1. About this Policy

This Privacy Policy explains how personal data is collected, used, stored and disclosed when you visit www.gitanawinery1953.com, contact us through the website or use the Gitana Winery online store available to customers in Switzerland.

“Personal data” means any information that identifies, or can reasonably be associated with, an individual.

Personal data is processed in accordance with applicable Swiss law, in particular the Federal Act on Data Protection (FADP) and the Data Protection Ordinance. To the extent that it applies, we also comply with the European Union General Data Protection Regulation (GDPR).

This Policy relates exclusively to the processing of personal data. Information about cookies and similar technologies is provided separately in our Cookie Policy.

2. Data controller

The controller responsible for the website is:

Gitana Wine House GmbH

Forchstrasse 28, 8008 Zurich

UID: CHE-423.575.897 MWST

Email: swiss.sales@gitanawinery1953.com

Telephone: +41 78 302 99 59

3. Personal data we collect

3.1 Data collected when you access the website

When you visit the website, our servers and technical systems may automatically collect certain information, including:

• IP address;
• date and time of access;
• pages visited and duration of the visit;
• the website from which you reached us;
• browser type and version;
• operating system;
• device type;
• language and general browser settings;
• technical information about errors and website operation;
• the choices recorded through the cookie banner.

This information is used to provide and secure the website, diagnose technical problems, prevent misuse and, depending on your choices, analyse how the website is used.

3.2 Data submitted through forms

When you use the contact form or submit an enquiry about distribution, exports, stores, visits or a potential collaboration, we may collect:

• first and last name;
• company and position;
• email address;
• telephone number;
• country or region;
• subject of the enquiry;
• content of the message;
• documents or information that you choose to provide;
• the history of subsequent communications.

Please do not submit sensitive data or information that is not required to handle your enquiry through our forms.

Submitting a form does not automatically result in the conclusion of a contract, the grant of distribution rights, the acceptance of a collaboration or the confirmation of a reservation.

3.3 Data processed for orders in Switzerland

When you place an order through the online store, we may collect:

• first and last name;
• billing and delivery addresses;
• email address and telephone number;
• products ordered, quantities and order value;
• payment information and payment status;
• delivery information;
• history of orders, cancellations, complaints and refunds;
• confirmation that the applicable legal age requirement has been met;
• communications relating to an order;
• information required to prevent fraud and secure transactions.

The online store accepts orders and delivers products exclusively to addresses in Switzerland.

Gitana Winery should not store complete payment card details where payment is processed directly by an external provider. In that situation, the payment provider will process the data in accordance with its own privacy policy.

https://stripe.com/gb/privacy

3.4 Age-related data

The website and the products presented are intended for adults.

We may request confirmation of age when you enter the website, place an order or receive the products. The confirmation displayed when accessing the website does not replace any checks required for the sale and delivery of alcoholic beverages.

We do not ordinarily retain a copy of an identity document solely to confirm age. If such a document is requested in a justified situation, the person concerned must be informed separately of the purpose, the data used and the retention period.

3.5 Newsletter and marketing communications

If you subscribe to our newsletter, we may process:

• your name, if requested;
• email address;
• selected language or country;
• the date and method of subscription;
• evidence of consent;
• interactions with messages received, if this feature is enabled.

Subscription is voluntary. You may withdraw your consent at any time by using the unsubscribe link included in each message or by contacting us at swiss.sales@gitanawinery1953.com.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

If messages include technologies that measure email opens and link clicks, their use must be described transparently and aligned with the choices made by the user.

4. Sources of personal data

We generally collect personal data:

• directly from you;
• automatically, through the website and technical infrastructure;
• from providers involved in processing payments or delivering orders;
• from distributors or business partners, where necessary to handle an enquiry;
• from public sources, exclusively where justified in connection with a business relationship or to verify information provided.

If we receive your data from another person or company, we will comply with the information obligations imposed by applicable law.

5. Purposes of processing

We may process personal data for the following purposes:

• providing, administering and securing the website;
• displaying content correctly on the user's device;
• responding to questions and enquiries;
• handling enquiries concerning distribution, exports and collaborations;
• processing and delivering orders in Switzerland;
• administering payments, invoices, cancellations and refunds;
• verifying compliance with age requirements;
• communicating about orders;
• handling complaints and damaged or non-conforming products;
• preventing fraud, security incidents and misuse;
• complying with accounting, tax and legal obligations;
• establishing, exercising or defending legal claims;
• analysing and improving the website and services, depending on the technologies implemented and the user's choices;
• sending marketing communications where consent has been given or another basis permitted by law applies.

We will not use personal data for purposes incompatible with those for which it was collected without legal justification or, where required, without providing additional information.

6. Grounds for processing

Depending on the circumstances and applicable law, processing may be based on:

• the necessity of entering into or performing a contract, including processing and delivering an order;
• compliance with a legal obligation;
• our legitimate interest in administering and securing the website, responding to enquiries and protecting our rights;
• the individual's consent, where required, including for certain marketing activities or analytics technologies;
• other grounds permitted by applicable law.

Where processing is based on consent, consent may be withdrawn at any time.

This list is particularly relevant where the GDPR applies. The Swiss FADP does not structure all ordinary processing activities around the same list of “legal bases” as the GDPR; this Policy should therefore not be understood as a GDPR-only policy.

