Privacy declaration

1. Controller

Importeria B.V.
Keulsepoort 2 - Unit 280
5911 BZ Venlo
The Netherlands
KvK: 76959066
VAT: NL860853901B01

Privacy contact:
info@importeria.com

Customer service:
order@importeria.nl

2. Customer, account and profile data

We process names, contact details, account identifiers, authentication data, account type and preferences to manage accounts, secure access and provide requested functions.

Potential legal-basis categories are performance of a contract or pre-contractual steps, legal obligations and Importeria's legitimate interest in secure account and customer administration.

3. Addresses, checkout and orders

For checkout and order handling we process billing and delivery addresses, country, contact details, cart, products, quantities, prices, taxes, shipping choices, consent and document snapshots, order status and customer-service information.

This processing is necessary for pre-contractual steps, performance of the sales contract, delivery, administration and legal obligations.

4. Payments and Stripe

Stripe processes payment details in its hosted payment environment. Importeria receives and stores Checkout Session, PaymentIntent and charge references, amounts, currency, payment status, limited provider payloads and webhook evidence for payment, reconciliation, fraud investigation and disputes.

Importeria does not store full card details. Stripe may act as an independent controller for its own payment security and fraud prevention; the exact allocation of roles, retention and transfers requires contractual confirmation before approval.

5. Suppliers and Stripe Connect

For the Winery Portal, supplier relationships and Stripe Connect, we process business and contact details, application and review information, connected-account references, capability and onboarding status and business settlement information.

This B2B processing does not change Importeria's role as consumer seller. Legal basis and retention depend on pre-contractual steps, the supplier agreement, legal obligations and security and audit interests.

6. Winery applications and Wine Intake

Winery applications and wine submissions may contain business details, contact persons, answers, product information, correspondence, workflow status and provenance.

We use this data to assess a potential relationship, review submissions and, following approval, operate catalogue and supplier processes.

7. Private attachments and malware scanning

Private Winery Portal and Wine Intake attachments may contain personal data and confidential business information. Files are stored privately, technically validated and scanned for malware using ClamAV.

Scan status, file digest, upload and access metadata may be retained to demonstrate security and integrity. Only authorised roles receive access through controlled download routes.

8. Transactional email

We process email addresses, template and version data, order or application references, delivery timestamps, retry and error data in a transactional outbox.

This supports order, account and workflow communication, reliable delivery, evidence and fault investigation. Email content and delivery history are not used as a marketing profile.

9. Webhooks, audits and security logs

We retain limited webhook payloads, digests, idempotency and processing status, StaffAudit events, actor and permission snapshots, operational status, security events and technical logs.

Purposes include payment processing, integrity, incident investigation, access control, fraud prevention, continuity and evidence of authorised actions. Audit and adjudication ledgers are append-only and tamper-evident where supported by the application.

10. Sessions, CSRF and cookies

Necessary session and CSRF cookies secure forms, login, cart, market context and checkout. A signed cookie remembers cookie choices. Stripe and the Thuiswinkel widget may use their own technology after the activation described in the Cookie Policy.

The current technologies, activation moments and maximum technical duration are listed in the Cookie Policy and its generated cookie table.

11. Recipients and service providers

Where necessary for your order and our services, payment, email, hosting, administration and delivery services receive personal data. We use Stripe for payments, Microsoft 365 for transactional email, and DPD/BRT and other approved carriers for delivery.

Data is shared only for the relevant purpose. Competent authorities and professional advisers may receive data for legal obligations or handling a dispute.

12. International transfers

Using a foreign service provider does not by itself mean that personal data is transferred outside the European Economic Area. Any international transfer is subject to the applicable legal conditions and safeguards.

13. Retention

The applicable Dutch retention obligations govern tax administration records. Legally required records are not deleted because of a shorter operational retention period.

Operational and technical data is reviewed for its specific purpose. Retention and necessary cleanup are reviewed quarterly, aligned with VAT administration. This is not automatic deletion or permission to erase legally required records.

The necessity of data still required for an ongoing obligation, a request, a security investigation or a dispute is assessed separately.

14. Security

Importeria uses measures including encrypted transport, access and role management, secure password storage, private file storage, malware scanning, signed order links, secure cookies, audit logging, backups and monitoring.

No measure prevents every risk. Incidents are assessed and, where required, reported under the applicable procedure.

15. Automated decision-making

The current Importeria application does not make solely automated decisions producing legal or similarly significant effects for customers. AI assistance in Wine Studio has no independent publication authority.

Stripe may use its own automated fraud and security controls under its terms. Current provider information must be checked before approval.

16. Privacy rights

Where applicable, you may request access, rectification, erasure, restriction or portability, object to processing, and withdraw consent without affecting earlier lawful processing.

Send requests to info@importeria.com. We may request proportionate information to verify your identity and authority.

17. Complaints and supervisory authority

For a privacy complaint, first contact info@importeria.com. You may also complain to the Dutch Data Protection Authority or approach a competent court.

18. Changes and version evidence

We publish a new dated version for material changes. Historical order consents and checksums remain unchanged. A new version does not apply retroactively.

Password recovery and one-time sign-in codes

At your request we send a recovery message or temporary one-time sign-in code to your account email address. We process account, request, security and delivery information to provide secure access and limit abuse.