Last updated: 2 July 2026

This Privacy Policy has been developed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter referred to as the GDPR, as well as Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD) and other applicable legislation.

The purpose of this Privacy Policy is to inform individuals who provide their personal data and/or the personal data of the person they represent about the specific aspects relating to the processing of their data, the purposes of such processing, the contact details for exercising their rights, data retention periods and security measures, among other matters.

WHO IS THE DATA CONTROLLER?

For data protection purposes, the company acts as the Data Controller in relation to the personal data processing activities it carries out.

The contact details of the Data Controller are provided below:

• Data Controller: VICENTE GANDÍA PLA SA
• Tax Identification Number (NIF): A46019063
• Postal address: Ctra. Cheste a Godelleta, s/n, 46370 CHIVA, València (Valencia), Spain
• Email address: info@vicentegandia.com
• Telephone: +34 962 52 42 42

WHAT PERSONAL DATA DO WE PROCESS?

All information collected by VICENTE GANDÍA PLA SA will be processed fairly, lawfully and transparently.

Furthermore, the data requested for each processing activity will be limited to what is strictly necessary to fulfil the specific purpose communicated in each case.

Accordingly, the data collected will be adequate, relevant and not excessive in relation to the purposes for which it is processed. Personal data will also be collected for specified, explicit and legitimate purposes and will not be further processed in a manner incompatible with those purposes. In addition, the data will be updated whenever necessary.

In general, the following categories of data are collected as part of the company’s various processing activities:

• Identification data.
• Administrative data.
• Commercial information.
• Transactions involving goods and services.
• Economic and financial data.
• Browsing data and web analytics.

WHERE DOES PERSONAL DATA COME FROM?

As a general rule, personal data is always collected directly from the data subject. However, in certain exceptional circumstances, data may be collected through third parties, organizations or services other than the data subject.

In such cases, the data subject will be informed through the information clauses included in the different data collection channels, within a reasonable period or at the time of the first communication with the data subject.

FOR WHAT PURPOSES DO WE PROCESS PERSONAL DATA?

In general, personal data is processed for the following purposes:

• Contact: Responding to requests for information about the products and services we offer, as well as answering any other questions submitted by users.
• Visit booking management: Managing online bookings for wine tourism visits, including visitor identification data, billing information, booking-related communications and payment processing. The legal basis is the performance of the booking contract. Special categories of personal data or information that is unnecessary for managing the visit must not be entered in the “Order Notes” field. If a date of birth is requested, this information will be processed exclusively to verify that the visitor is of legal age or to manage access conditions associated with the visit. If it is not strictly necessary, it may be replaced with an age range or the number of participants.
• Customers: Managing sales of goods and services, invoicing, accounting, collections, outstanding payments, offers, quotations and contracts, customer service, contact and commercial relationships.
• Suppliers: Managing purchases, accounting, payments, orders, contact and commercial relationships.
• Profiling: Using your data to create a commercial profile based on your purchasing habits and personal and social characteristics for advertising and retargeting purposes, including the use of tools such as Google Analytics, Google Ads and Microsoft Clarity. The data subject has the right to object to this processing at any time.

These processing activities involve the creation of profiles of users of our website in order to make automated decisions based on the logic described in this Privacy Policy.

WHAT IS THE LEGAL BASIS FOR PROCESSING PERSONAL DATA?

Specifically, the following legal bases apply to the processing activities described below:

• Contact: The legitimate interest of the Data Controller in responding to enquiries received (Article 6(1)(f) GDPR).
• Visit booking management: Performance of the booking contract (Article 6(1)(b) GDPR). Communications necessary for managing the booking are covered by the performance of the contract and do not require additional consent.
• Customers / invoicing: Performance of a contract (Article 6(1)(b) GDPR) and compliance with legal tax and commercial obligations (Article 6(1)(c) GDPR).
• Suppliers: Performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR).
• Commercial communications about products or services similar to those previously purchased: Legitimate interest (Article 6(1)(f) GDPR and Article 21(2) LSSI). This processing is only permitted when the recipient is an existing customer who has not expressly objected at the time of data collection or in any subsequent communication.
• Profiling and behavioral advertising (Google Ads / retargeting): Consent of the data subject (Article 6(1)(a) GDPR), provided through the cookie management panel. The data subject may withdraw their consent at any time.
• Compliance with legal and regulatory obligations: Including, but not limited to, accounting and tax regulations, the Accounts Auditing Act, employment legislation, the Civil Code, the Commercial Code, and any specific law or regulation that authorizes or requires the processing of the data subject’s personal data.

