Privacy Policy

1. Data Controller

In accordance with Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), and Organic Law 3/2018 on Personal Data Protection and the guarantee of digital rights (LOPDGDD), users are informed that the personal data provided will be processed by:
Data Controller: CASTELL D’ENCUS, S.L.
Tax ID No.: B63266431
Address: Carretera de Tremp a Santa Engràcia, Km. 5, 25630 Talarn (Lleida)
Telephone: 973 252 974
Email: castelldencus@castelldencus.com

2. Purposes of Processing

The personal data provided may be processed for the following purposes:
• To manage enquiries, requests for information and communications made through the website or by any other contact method.
• To manage bookings for visits, wine tourism activities, tastings and events organised by the entity.
• To manage orders, purchases made through the online store and the corresponding contractual relationship with customers.
• To manage billing, payment collection and compliance with administrative, accounting and tax obligations.
• To manage participation in loyalty programmes, customer clubs or promotional activities, where applicable.
• To send commercial information about the entity’s products, services, activities and news by electronic or conventional means, where consent or sufficient legal authorisation exists.
• To ensure the security of the website and prevent fraudulent or unlawful use.
• To manage browsing preferences through the use of cookies, in accordance with the corresponding Cookie Policy.

3. Legal Basis for Processing

The legal basis that legitimises the processing of personal data may be:
• The performance of a contract or the application of pre-contractual measures requested by the data subject.
• Compliance with legal obligations applicable to the data controller.
• Consent given by the data subject for one or more specific purposes.
• The legitimate interest of the controller in ensuring website security, preventing fraud and properly managing the relationship with customers and users.
Where processing is based on consent, it may be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal.

4. Categories of Data Processed

Depending on the intended purpose, the following categories of data may be processed:
• Identification data, such as first name and surname.
• Contact details, such as email address, telephone number and postal address.
• Financial and billing data.
• Data relating to purchases, bookings or contracted services.
• Browsing and website usage data.
• Any other information voluntarily provided by the data subject.

5. Data Retention

Personal data will be retained for the time necessary to fulfil the purpose for which it was collected.
Subsequently, the data may be duly blocked for the periods required by applicable regulations in order to address any possible legal liabilities.
In particular:
• Data related to purchases and billing will be retained for the legally required periods.
• Data used for sending commercial communications will be retained until the data subject withdraws their consent or requests its deletion.
• Data arising from enquiries will be retained for the time necessary to respond to them and carry out the corresponding follow-up.

6. Data Recipients

Personal data may be disclosed to:
• Banking and financial institutions for the management of collections and payments.
• Advisors, administrative agencies and professional service providers.
• Technology and web hosting providers that provide services to the data controller.
• Public administrations, official bodies and competent authorities where there is a legal obligation.
No data transfers other than those indicated will be carried out unless required by law or with the express consent of the data subject.

7. International Data Transfers

Some of the technology providers used by the entity may be located outside the European Economic Area or may carry out international data processing.
In such cases, the controller will adopt the appropriate safeguards provided for in data protection regulations to ensure a level of protection equivalent to that required by European legislation.

8. Rights of Data Subjects

Any person has the right to obtain confirmation as to whether CASTELL D’ENCUS, S.L. is processing personal data concerning them.
They may also exercise the following rights:
• Access to their personal data.
• Rectification of inaccurate data.
• Erasure of data where appropriate.
• Restriction of processing.
• Objection to processing.
• Data portability.
• Withdrawal of previously given consent.
To exercise these rights, they may contact the postal address or email address indicated in this policy in writing.
Where necessary to verify their identity, supporting documentation may be requested.

9. Complaints Before the Supervisory Authority

If you consider that the processing of your personal data does not comply with current regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) through its electronic headquarters or by any of the means made available by said supervisory authority.