WineryElf Privacy Policy
In force since 16 October 2026
§1 Scope of the Policy
This Policy describes the processing of personal data by Sugester sp. z o.o., with its registered office in Warsaw, in connection with the WineryElf service. The Policy applies to site visitors, customers, account users, partners, form respondents and suppliers.
The Policy covers the service available at wineryelf.com and vineyardelf.com, the application, and accounts hosted at addresses assigned to customers, being subdomains of vineyardelf.com, wineryelf.com or intum.com. The service runs on the Intum platform - activating additional modules of that platform does not change the data controller or the rules described in this Policy.
Data is processed in accordance with the GDPR (Regulation 2016/679).
§2 Data Controller
Contact with the Controller:
- Sugester sp. z o. o.
- ul. Juliana Smulikowskiego 6/8, 00-389 Warsaw, Poland
- KRS: 0000546750
- NIP (VAT ID): 5213690735
- REGON: 360942507
- Email: [email protected]
- Email: [email protected]
- Details available at: https://sugester.pl/polityka-prywatnosci
- Concluding and performing the contract (Art. 6(1)(b) GDPR)
- Compliance with legal obligations (Art. 6(1)(c) GDPR)
- Legitimate business interests (Art. 6(1)(f) GDPR)
- Marketing (Art. 6(1)(a) and (f) GDPR)
- Public authorities (public prosecutor, police, tax administration)
- Affiliated companies
- Service providers (IT, marketing, security, accounting)
- PayU S.A. and PayPal
- Site visitors: until consent is withdrawn or an objection is raised
- Customers: for the term of the contract + the period required by law (e.g. 5 years for accounting records)
- Account users: for as long as the data remains relevant
- Forms: until the enquiry is handled
- DSA reporters: until the case is handled + legal requirements
- Suppliers: for the term of the contract + legal requirements
- Marketing recipients: until consent is withdrawn or an objection is raised
- Contact you and present an offer
- Conclude a contract
- Use certain features
- Strictly necessary: keep the service running (no consent required)
- Functional: adapt the content (consent)
- Analytics: user statistics (consent)
- Advertising: personalised ads (consent)
- Session: until you log out
- Persistent: for the period set in their parameters
Data Protection Officer (DPO):
§3 Scope, purposes and legal bases of processing
Services without an account
Visitors' data is processed in order to provide the services and on the basis of legitimate interests (Art. 6(1)(b) and (f) GDPR).
Services requiring an account
Data is processed for the purposes of:
Categories of data: first name, surname, address, VAT ID, business register number, email, phone number, authentication data, as well as data entered by the Customer within the records they keep.
Partner Programme
Data processed to operate the affiliate programme, settlements and tax obligations.
Forms and online chat
Data collected to handle enquiries on the basis of legitimate interests.
Handling of illegal content (DSA)
Reporter's data processed on the basis of obligations under Art. 16-17 of the Digital Services Act.
Suppliers
Data processed to conclude contracts, meet tax obligations and maintain business relations.
Marketing
Data processed on the basis of consent or legitimate interests.
§4 Recipients of personal data
Data may be transferred to:
International transfers:
Entities in the USA that have joined the EU-U.S. Data Privacy Framework (Amazon, Google, Meta, Microsoft) receive data on that basis. Other entities only with explicit consent.
§5 Retention periods
§6 Rights related to processing
Right to withdraw consent
Possible at any time without negative consequences. Contact: [email protected]
Right of access
The right to obtain confirmation as to whether we process your personal data and to access it.
Right to rectification
The right to request correction of inaccurate data.
Right to erasure
Available where the data is no longer needed, is processed unlawfully, or an objection has been raised - subject to the exceptions in Art. 17(3) GDPR.
Right to restriction
The right to restrict processing in specific circumstances.
Right to data portability
Receiving the data in a structured format where processing is carried out by automated means to perform a contract.
Right to object
You may object to processing based on legitimate interests or to direct marketing.
Right to lodge a complaint
With the President of the Personal Data Protection Office (Poland).
Response time: 1 month from the request, extendable by a further 2 months.
§7 Providing data - voluntary nature
Providing data is in principle voluntary, however refusal may make it impossible to:
Data may come from public registers (KRS, GUS, CEIDG) or from the entity you represent.
§8 Data security
The Controller monitors risk and applies adequate security measures, with access limited to authorised persons. The same is required of its sub-processors.
§9 Cookies and pixel tags
Types of cookies:
Storage types:
Managing cookies:
You can change your preferences or withdraw consent using the dedicated button on the site. Clicking "OK" constitutes consent to all cookies.
§10 Changes to the Policy
The Policy is reviewed and updated regularly. The current version applies from 1 October 2026.
---