Vinius Privacy & GDPR Policy

    Version: 1.1
    Effective Date: September 21, 2026
    Last updated: August 19, 2026
    Supersedes: Version 1.0 of February 7, 2026

    This Privacy & GDPR Policy ("Policy") explains how Vinius collects, uses, shares, and protects personal data when you use the Vinius platform, including our web and mobile applications, APIs, and related services (collectively, the "Platform").

    This Policy is intended to be compliant with EU data protection law (including the GDPR), and it also addresses rights that may apply in the UK and certain U.S. jurisdictions. If there is any conflict between this Policy and a signed data processing agreement ("DPA") with your organization, the DPA will control.

    This Policy focuses on privacy and data protection. Terms and Conditions are provided separately.

    1. Who We Are

    Data Controller (for account and platform administration): Vinius V.O.F. (VAT BE 1021.970.422) Registered address: Kattendansstraat 82 3500 Hasselt Belgium Contact email: privacy@govinius.com

    Data Protection Officer (if applicable): Bruno Braes Contact email: bruno@govinius.com

    UK/EU Representative (if applicable): Bruno Braes (bruno@govinius.com)

    Vinius acts in two distinct roles, and which one applies depends on the purpose of the processing.

    Where we act as processor. If you use Vinius on behalf of an organization, we act as a data processor for the personal data your organization uploads or manages within the Platform ("Customer Data"), and your organization is the data controller for that data. That processing is governed by the DPA.

    Where we act as an independent controller. For certain purposes we determine the purpose and means of processing ourselves, and we act as an independent controller rather than on your instructions. Those purposes are:

    • Account creation, authentication, and platform administration
    • Platform security, abuse prevention, and fraud prevention
    • Billing, invoicing, and collections
    • Product development and improvement of the Platform
    • Aggregated Market Insight, as described in Section 7

    For those purposes this Policy applies and sets out the lawful basis we rely on. We do not act on your instructions when processing for those purposes, and we are directly accountable for them.

    2. Scope

    This Policy applies to:

    • Visitors to our websites
    • Users of our applications and APIs
    • Customers and organizations using the Platform
    • Applicants, partners, and business contacts

    3. Personal Data We Collect

    We collect the following categories of personal data, depending on how you use the Platform:

    3.1 Account and Profile Data

    • Name, email address, password (hashed), role, organization, and profile details
    • Optional profile data such as photo, biography, social links, certifications, and preferences

    3.2 Organization and Operational Data

    • Organization information (company name, address, VAT ID, billing contact)
    • User roles and permissions
    • Wine inventory records and operational logs that may include personal identifiers

    3.3 Content and Community Data

    • Tasting notes, reviews, images, comments, messages, and other user-generated content
    • Community interactions (followers, endorsements, clubs, announcements)

    3.4 Transaction and Billing Data

    • Subscription plan, invoices, payment status
    • Payment details are processed by third-party payment processors; we do not store full payment card details

    3.5 Device and Usage Data

    • IP address, browser type, device identifiers, operating system
    • Log data, time zone, timestamps, and interactions with the Platform

    3.6 Integrations and API Data

    • API keys, access scopes, and audit logs
    • Data exchanged with integrated systems (e.g., POS, analytics, storage, or authentication providers)

    3.7 Cookies and Similar Technologies

    • Cookies, pixels, and similar technologies for authentication, security, analytics, and preferences

    4. Legal Bases for Processing (GDPR)

    We process personal data under the following legal bases:

    • Contract: to provide the Platform, manage accounts, and deliver services
    • Legitimate interests: to improve and secure the Platform, prevent fraud, develop new features, and produce Aggregated Market Insight as described in Section 7
    • Legal obligation: to comply with tax, accounting, and regulatory requirements
    • Consent: for optional marketing communications and certain cookies (where required)

    Where we rely on legitimate interests, we have assessed that interest against your rights and freedoms. You can object to processing based on legitimate interests at any time (see Section 11). For Market Insight specifically, that objection takes the form of the opt-out described in Section 7, which is unconditional.

    You can withdraw consent at any time (see Section 11).

    5. How We Use Personal Data

    We use personal data to:

    • Provide and maintain the Platform and its features
    • Authenticate users and enforce access controls
    • Process subscriptions, billing, and support requests
    • Improve performance, reliability, and security
    • Provide analytics and insights related to inventory, pricing, and community activity
    • Produce Aggregated Market Insight, subject to Section 7
    • Deliver communications, service updates, and security notices
    • Comply with legal obligations and enforce our agreements

    6. AI and Automated Processing

    Vinius uses AI and automated tools to enrich wine data, suggest classifications, and provide insights. AI outputs are used to improve data quality and platform features.

    We do not use your Content to train third-party foundation models. Where we send content to an AI provider for inference, we apply the provider's controls that exclude that content from model training. Our AI providers are listed in Section 8.

    You remain responsible for the accuracy and compliance of data you rely on for business decisions.

    7. Aggregated Market Insight

    We produce statistical, benchmark, index, and trend outputs derived from data across multiple organizations. We call these "Market Insight". This section explains what we do, on what basis, and how to stop it.

    Who this applies to. Market Insight is produced only from data associated with organizations using the Platform under a paid business plan. Individual collector accounts are excluded entirely. If you use Vinius as a private collector, none of your data contributes to Market Insight and nothing in this section applies to you.

    What the outputs contain. Market Insight is aggregated and de-identified. It does not identify any organization, user, venue, or individual, whether directly or by reasonable inference from the output or from that output combined with other information we have published. No figure is published unless it is derived from at least five contributing organizations, with no single organization contributing more than 25% of that figure.

