Privacy Policy

Last updated: 1 November 2026

This policy explains which personal data we process when you visit vadio.pt, buy from our online shop, join the Perpetuum Club or get in touch with us, what we use it for and what rights you have. We comply with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Portuguese Law no. 58/2019 of 8 August.

1. Who is responsible for your data

The data controller is Vadio Wines, Unipessoal, Lda., tax number (NIPC) 510979017, registered office at Rua Dr. Manuel Rodrigues, n.º 28A, 3780-594 Vilarinho do Bairro, Portugal.

For any question about your data or to exercise your rights, write to geral@vadio.pt or call +351 913 036 846. We are not required to appoint a data protection officer and have not appointed one.

2. What data we process, why, and on what legal basis

Online shop orders. Name, email, phone number, billing and delivery address, tax number (if you provide it for the invoice), products ordered, amounts and order history. We use this data to process, ship and invoice your order and to provide after-sales support, including returns and warranty. Legal basis: performance of the contract (Article 6(1)(b) GDPR) and compliance with legal obligations, namely tax obligations (Article 6(1)(c)).

Payments. Payments are processed by Stripe. Card details are entered directly on Stripe’s secure page and never reach us; we only receive the payment confirmation, the payment method and, for cards, the brand and last four digits. Legal basis: performance of the contract. Stripe also processes data to prevent fraud, as a controller, under its own privacy policy.

Perpetuum Club. Your order data, joining date, chosen plan and history of renewals and shipments. We use them to manage the subscription, charge each semester, prepare shipments and invite members to Club events. Legal basis: performance of the contract.

Members area (My Account). To sign in, you enter the email of your subscription and we email you an access code; we do not use passwords. We use your email to confirm with Stripe that you have an active subscription, to show you your plan, the date of the next charge and the exclusive bottles still available this semester, and to handle the requests you make in the members area, such as skipping a shipment or managing your subscription. Legal basis: performance of the contract.

Newsletter and waiting list. Your email address and, if you provide it, your name. We use them to send you Vadio news, releases and offers. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time through the link in every email or by writing to us. Withdrawal does not affect emails already sent.

Enquiries, requests and complaints. The data you send us by email, phone or social media, including withdrawal requests, warranty claims and complaints. We use it to reply and handle your request. Legal basis: pre-contractual steps or performance of the contract, our legitimate interest in replying to people who contact us (Article 6(1)(f)) and legal obligations, for complaints and withdrawals.

Age verification. Selling alcoholic beverages to anyone under 18 is prohibited. When you enter the site and when you order, we ask you to confirm that you are 18 or older; the confirmation is stored only in your browser and we do not collect your date of birth. If in doubt, we may ask for proof of age, which we do not keep. Legal basis: compliance with a legal obligation.

Website operation and security. When you visit the site, our hosting provider logs technical data such as your IP address, browser type and the page requested, in order to deliver the pages and protect the site against attacks. Legal basis: our legitimate interest in keeping the site secure and available.

The data requested when you order is necessary to enter into and perform the contract: without it we cannot accept the order. All other data is optional. We do not take decisions based solely on automated processing that produce legal effects concerning you.

3. Who we share data with

We do not sell or rent personal data. We only share what is necessary with:

• Stripe (Stripe Payments Europe, Limited, Ireland), which processes payments and Club subscriptions;
• Cloudflare, which hosts the website and the server that prepares payments;
• the carriers that deliver your order, which receive the delivery name, address and phone number;
• our accountants and certified invoicing software, to issue and keep invoices;
• our email and newsletter service providers;
• the Portuguese Tax Authority and other public authorities, where required by law.

Providers that process data on our behalf are bound by contract to use it only to provide their service to us and to keep it secure.

4. Transfers outside the European Economic Area

Stripe, Cloudflare and our email delivery provider belong to groups headquartered in the United States and may process data there. These transfers are covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework, for certified companies, or by the standard contractual clauses approved by the European Commission.

5. How long we keep data

• Invoices and accounting records: 10 years, as required by tax law.
• Customer and order data: for as long as the business relationship and the legal guarantee of the products last (3 years after delivery); after that we keep only what tax law requires.
• Perpetuum Club: while the subscription is active and, afterwards, for the periods above.
• Newsletter: until you withdraw your consent.
• Requests, complaints and withdrawals: 3 years after the matter is closed.
• Website technical logs: for short periods set by the hosting provider for security purposes.

At the end of these periods, the data is deleted or anonymised.

6. Your rights

At any time and free of charge, you may ask to access, rectify, erase or restrict your data, object to processing based on our legitimate interest and ask for the portability of the data you provided to us. You can always object to marketing communications and withdraw any consent you have given, without affecting processing carried out before.

To exercise these rights, write to geral@vadio.pt. We will reply within one month. We may ask for information to confirm your identity.

You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

7. Cookies and browser storage

The website only uses storage that is strictly necessary for it to work, kept in your own browser (local storage). Because it is essential, the law does not require your consent for it (Article 5 of Portuguese Law no. 41/2004 of 18 August). We do not use analytics or advertising cookies. If we ever do, they will only be activated after you allow them in the cookie notice.

• vadio-age: stores your confirmation that you are 18 or older, so we do not ask again.
• vadio-cookies: stores your choices in the cookie notice.
• vadio-cart-v1: stores the products in your basket and the shipping country.
• vadio-membro: stores your members area session (name, email and a signed session code), until you sign out or for 30 days.

This data stays in your browser until you delete it; only the members area session is sent to our server, when you use member features. The website’s fonts are hosted on the site itself. When you proceed to payment, you move to Stripe’s page, which uses its own cookies, necessary for payment and fraud prevention. The share buttons only open the social network (Facebook, X, Pinterest, LinkedIn or Telegram) if you click them, and you are then subject to that network’s policy.

Change my cookie choices

8. Security

The website always runs over an encrypted connection (HTTPS). Access to customer data is limited to the people who need it to handle orders, and payments are made through Stripe, which is PCI DSS certified. We do not store card details.

9. Minors

The website and shop are intended exclusively for people aged 18 or over. We do not knowingly collect data from minors; if we learn that this has happened, we delete that data.

10. Changes to this policy

We may update this policy to reflect changes in the law or in the way we work. The current version is always on this page, with the date of the last update. If the change is significant, we will notify customers and Club members by email.