Privacy policy

This policy explains how personal information is handled in connection with browsing Vinetur, inquiries, user accounts and contributions, the newsletter and advertising services. Information provided in a particular form or purchase process supplements this policy. Reading it or accepting account terms does not mean consenting to every use of your data.

1. Data controller and contact details

The controller is VGSC, S.L., Spanish tax identification number B70255591, the publisher of Vinetur. Its tax address and operating office are at calle Castelao 17, 1B, 36600 Vilagarcía de Arousa, Pontevedra, Spain.

Send privacy inquiries and requests to exercise your rights to [email protected] or to that postal address, explaining that your message concerns data protection. Publisher details and service terms are available in the legal notice.

2. Information we handle and where it comes from

• Inquiries and correspondence: information you provide, such as your name, email address, subject, message and any documents you choose to attach.
• User accounts: name, username, email address, login credentials, edition or language, and dates and technical records of registration, verification and access. Your profile may also include a picture, description and website.
• Contributions: text, images and other material submitted, authorship and editing information, and communications needed to review or manage publication.
• Newsletter: email address, name where available, linked account if any, selected edition, and records of subscription requests, confirmation, preferences and unsubscribing.
• Purchases: contact and representative details, tax information, orders, invoices and communications about the service. Services paid by direct debit may require an IBAN, BIC and debit mandate details.
• Browsing, security and measurement: IP address, browser or device information, access and incident logs, identifiers and visit, impression or click events, depending on the function used. Email measurement may associate opens or clicks with a recipient.

Information comes primarily from your interactions with Vinetur and what you provide. For purchases, it may also come from a person acting on the customer's behalf. Journalism may draw on public sources, people involved in a story, contributors or other reporting sources; publishing that information requires consideration of its relevance and the rights of the people concerned.

Provide information relevant to the request you are making. If you supply other people's information or images, you must have a basis for doing so and respect their rights. Required fields enable the relevant function; without them, we may be unable to process your request. Optional profile information is not needed to receive a reply to an inquiry.

3. Purposes and legal bases

• Answering inquiries and handling requests. Information is used to respond and take the steps you request. For service inquiries, the basis is taking steps before entering into a contract or performing the relevant relationship; for other correspondence addressed to Vinetur, it is our legitimate interest in responding.
• Creating and administering accounts. Processing needed to register, verify and authenticate an account, manage preferences and provide requested functions is based on performing the service terms. Verification, access recovery and security messages are part of this administration.
• Managing profiles and contributions. Publishing and administering the information and material you submit for these functions is connected to providing the requested service under its terms. Journalism also requires balancing data protection with freedom of expression and information. Requests concerning a news story are assessed in light of its content, timeliness, news value and the rights affected.
• Providing and invoicing advertising services. The basis is performing a contract or taking steps requested before contracting. Tax and accounting administration is based on applicable legal obligations. Details of representatives and contact persons are used to manage the relationship with the organization they represent.
• Sending the newsletter you requested. Voluntary subscription is based on consent. Choosing the newsletter is separate from accepting registration terms, and consent can be withdrawn without closing your account.
• Protecting the service and preventing abuse. Managing access, automated-use attempts, fraud and incidents is based on the legitimate interest in protecting accounts, systems and users, subject to legal obligations and specific requirements applicable to the technologies used.
• Measuring use and results. Measurement functions record visits and interactions with content, advertising and emails. Cookies or technologies that store information on or access a device require prior consent unless an exemption applies. Subsequent processing of personal information also needs a valid legal basis. These technologies are explained in the cookie policy.
• Handling rights requests, complaints and official demands. Necessary information is processed to meet legal obligations and, where applicable, for the legitimate interest in establishing, exercising or defending legal claims.

Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without giving those reasons. Consent for one purpose does not automatically cover others.

4. What is public on a profile

A user profile displays the name, username, picture you have added, description and website you choose to publish, along with associated contributions and their visible counters. Other people can view this information and search engines may index it.

The email address used to manage an account is not displayed as a public profile field. If you include it yourself in a description, text, image or other public content, it may be visible within that content. Tax and bank details supplied for purchases are not part of your public profile.

Removing a contribution or deactivating an account does not guarantee immediate removal of copies already made by others or search engines. You may send Vinetur a specific request so we can assess appropriate action within our responsibility.

5. Newsletter and email measurement

The newsletter delivers Vinetur's informational content and may include advertising or sponsored content. You can request it through subscription forms or select the optional newsletter choice during registration. A standalone subscription requires confirmation through the link emailed to you; when registering an account, activation of the selected newsletter is linked to account email verification.

Unsubscribe using the link in newsletter emails, through your account's newsletter settings where linked, or by writing to [email protected]. Unsubscribing does not require closing your account and does not prevent messages necessary for something you requested, such as verifying access or handling an order.

Emails may use tracking images and links to record opens, clicks or advertising interactions. Depending on the function, records may be associated with the subscriber, message, advertisement, edition, date and technical information such as the IP address. An encoded identifier does not, on its own, make these records anonymous.

Requesting a newsletter does not mean giving unrestricted permission for measurement. Tracking technologies must meet their own transparency requirements and, where required, consent requirements. Email software may block remote images, although this does not necessarily prevent all records associated with opening links.