HOW LONG DO WE RETAIN PERSONAL DATA?

As a general rule, personal data is processed for as long as necessary to fulfil the purpose for which it was collected, while the service or contractual relationship remains in place, while there is a mutual interest and/or for the period established by the relevant legislation.

Once the applicable retention periods have expired, the data will be erased. This erasure process will involve restricting access to the data, which will be retained solely for access by Public Authorities, Judges and Courts in order to address any potential liabilities arising from the processing, for the duration of the relevant statutory limitation periods. Once these periods have expired, the information will be permanently destroyed.

Specifically, the following retention periods apply to the processing activities described below:

• Contact: Until the enquiry has been resolved and, subsequently, for a maximum of 3 years in accordance with the limitation period for civil claims.
• Visit booking management: For the duration of the contractual relationship and, once it has ended, for 4 years to comply with tax obligations (General Tax Law), 5 years to comply with commercial obligations (Commercial Code) and 3 years for the statutory warranty period (Royal Legislative Decree 1/2007).
• Customers / invoicing: For the duration of the contractual relationship and, once it has ended, for 4 years to comply with tax obligations (General Tax Law), 5 years to comply with commercial obligations (Commercial Code) and 3 years for the statutory warranty period (Royal Legislative Decree 1/2007).
• Suppliers: For the duration of the contractual relationship and, once it has ended, for 4 years to comply with tax obligations and 5 years to comply with commercial obligations.
• Profiling and behavioral advertising: Until the data subject withdraws consent or objects to the processing.
• Exercise of rights: 4 years as documentary evidence of compliance with Article 12 of the GDPR.

WITH WHOM DO WE SHARE PERSONAL DATA?

To fulfil the purposes described above, personal data may be shared with:

• Technology providers acting as data processors under Article 28 of the GDPR: Google LLC (Google Analytics, Google Tag Manager, Google Ads), Microsoft Corporation (Microsoft Clarity), and other technology service providers necessary for the operation of the website and the management of bookings.
• Payment gateway: The online payment provider acts as a data processor under Article 28 of the GDPR for the management of transactions arising from bookings.
• Public authorities and competent bodies when required by applicable legislation.

ARE INTERNATIONAL DATA TRANSFERS CARRIED OUT?

Please be informed that some of the technology providers used by this website transfer data outside the European Economic Area. Specifically:

• Google LLC (USA) — Google Analytics, Google Tag Manager and Google Ads: The transfer is covered by Google’s participation in the EU–US Data Privacy Framework, adopted by the European Commission in July 2023.
• Microsoft Corporation (USA) — Microsoft Clarity: The transfer is covered by Microsoft’s participation in the EU–US Data Privacy Framework, adopted by the European Commission in July 2023.

The applicable safeguards are available upon express request by contacting rgpd@vicentegandia.com.

WHAT RIGHTS CAN YOU EXERCISE?

Under current legislation, you have the following rights:

• Right of Access: The right to request information from the Data Controller as to whether your personal data is being processed.
• Right to Rectification: The right to request the correction of inaccurate or incomplete personal data.
• Right to Object: The right to object to the processing of your personal data or to request that such processing cease.
• Right Regarding Automated Individual Decision-Making: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• Right to Restriction of Processing: The right to request the restriction of the processing of your personal data in certain circumstances.
• Right to Erasure or the Right to Be Forgotten: The right to request the erasure of your personal data.
• Right to Data Portability: The right to request that the Data Controller provide your personal data in a structured and clear format for transfer to another controller.
• Right to Lodge a Complaint: The right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data does not comply with applicable legislation.