    What we never do. We do not sell, license, or supply raw or record-level data to third parties. We do not disclose, in identifiable form, the prices or commercial terms you have agreed with a named supplier to any competitor of yours, or to any supplier, distributor, or producer.

    Who receives it. Market Insight may be supplied to producers, importers, hospitality operators, insurers, and financial institutions. It is not supplied to distributors or wholesalers. If that changes we will give advance notice as a material change under clause 18 of the Terms.

    Timing. Insight describing purchase prices or commercial terms is derived from data that is at least three months old. Insight describing volume, depletion, assortment, or availability may be derived from current data.

    Our role and lawful basis. In producing and supplying Market Insight we act as an independent controller, because we determine this purpose ourselves rather than acting on your instructions. Most of the underlying data is commercial rather than personal. To the extent personal data is processed for this purpose, we rely on legitimate interests under Article 6(1)(f) GDPR: our interest in producing market intelligence about the wine trade, balanced against your rights.

    In carrying out that balancing we took the following into account, and each is a binding commitment rather than a description of intent:

    • Consumers and private collectors are excluded from the processing altogether
    • The outputs are aggregated and de-identified, so the published result is not personal data
    • The aggregation floor prevents any single contributor being isolated from a figure
    • Supplier pricing and commercial terms are protected from identifiable disclosure
    • The opt-out below is unconditional and carries no consequence for your service, entitlements, or price

    How to opt out. You can opt out at any time from your organization settings in the Platform, or by writing to privacy@govinius.com. Opting out does not affect your access to the Platform, your feature entitlements, or your pricing, and we will not ask you to justify it. Opt-out takes effect going forward. Insight already published cannot be recalled, because it contains no data attributable to you.

    8. Sharing and Disclosure

    We may share personal data with:

    • Sub-processors: hosting, storage, email delivery, authentication, AI inference, and security services that process personal data on our behalf
    • Integrations: POS systems, inventory tools, or other systems you connect to the Platform
    • Legal and compliance: where required by law, court order, or to protect rights and safety
    • Business transfers: in connection with a merger, acquisition, or asset sale

    We do not share personal data with third parties for their independent marketing purposes without your consent.

    8.1 Sub-processors

    We maintain a current list of sub-processors naming each vendor, what it does, what data it receives, and where it is located.

    Each sub-processor is engaged under a written agreement imposing data protection obligations equivalent to those we owe you. We give notice before adding or replacing a sub-processor, and customers with a DPA in place have a right to object as set out in the DPA.

    9. International Transfers

    Vinius is based in the EU but may process data in other countries. When we transfer personal data outside the EEA or UK, we rely on appropriate safeguards such as:

    • Standard Contractual Clauses (SCCs)
    • The UK International Data Transfer Agreement (IDTA)
    • Other lawful transfer mechanisms recognized by applicable law

    The sub-processor list records which safeguard applies to each vendor.

    10. Data Retention and Export

    We retain personal data only as long as necessary for the purposes described in this Policy, including:

    • While your account is active
    • As required for legal, accounting, or regulatory obligations
    • For the establishment, exercise, or defense of legal claims

    Export on termination. During your subscription and for 30 days after termination, you may request an export of your inventory, lot, supplier, order, and transaction records in a structured, commonly used, machine-readable format. We will provide it within 14 days of a valid request at no charge. After that period we may delete your data, except where retention is required by law or where the data has already been incorporated into published Market Insight in de-identified form.

    We may anonymize or aggregate data for long-term analytics and platform improvement. Once data is anonymized so that it can no longer be attributed to you, it is no longer personal data and is not subject to the retention periods above.

    11. Your Rights (EU / UK)

    If you are located in the EU or UK, you have the right to:

    • Access your personal data
    • Correct inaccurate data
    • Delete your data ("right to be forgotten")
    • Restrict or object to processing
    • Data portability
    • Withdraw consent at any time
    • Lodge a complaint with your local supervisory authority

    Our lead supervisory authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données). UK users can also complain to the Information Commissioner's Office (ICO).

    Where Vinius acts as processor for your organization's Customer Data, we will direct your request to that organization as controller, and assist them in responding as set out in the DPA.

    12. Additional Rights for U.S. Residents

    Depending on your state of residence (e.g., California), you may have additional rights, including:

    • The right to know the categories and specific pieces of personal data collected
    • The right to delete personal data (subject to exceptions)
    • The right to correct inaccurate data
    • The right to opt out of certain data sharing ("sale" or "sharing" as defined by law)
    • The right to not be discriminated against for exercising privacy rights

    We do not sell personal data for money. Market Insight, described in Section 7, is aggregated and de-identified and is not personal information under these laws. Regardless of how it is characterised, you may opt out of contributing to it at any time under Section 7. If you wish to exercise U.S. privacy rights, contact us using the details in Section 15.

    13. Security

    We use technical and organizational measures to protect personal data, including encryption, access controls, audit logging, and least-privilege access. No system is fully secure; you are responsible for safeguarding your login credentials.

    14. Children's Privacy

    The Platform is not intended for individuals under the legal drinking age in their jurisdiction. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data, contact us so we can take appropriate action.

    15. Contact and Requests

    To exercise your rights or ask questions:

    We may need to verify your identity before processing requests.

    16. Updates to This Policy

    We may update this Policy from time to time. We will post changes and update the "Last updated" date. If changes are material, we will provide additional notice as required by law and, where the change affects the Terms, in accordance with clause 18 of the Terms and Conditions.