6. Providers, recipients and external services

IONOS provides Vinetur's server and hosting, domain and email services. These may involve processing needed to deliver those services. Other recipients may include banks involved in collecting payment, accounting or legal professionals where needed for the relevant matter, and public administrations, courts or authorities entitled to receive information under a legal obligation.

Elastic Email helps deliver newsletters and receives information needed to send them, such as the recipient address and message content, and to handle delivery and related incidents. Subscription and statistics management also uses AcyMailing software installed on Vinetur; using that software does not, by itself, mean information is disclosed to its vendor.

Cloudflare provides content delivery and web traffic protection. These functions may involve processing IP addresses and browser request information.

OpenAI supports tasks such as organizing communications and sources, preparing content and images, and editorial translation. DeepL is retained as a backup translation tool. These functions may send providers text, images or extracts of communications containing personal information. Use must be limited to the relevant purpose and is not permission to use that information for any other purpose.

The site integrates Google services, such as Analytics for measurement and reCAPTCHA in registration or subscription functions. reCAPTCHA verification may send Google the interaction result or token and IP address, in addition to information collected by the browser integration. Its use must be considered alongside the cookie policy and Google's privacy policy.

When you follow external links or interact with integrated services, the provider may process information under its own role and policy. Linking to a third-party policy does not replace Vinetur's own information duties or obligations.

A provider's brand alone does not establish where all information is processed. External services may involve processing outside the European Economic Area. Locations, subprocessors and, where relevant, transfer mechanisms depend on the service and its applicable terms. You can request information about recipients and transfers affecting your data at [email protected]. You should not assume that all processing is confined to Spain or the European Union.

7. Retention, deactivation and erasure

Retention must relate to the purpose for which information was collected and any continuing obligations or liabilities. The following criteria apply:

• Inquiries: as long as needed to respond and complete the matter; if an inquiry leads to a contract, incident or claim, the corresponding criteria apply.
• Accounts: while used to provide the service and, after deactivation, where retention is justified by obligations or liabilities. The delete-account option deactivates access and revokes sessions; it does not immediately and completely erase every related record.
• Newsletter: while subscribed, to send messages. Unsubscribing stops that subscription and retains its status and associated information; it does not automatically erase every subscriber record. Subsequent retention must be limited to justified purposes, such as honoring the unsubscribe request, evidencing the choice or addressing liabilities.
• Purchases and invoicing: during the relationship and for periods required by commercial, tax or other applicable obligations. As a general rule, Spain's Commercial Code requires accounting documents to be kept for six years from the last entry, subject to special periods or liabilities requiring specific documents to be retained.
• Publications and news archives: during distribution and justified retention in the archive, considering freedom of information, continuing news value and affected individuals' rights. Keeping a publication available is assessed separately from the need to keep an account active.
• Security and measurement: for a period proportionate to preventing or investigating incidents and the relevant measurement purpose. A cookie or link expiring does not itself erase information already recorded in systems.

Standalone newsletter confirmation links expire after 48 hours. This limits the link's validity; it is not a promise to erase the email address or other records after that time.

Unsubscribing from marketing, deactivating an account and exercising the right to erasure are different actions. To request erasure, use the channels below. Where Spanish law requires data to be retained in a blocked state, its use must be restricted to legally specified liabilities during the applicable period, after which it must be erased. Retention does not permit continued mailings after an unsubscribe request or objection.

8. Your rights

Under the General Data Protection Regulation, you may request access to your information, correction of inaccurate information, erasure, restriction of processing and portability where applicable. You may also object to certain processing and withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Write to [email protected] or VGSC, S.L., calle Castelao 17, 1B, 36600 Vilagarcía de Arousa, Pontevedra, Spain, stating the right you wish to exercise and the information needed to locate your records. An identity-document copy is not routinely required. Where there are reasonable doubts about identity, proportionate additional verification information may be requested.

A response must be provided without undue delay and generally within one month of receiving your request. This may be extended by up to two further months where necessary because of complexity or the number of requests; you must be told about the extension and its reasons within the first month.

If you believe your information is being handled unlawfully, you may complain to the Spanish Data Protection Agency (AEPD). You do not have to contact Vinetur first to make that complaint.

Requests concerning information in journalism are also assessed in light of freedom of expression and information and legal limits on erasure. To correct reporting or exercise the Spanish statutory right of reply, use the channel in the legal notice; that route does not replace your data protection rights.

9. Children and security

Where processing relies on consent and concerns a child under 14, Spanish law requires consent from the holder of parental responsibility or guardianship. This threshold does not replace legal-capacity requirements for purchases or mean that age is automatically verified. If you represent a child and need to report a matter concerning their information, contact Vinetur.

Service management includes authentication, verification and safeguards against unauthorized access or misuse. No system is completely secure. Protect your credentials and report suspicious access or incidents to [email protected].

10. Updates to this policy

This policy may change as processing or applicable law changes. Updating the text does not itself broaden consent or retroactively change your choices. Where new processing requires it, the relevant information must be provided and appropriate consent obtained.