list to ensure we do not contact you again.
- Website analytics data: Data collected through Google Analytics is retained for 14 months from the date of collection, after which it is automatically deleted by Google.
- Cookie data: The retention period for cookies varies by type. Essential cookies expire at the end of your browsing session. Analytics cookies are retained for up to 13 months. Advertising cookies are retained for up to 12 months. See Section 10 for more detail.
- Server logs: Our web server logs, which contain IP addresses and page request data, are retained for 90 days and then automatically purged.
When the retention period expires, we securely delete or anonymise your personal data so that it can no longer be associated with you.
7. Data Sharing
We do not sell, rent, or trade your personal data to any third party. We may share your data with the following categories of recipients, strictly for the purposes described in this policy:
- Hosting provider: Our website is hosted on servers located within the European Economic Area (EEA). Our hosting provider processes technical data and server logs on our behalf under a data processing agreement.
- Analytics provider: We use Google Analytics, operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to collect and analyse website usage data. Google acts as a data processor on our behalf.
- Advertising platform: If you have consented to advertising cookies, data about your browsing activity may be shared with Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) through the Meta Pixel to measure advertising effectiveness.
- Payment processor: If you make a purchase, your payment information is processed directly by our payment processor under their own privacy policy. We do not receive or store your full payment card details.
- Delivery partners: If you order products for delivery, we share your name, delivery address, and phone number with our delivery partner to fulfil your order.
- Professional advisors: We may share data with our accountant, legal counsel, or other professional advisors where necessary, subject to professional confidentiality obligations.
- Legal authorities: We may disclose your data to law enforcement or regulatory authorities if required to do so by law, or if we reasonably believe that disclosure is necessary to protect our rights, your safety, or the safety of others.
All third parties that process personal data on our behalf are bound by data processing agreements that require them to protect your data in accordance with the GDPR and to use it only for the specific purposes we instruct.
8. International Transfers
We strive to keep your personal data within the European Economic Area (EEA) wherever possible. Our website hosting and primary service providers are based within the EEA.
However, some of our third-party service providers, particularly Google (for Google Analytics), may transfer data outside the EEA to countries such as the United States. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your personal data, including:
- European Commission adequacy decisions: Where the destination country has been determined by the European Commission to provide an adequate level of data protection.
- Standard Contractual Clauses (SCCs): Where no adequacy decision exists, we rely on Standard Contractual Clauses approved by the European Commission, which contractually require the recipient to protect your data to EEA standards.
- EU-U.S. Data Privacy Framework: Where applicable, transfers to U.S. companies certified under the EU-U.S. Data Privacy Framework are permitted under an adequacy decision.
You may request further information about the specific safeguards applied to international transfers of your data by contacting us at the details provided in Section 13.
9. Your Rights Under GDPR
Under the General Data Protection Regulation (Articles 15 through 22) and the Irish Data Protection Act 2018, you have the following rights in relation to your personal data:
- Right of access (Article 15): You have the right to request a copy of the personal data we hold about you, along with information about how we process it. We will respond to your request within 30 days.
- Right to rectification (Article 16): If any personal data we hold about you is inaccurate or incomplete, you have the right to ask us to correct or complete it without undue delay.
- Right to erasure (Article 17): You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected, or when you withdraw your consent. This right does not apply where we are legally required to retain the data.
- Right to restriction of processing (Article 18): You may ask us to restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of contested data or while we assess a legitimate interest objection you have raised.
- Right to data portability (Article 20): Where processing is based on consent or a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
- Right to object (Article 21): You have the right to object to our processing of your personal data where we rely on legitimate interests as the legal basis. You also have an unconditional right to object to processing for direct marketing purposes.
- Right to withdraw consent: Where we process your data based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- Right not to be subject to automated decision-making (Article 22): You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on you. We do not currently engage in automated decision-making of this nature.
To exercise any of these rights, please contact us at [email protected] or write to us at the postal address provided in Section 13. We may ask you to verify your identity before processing your request. We will respond to all valid requests within 30 days, although we may extend this period by a further 60 days for complex requests, in which case we will inform you.
If you are unsatisfied with our response, you have the right to lodge a complaint with the Data Protection Commission of Ireland (DPC), the Irish supervisory authority for data protection. The DPC can be contacted at:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Website: www.dataprotection.ie
Phone: +353 (0)1 765 0100
10. Cookies
Our website uses cookies, which are small text files placed on your device when you visit our website. Cookies help us improve your browsing experience, understand how our website is used, and deliver relevant content.
We use the following types of cookies:
- Essential cookies: These are strictly necessary for the basic functioning of our website. They enable core features such as remembering your cookie consent preferences and maintaining session security. These cookies cannot be disabled without impairing the website's functionality. Duration: session-based, deleted when you close your browser.
- Analytics cookies: These cookies help us understand how visitors interact with our website by collecting information about pages visited, time on site, navigation paths, and similar metrics. We use Google Analytics for this purpose. Analytics cookies are only set with your explicit consent. Duration: up to 13 months.
- Marketing cookies: These cookies are used to track visitors across websites and display advertisements that are relevant and engaging. We may use the Meta Pixel for advertising measurement and retargeting purposes. Marketing cookies are only set with your explicit consent. Duration: up to 12 months.
- Preference cookies: These cookies remember choices you have made on our website, such as your cookie consent selection, to provide a personalised experience on return visits. Duration: up to 12 months.
When you first visit our website, a cookie consent banner will appear giving you the option to accept or reject non-essential cookies. Your choice is stored in your browser's local storage and remembered for future visits. You can change your cookie preferences at any time by clearing your browser's local storage or cookies and revisiting our website, which will prompt the consent banner to appear again.
You can also manage cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking essential cookies may impair the functionality of our website. For information on managing cookies in specific browsers, please consult your browser's help documentation.
11. Children's Privacy
Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us immediately at [email protected] and we will take prompt steps to delete such data from our records.
If we become aware that we have inadvertently collected personal data from a child under the age of 16 without appropriate parental consent, we will delete that information as quickly as possible.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email or by placing a prominent notice on our website.
We encourage you to review this policy periodically to stay informed about how we protect your data. Your continued use of our website after any changes to this policy constitutes your acceptance of the updated policy. If you do not agree with any changes, you should stop using our website and contact us to request deletion of your data.
Previous versions of this policy are available upon request by contacting us at the details below.