7. Recipients of personal data

To the extent necessary, we may disclose personal data to the following categories of recipients:

• companies that operate the website and the Swiss online store;
• hosting and technical infrastructure providers;
• IT maintenance, security and support providers;
• e-commerce platform providers;
• payment processors and financial institutions;
• courier and logistics companies;
• email and communications service providers;
• analytics and consent-management providers, if used;
• accountants, auditors, lawyers and other professional advisers;
• public authorities, courts or other bodies where disclosure is required or permitted by law;
• distributors or local partners, where disclosure is necessary to handle an enquiry and there is a valid justification for it.

Providers that process personal data on our behalf must use it only in accordance with our instructions and applicable contractual obligations.

We do not sell personal data.

8. International data transfers

Because the website is international and its operators, providers or partners may be established in different countries, personal data may also be processed outside Switzerland.

Where personal data is transferred to a country that does not provide a level of protection recognised as adequate, we will use safeguards provided for under applicable law, such as recognised contractual clauses, or rely on an applicable statutory exception.

Depending on the providers actually used, personal data may be processed in:

• Switzerland;
• the Republic of Moldova;
• the European Union/European Economic Area;

9. Cookies and external services

The website may use cookies and similar technologies for:

• technical operation;
• remembering user preferences;
• managing the shopping cart;
• security and fraud prevention;
• audience measurement;
• embedding videos, maps or social-media platforms;
• advertising and campaign measurement, if such tools are implemented.

Details of the providers, purpose, duration and means of disabling these technologies are provided in the Cookie Policy and the preference-management tool.

Where required, non-essential cookies and technologies are activated only after the user has made a choice.

Embedded third-party content may allow the relevant providers to receive information about the device and interactions with the website. These integrations must remain blocked until the user has made a choice where applicable law so requires.

In 2025, the FDPIC published specific guidance on the use of cookies and similar technologies: FDPIC – Guidelines on data processing using cookies.

10. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, to comply with legal obligations and to protect our rights.

Specific retention periods depend on the nature of the data:

• technical data and security logs: [retention period to be confirmed];
• general enquiries: no more than 24 months after the enquiry has been resolved;
• commercial or distribution enquiries: for the duration of the discussions and subsequently for as long as justified by the business relationship or any applicable obligations;
• order data and financial and accounting records: for the period required by applicable Swiss law;
• complaint data: until the complaint has been resolved and thereafter for as long as necessary to protect legal rights;
• newsletter data: until you unsubscribe, while retaining the minimum evidence of the unsubscribe request where necessary;
• cookie preferences: for the period configured in the consent-management platform.

Data may be retained for longer where there is a dispute, investigation, legal obligation or another justified reason.

At the end of the relevant period, data is deleted, anonymised or archived with restricted access, as appropriate.

11. Data security

We implement appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• unauthorised use or alteration;
• accidental loss;
• disclosure;
• destruction;
• other forms of unlawful processing.

These measures may include access controls, authentication, encryption of communications, backups, system updates and limiting access to persons who require the data.

No online system can guarantee absolute security. In the event of a data security incident, we will take the measures required by applicable law, including notifying the competent authority and affected individuals where the legal requirements are met.

12. Your rights

Subject to the conditions laid down by applicable law, you may request:

• confirmation as to whether we process your personal data;
• access to your data and information about its processing;
• correction of inaccurate data;
• deletion or destruction of data;
• the cessation or restriction of certain processing;
• delivery of data in a portable format where the legal requirements are met;
• withdrawal of consent;
• objection to certain uses, particularly direct marketing;
• review of an individual decision made solely by automated means, if such processing takes place and produces relevant effects.

These rights are not absolute. A request may be restricted or refused where the retention or use of data is required by law, necessary for the performance of a contract, justified by overriding legitimate interests or necessary to protect legal rights.

To exercise your rights, you may contact us at swiss.sales@gitanawinery1953.com. We may request additional information strictly necessary to verify your identity.

The FDPIC confirms that, under Article 25 FADP, an individual may request information about their personal data, the purposes of processing, recipients and the retention period: FDPIC – Knowing and asserting my rights.

13. Complaints

If you have concerns about the processing of your personal data, please contact us first at swiss.sales@gitanawinery1953.com so that we can attempt to resolve your enquiry.

You may also contact the competent Swiss authority:

Federal Data Protection and Information Commissioner (FDPIC)

FDPIC – official website

If the GDPR applies to your situation, you may also have the right to lodge a complaint with the competent data protection authority in the country where you live or work.

14. Children's data

The website and online store are not intended for minors, and we do not knowingly seek to collect their data for the sale of alcoholic beverages.

If we become aware that we have collected such data without justification, we will take steps to delete it to the extent permitted by law.

15. Automated decision-making and profiling

We do not use data collected through the website to make individual decisions based solely on automated processing that produce legal effects or significantly affect an individual.

16. External websites and platforms

The website may contain links to distributors, stores, social networks and other services operated by third parties.

We do not control how these entities process data once you access their services. We recommend that you review the privacy policy of each external operator.

The presence of a link does not mean that Gitana Winery is responsible for the privacy practices of the relevant website.

17. Changes to this Policy

We may update this Privacy Policy to reflect changes to the website, providers, internal processes or applicable law.

The applicable version is the one published on the website together with the date of the latest update.

If material changes are made, we may display a prominent notice or notify individuals directly where the nature of the change and the contact details available justify doing so.

18. Contact

For questions, requests or complaints concerning personal data:

Gitana Wine House GmbH

Forchstrasse 28, 8008 Zurich

Telephone: +41 78 302 99 59

Email: swiss.sales@gitanawinery1953.com