Legal information

Privacy policy

What data of yours is processed here, what for, for how long and what you can do about it.

Last updated: 2026-09-22

In short

You can use the whole directory without giving any data and without signing up.
Data is only requested if you create an account or write through the contact form.
Your data is never sold or handed to anyone, and there is no advertising or profiling.
You can delete your entire account, with all its lists, from "My account", without asking anyone.

1. Who processes your data

The data controller is the owner of this website:

Owner: Jose A Tizon
Privacy contact: hi@bodegasdejerez.com

Given the volume and type of data processed here, appointing a data protection officer is not mandatory. For any privacy matter, write to the address above.

2. What data is processed and why

There are only four situations in which this site processes personal data. None of them involves advertising, selling data or automated decisions affecting you.

a) Your member account

If you sign up, we store your name, your email, your password (hashed, never in the clear: not even the owner can read it), a profile name generated from yours, and the language you signed up in, which is the one used for the emails sent to you.

Purpose:: creating and maintaining your account, identifying you when you sign in and confirming the email is yours.
Legal basis:: performance of the service you request by signing up (Art. 6(1)(b) GDPR).
Retention:: for as long as the account exists. If you delete it, everything is deleted immediately and without a copy.

b) Your lists, your notes and your ratings

The wineries and wines you save, along with the name and description of each list and the notes and ratings you write.

Purpose:: providing you with the lists feature, which is what the account exists for.
Legal basis:: performance of the service you request by signing up (Art. 6(1)(b) GDPR).
Retention:: for as long as the account exists. Deleting the account also deletes every list.

Careful with public lists: lists start out private and only you can see them. If you mark one as public, anyone who knows its address will be able to see your name, the name of the list and the notes and ratings you have written in it. Those pages carry the tag asking search engines not to index them, but that does not make them secret: they are public to anyone with the link. You can make them private again whenever you want.

c) The contact form

The name, the email, the winery (if you give one) and the message you write. The message is stored and also forwarded by email to the owner.

Purpose:: reading your message, replying to you and, if you report an error in an entry, being able to correct it.
Legal basis:: your consent, given when you submit the form (Art. 6(1)(a) GDPR).
Retention:: while your enquiry is being handled and, at most, one year from then.

d) The server technical log

Like any web server, this one records every request it receives: the IP address, the date, the page requested and the browser. These are technical records that are not cross-referenced with your account or used to work out who you are.

Purpose:: keeping the site up, diagnosing errors and detecting abuse.
Legal basis:: the legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
Retention:: they rotate on their own and are not archived.

The data requested in each form is the minimum needed. If you do not provide it, the account simply cannot be created or the message sent; the rest of the site works just the same.

3. Who else sees your data

Your data is not sold, not rented and not handed to third parties to do anything with. It is hosted and transported by the technical providers without which the site could not work, which act as data processors and may only use it to provide their service:

DigitalOcean

Hosting of the database. The servers are in Amsterdam (Netherlands), inside the European Union.
Cloudflare

It carries the requests from the internet to the server and is where the HTTPS encryption ends, so it sees your IP address and which page you ask for. It also serves the library that draws the maps on the winery pages.
Brevo

Delivery of the site's emails: the address confirmation, the password recovery link and the contact form notifications. It is a French provider and processes the data inside the European Union.

The site itself is not hosted with any company: it runs on a server of the publisher’s own, in Spain.

When you open the page of a winery that has a map, your browser requests the images of that map from OpenStreetMap, the foundation that keeps it free. Your browser makes that request directly, so OpenStreetMap sees your IP address; nothing else is sent to it and it is not told who you are. Everything else a page loads —the fonts included— comes from this same domain.

Cloudflare is a United States company and its network runs outside the European Economic Area: that transfer relies on the European Commission’s standard contractual clauses and on its adherence to the EU–U.S. Data Privacy Framework. The rest of the data does not leave the European Economic Area. Beyond the above, data could be disclosed to judges, courts or public authorities where a rule requires it.

4. Cookies

This site uses no advertising cookies, no social network cookies and no cross-site tracking. That is why you will not see a cookie notice asking for your permission: there is nothing to consent to.

The only two cookies set are technical and necessary for the site to work, and are exempt from consent under Article 22.2 of the LSSI:

Cookie	What it does	Duration
bodegas-de-jerez-session	Keeps your session while you browse and remembers whether you have signed in.	2 hours
XSRF-TOKEN	Protects forms against forged submissions from another site.	2 hours

Nor is any analytics tool measuring your visit right now. If one is ever added, it will be one that sets no cookies and does not allow identifying you, and it will be stated here before being switched on.

You can block or delete these cookies from your browser, but then you will not be able to sign in or submit forms.

5. How it is protected

The whole site travels encrypted over HTTPS, the database connection is encrypted too, and passwords are stored with an irreversible hashing algorithm: they are not stored in the clear anywhere, not even in a way the owner could read. Access to the administration area is restricted to the team's accounts.

6. Your rights

The GDPR grants you these rights over your data, and exercising them is free:

Access: knowing what data of yours is processed and obtaining a copy.
Rectification: correcting data that is wrong or incomplete.
Erasure: asking for it to be deleted once it is no longer needed.
Restriction: asking for it to be kept but not used while a disagreement is resolved.
Portability: receiving your data in a format you can take elsewhere.
Objection: objecting to processing based on legitimate interest.
Withdrawing consent: at any time, without affecting what was done before withdrawing it.

For the two most common ones you do not need to write to anyone: from "My account" you can correct your data and delete the whole account, with all its lists, on the spot.

For any other, write to hi@bodegasdejerez.com stating which right you wish to exercise. You will get an answer within one month at the latest.

If you believe your data is not being processed properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), which is the competent supervisory authority. www.aepd.es

7. Minors

This site is about wine and its accounts are reserved for people over 18. Data from minors is not knowingly collected. If we detect a minor's account, it is deleted. If you are a parent or guardian and believe this has happened, write to us and we will sort it out.

8. Changes to this policy

This policy may change if what the site does changes. The version in force is always the one published here, with its update date above. If a change affects you significantly and you have an account, you will be notified by email before it is applied.

The owner's details and the conditions of use of the site are in the legal notice. Read the legal notice