HOW CAN YOU EXERCISE YOUR RIGHTS?

Data subjects may exercise their rights through the following channels:

• Email: rgpd@vicentegandia.com.
• Postal mail: Ctra. Cheste a Godelleta, s/n, 46370 CHIVA, València (Valencia), Spain.

In both cases, documentation proving the identity of the applicant may be requested where necessary. As a general rule, providing a copy of a national identity document (DNI) is not mandatory in order to exercise these rights. However, if there are reasonable doubts about the applicant’s identity, additional information necessary to confirm their identity may be requested.

In any event, you may seek the assistance of the Spanish Data Protection Agency (Agencia Española de Protección de Datos) through its website.

Your request will be addressed within a maximum period of 30 days from receipt. This period may be extended by up to 2 months in particularly complex cases, provided that the data subject is notified in advance (Article 12(3) GDPR).

WHAT ARE THE POSSIBLE CONSEQUENCES OF NOT PROVIDING THE REQUESTED INFORMATION?

The data requested in fields marked with an asterisk, identified as mandatory, or provided through the channels where information is collected is strictly necessary for the purposes for which it is requested, for providing an optimal service to the data subject, for complying with a legal obligation imposed on the Data Controller, or as a requirement for entering into a contract. Providing data in the remaining fields is voluntary.

If not all the requested data is provided, we cannot guarantee that the information and services offered will fully meet your needs.

Therefore, if the required data is not provided or is provided incorrectly or incompletely, we may be unable to process your request, making it impossible to provide the requested information or complete the contracting of services.

Likewise, the user guarantees that the information submitted through any of the forms is truthful, accurate and relates to their own personal data.

The services offered through our platforms are not intended for minors. Therefore, registration is only permitted for individuals over 18 years of age. Otherwise, any potential liabilities arising from a minor’s use of our platforms shall be the responsibility of the minor’s parents or legal guardians.

HOW IS PROFILING CARRIED OUT?

VICENTE GANDÍA PLA SA may create a commercial profile based on the information provided by the data subject and their interactions with the content offered, for the purpose of sending personalized information about our products or services, including by electronic means, as well as displaying advertisements tailored to their interests on other websites, applications or social networks (retargeting). To this end, tools such as Google Analytics, Google Ads (including conversion tracking and remarketing features) and Microsoft Clarity are used. The legal basis for profiling and behavioral advertising is the consent of the data subject, provided through the cookie management panel. No automated decisions producing significant legal effects will be made based solely on this profile. Users may object to the profiling of their information or withdraw their consent at any time through the cookie management panel or by contacting the designated communication channel.

The contact details of the Data Controller are provided below:

• Browsing and web analytics: We will process your browsing data to analyze website usage, measure the performance of advertising campaigns and personalize the information we send you, adapting it to your tastes and preferences based on your browsing habits and interactions with our content, through the use of cookies and other similar technologies (for more information about the use of cookies, please visit our Cookie Policy).
• Advertising and retargeting: We will use your data to display advertisements based on the profile created from your browsing history and interactions with our content. These advertisements may appear on other websites, applications or platforms that you visit.

WHAT SECURITY MEASURES HAVE WE IMPLEMENTED?

The security measures adopted by VICENTE GANDÍA PLA SA are those required in accordance with Article 32 of the GDPR.

In this regard, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons, appropriate technical and organizational measures have been implemented to ensure a level of security appropriate to the existing risk.

In all cases, VICENTE GANDÍA PLA SA has implemented sufficient mechanisms to:

• Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
• Restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident.
• Regularly test, assess and evaluate the effectiveness of the technical and organizational measures implemented to ensure the security of processing.
• Enable the encryption of data and communications.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be reviewed periodically to reflect changes in applicable legislation, updates to procedures for collecting and using personal data, the introduction of new services or the discontinuation of existing ones. These changes will take effect upon publication on the website. Therefore, it is important that you review this Privacy Policy regularly to remain informed of any changes.