logo
Back

LEGAL INFORMATION

Privacy policy

Transparency about how we operate, what data we process and what rights you have as a customer.

Last updated: April 6, 2026

5 Sommeliers is committed to protecting the privacy of its users. This Privacy Policy describes how we collect, use, store and protect your personal data, in compliance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and applicable Portuguese legislation.

1. Data Controller

The data controller for your personal data is:

5 Sommeliers Email: geral@5sommeliers.com

For questions related to data protection, you may contact us at the email address above.

2. Personal Data Collected

We collect the following personal data, as necessary for the provision of our services:

Account data

  • First name and last name
  • Email address
  • Phone number (optional)

Shipping and billing data

  • Full address (street, postal code, city, province, country)
  • Tax Identification Number (NIF/VAT)
  • Company name (optional)

Payment data

  • Credit/debit card information — this data is processed directly by our certified payment processor and is not stored on our servers

Usage data

  • Browsing and interaction data on the website (collected via PostHog)
  • Language preferences
  • Device and browser information

3. Purpose of Processing

We use your personal data for the following purposes:

  • Service delivery — account management, processing of subscriptions and orders, product shipping
  • Communication — responding to enquiries, order status notifications
  • Billing — invoice issuance and compliance with tax obligations
  • Service improvement — anonymised analysis of usage patterns to improve user experience
  • Marketing — communications about news and promotions, only when expressly authorised by the user

4. Legal Basis

The processing of your personal data is based on the following legal grounds, pursuant to Article 6 of the GDPR:

  • Performance of a contract — for the provision of contracted services (subscriptions, orders, account management)
  • Consent — for marketing communications and analytics cookies
  • Legal obligation — for compliance with tax and legal obligations (billing, record retention)
  • Legitimate interest — for service improvement and website security

5. Retention Period

Your personal data is retained for the following periods:

  • Account data — while the account is active, and for 30 days after account closure
  • Billing data — 10 years, in accordance with Portuguese tax obligations
  • Usage data (analytics) — 26 months
  • Marketing data — until consent is withdrawn

6. Data Sharing

Your personal data may be shared with the following third parties, strictly for the stated purposes:

  • Payment processor — for secure card transaction processing
  • PostHog — for website usage analysis (anonymised data)
  • Shipping carrier — for order delivery (name, delivery address, contact)
  • Tax Authority — in accordance with legal billing obligations

We do not sell, trade or transfer your personal data to third parties for marketing purposes.

7. Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access — request information about the data we hold about you
  • Right to rectification — request correction of inaccurate or incomplete data
  • Right to erasure — request deletion of your personal data, where applicable
  • Right to restriction of processing — request restriction of the processing of your data
  • Right to data portability — receive your data in a structured, machine-readable format
  • Right to object — object to the processing of your data in certain circumstances
  • Right to withdraw consent — withdraw previously given consent at any time

To exercise any of these rights, please contact us at geral@5sommeliers.com. We will respond to your request within 30 days.

8. Data Security

We have implemented technical and organisational measures to protect your personal data, including:

  • Secure authentication — we use an email verification code system (OTP), eliminating the need to store passwords
  • Encryption in transit — all communications are protected by HTTPS/TLS
  • Restricted access — access to personal data is limited to authorised personnel
  • Secure payment processing — card data is processed exclusively by our certified payment processor

9. International Transfers

Some of our service providers (namely PostHog, for usage analytics) may process data outside the European Economic Area (EEA). In such cases, we ensure that adequate safeguards are in place, including standard contractual clauses approved by the European Commission.

10. Minors

Our services are not intended for persons under the age of 18. We do not knowingly collect personal data from minors. The purchase of alcoholic beverages is strictly prohibited for persons under 18, in accordance with Portuguese law.

11. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy at any time. Any changes will be published on this page with the revised update date. We recommend that you review this page periodically.

12. Contact and Complaints

For questions about the protection of your personal data, please contact us:

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD):