Updated 15 October 2026.
1. Controller and contact
Vino Nobile Pood OÜ, registry code 16366217, Veerenni 17/Herne 5, 10135 Tallinn, Estonia. For personal data enquiries, contact pood@vinonobile.ee or +372 53444903.
2. Data and purposes
We receive data mainly from you when you order, use your account, contact us or choose cookie preferences. Payment and delivery partners provide the status needed to fulfil your order. Use of the store also generates technical data, such as IP address, device and browser information and pages visited.
- Orders and customer service: name, email, telephone, delivery and any required billing address, goods, amounts, payment and delivery details, and related correspondence. The basis is entering into and performing the contract (GDPR Article 6(1)(b)). Order, payment, delivery, return and refund messages are service communications and do not require marketing consent.
- Accounting and legal obligations: invoice, payment and transaction data. The basis is compliance with a legal obligation (Article 6(1)(c)). The recipient's age and identity are checked when alcohol is handed over, as required by law.
- Customer account: email, name, saved contact details and order history. The basis is providing the service you request (Article 6(1)(b)). Sign-in uses a one-time code sent by Shopify.
- Security and legal claims: necessary technical logs, transaction information and dispute correspondence. The basis is our legitimate interest in protecting the store and customers from misuse and establishing or defending claims (Article 6(1)(f)). We assess necessity and the effect on your rights.
- Marketing messages and non-essential cookies: your separate consent (Article 6(1)(a)). Consent is not a condition of purchase. Unsubscribe using the link in a marketing email or contact pood@vinonobile.ee.
A standard online order does not require your gender or national identification number. Showing identification when alcohol is handed over does not mean the store needs a copy of the document. Vino Nobile does not see your full payment card details; the payment provider processes them.
3. Service providers and transfers
Our store is hosted by Shopify, which processes visit, account and purchase data. Card payments are processed by Shopify Payments, and bank-link payments by Maksekeskus AS (MakeCommerce). The selected payment provider receives the order reference, amount, currency and contact and payment details needed to process the payment. MakeCommerce’s shipping service and the selected carrier, including SmartPosti, receive the name, email, telephone, selected pickup point or delivery address and shipment details needed to arrange delivery. SmartAccounts and, where needed, an accounting service support our accounting. The order and accounting integration runs on Cloudflare infrastructure. Providers receive data needed for their tasks. We may also disclose information to competent authorities where legally required.
Our store uses Shopify Network Intelligence. Shopify may combine customer data from our store with data from other Shopify merchants and Shopify services to provide enhanced services, including security, personalisation and, with consent, advertising services. Non-essential tracking and activity-based advertising require consent. Shopify's independent processing is described in Shopify's Consumer Privacy Policy. You can also exercise rights, object or withdraw consent relating to Shopify through the Shopify privacy portal.
Providers and subprocessors may be located outside the European Economic Area. Transfers use an applicable adequacy decision or other GDPR safeguards, such as European Commission standard contractual clauses. See also Shopify's Data Processing Addendum. Contact us for information about a particular transfer and its safeguards.
4. Cookies and choices
Necessary cookies support the cart, sign-in, security and language selection. Non-essential analytics, preference and marketing cookies depend on your cookie banner choices. You may reject them and later withdraw consent through cookie preferences. Rejecting non-essential cookies does not prevent a standard purchase. More information is available in Shopify's cookie information.
5. Retention
Accounting source documents and their personal data are retained for seven years from the end of the financial year in which the transaction was recorded. Data kept separately for order service, customer management and store operations is retained for up to one year after the relevant purpose ends; this does not shorten the statutory period for accounting documents. Marketing contact data is used until consent is withdrawn, with the currency of consent and contact details reviewed at least annually. A minimal suppression record may be retained to document an opt-out and prevent further unwanted messages.
Where there is a dispute, necessary data is retained for resolving the claim and the applicable limitation period. Security logs are retained as needed to investigate threats. Data is deleted or anonymised when its purpose and lawful retention basis end. Data subject to a statutory retention obligation cannot be deleted before that obligation expires.
6. Your rights
You may request information and a copy of your data, correct inaccurate data and, subject to the conditions in law, request erasure, restriction or portability. You may object to processing based on legitimate interests; an objection to direct marketing stops that use. You may withdraw consent at any time without affecting the lawfulness of previous processing.
Send requests to pood@vinonobile.ee. We may verify your identity proportionately. We normally respond within one month and will explain any legally permitted extension. You may complain to the Estonian Data Protection Inspectorate or seek a court remedy.
7. Changes
We publish the current policy on this page and give additional notice of material changes where required by law. An updated policy does not replace consent where new processing requires it.