GDPR

GDPR

Civic association Wine from Modra — www.vinozmodry.sk Last update: 8.7.2026

This document describes how we process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as „GDPR") and Act No. 18/2018 Coll. on the protection of personal data.

1. Who is the operator

The controller of personal data is:

Civic association Wine from Modra Headquarters: Štúrova 79, 900 01 Modra ID: 42 417 341 Registration number at the Ministry of the Interior of the Slovak Republic: VVS/1-900/90-45582

(hereinafter „operator", „association", „we")

Contact details in matters of personal data protection: E-mail: ahoj@vinozmodry.sk Correspondence address: Štúrova 79, 900 01 Modra

Responsible person (DPO): It was not established, as this obligation does not follow from the GDPR (Article 37).

We are a civil association that manages the Slovak wine and viticulture appellation Wine from Modra (Víno z Modry™), brings together Modran winemakers, organizes public and professional events and promotes wine from Modra.

2. What personal data do we process and for what purpose

2.1 Membership of winemakers in the association

When you become a member of our association as a winemaker, or when you contact us with an interest in membership, we process:

  • Data: name and surname of the contact person, business name of the winery, ID number, address, e-mail, telephone number, data on vineyards and production according to the association's statutes.

  • Purpose: registration of members, fulfillment of the membership agreement, collection of membership fees, organization of joint activities, guarantee of wine origin within the appellation.

  • Legal basis: performance of the membership agreement (Art. 6 (1) (b) GDPR), performance of legal obligations (Art. 6 (1) (c) GDPR — in particular accounting).

  • Retention period: for the duration of membership and 10 years after its termination according to the Act on Accounting and Archives.

2.2 Interest in membership (form „I want to become a member')

When submitting the membership interest form, we process:

  • Data: name, surname, e-mail, telephone number, wine information, message content.

  • Purpose: assessment of interest in membership, communication about next steps.

  • Legal basis: pre-contractual measures (Art. 6 (1) (b) GDPR).

  • Retention period: 1 year from the last communication, if there is no acceptance as a member.

2.3 Registration of marketers and sellers for events

When organizing events (Wine market in Modra, Vínostan in the vintage, Winemakers in the hamlet and others), we process data from marketers and sellers:

  • Data: name and surname /business name, ID number, contact details, sales assortment, data necessary for invoicing and possible legal obligations.

  • Purpose: conclusion and performance of the contract for participation in the event, invoicing.

  • Legal basis: performance of the contract (Art. 6 (1) (b) GDPR), performance of legal obligations (Art. 6 (1) (c) GDPR).

  • Retention period: 10 years according to Act no. 431/2002 Coll. on accounting.

2.4 Sale of tickets for events

When buying tickets for our events (e.g. Winemakers in the hamlet):

  • Data: first and last name, e-mail, telephone number, data necessary to make the payment.

  • Purpose: conclusion of the contract for visiting the event, delivery of the ticket, invoicing.

  • Legal basis: performance of the contract (Art. 6 (1) (b) GDPR), performance of legal obligations (Art. 6 (1) (c) GDPR).

  • Retention period: data from accounting documents for 10 years according to the Accounting Act. Data for a claim 4 years according to limitation periods.

  • Intermediary: we sell tickets through [ADD — Squarespace Commerce /GoOut /Predpredaj.sk /other].

2.5 Contact form and communication (including form „For media')

When you contact us via the contact form, by email or phone:

  • Data: name, e-mail, or phone number, message content. When contacting the media, the editors and the position.

  • Purpose: answering your question, media communication, processing the request.

  • Legal basis: pre-contractual measures (Art. 6 (1) (b) GDPR), or our legitimate interest to communicate with interested parties, media and partners (Art. 6 (1) (f) GDPR).

  • Retention period: 1 year since the last communication.

2.6 Newsletter

When you subscribe to our newsletter:

  • Data: e-mail address or name.

  • Purpose: sending news about events, winemakers, association activities.

  • Legal basis: your express consent (Art. 6 (1) (a) GDPR), which you give by ticking the consent when submitting the form and confirming via e-mail (so-called double opt-in).

  • Retention period: until consent is revoked. You can withdraw your consent at any time by clicking on the „Unsubscribe link" in any of our e-mails or by e-mail at ahoj@vinozmodry.sk

  • The newsletter may contain tracking pixels and links that allow us to determine whether an email has been opened and which links you have clicked on.

2.7 Photographic and video recordings of events

From the public events we organize (Wine Market in Modra, Winemakers in the hamlet, Vínostan on the vintage, Open Cellars on St. Urbana, Open Cellars Day, Modran Wine Day and others), we take photos and videos that we use for:

  • promotion of a specific event and association (web, social networks — Facebook, Instagram, LinkedIn, YouTube),

  • promotion in printed marketing materials, the

  • proof that the event took place (especially for the purpose of billing possible subsidies).

  • Legal basis: legitimate interest (art. 6 (1) (f) GDPR) in general footage of public events where the person is not the primary subject of the footage. For identifiable persons in close-up (portrait photos) — your consent (Art. 6 (1) (a) GDPR).

  • We inform about the shooting when entering the event/in the conditions of the event.

  • Retention period: until withdrawal of consent, or until the purpose of promotion expires.

  • If you are pictured on the recording and do not wish to, please contact us at ahoj@vinozmodry.sk and we will remove the image from active use without delay.

2.8 Cookies and web analytics

When you visit our website, we process cookies and similar technologies. Details can be found in Policy for the use of cookies.

2.9 Protection of forms (reCAPTCHA)

We use the service when submitting forms Google reCAPTCHA (Google Ireland Ltd. /Google LLC, USA), which distinguishes a human visitor from a bot. reCAPTCHA processes your IP address, browser data and interaction with the web.

  • Purpose: web protection against abuse and spam.

  • Legal basis: our legitimate interest in protecting the Web (art. 6 (1) (f) GDPR).

  • More information can be found in google Privacy Policy.

2.10 Social networks (Facebook, Instagram, LinkedIn)

We run social media sites Facebook (@vine-blue), Instagram (@vine-blue) and LinkedIn. If you follow us on them or communicate with us:

  • Data: your profile name, message content, comments, likes.

  • Purpose: communication, promotion of events and appeals, awareness raising.

  • Legal basis: legitimate interest (Art. 6 (1) (f) GDPR).

  • Joint operator: in relation to site statistics („Page Insights"), we are together with Meta Platforms Ireland Ltd. (Facebook, Instagram) and LinkedIn Ireland Unlimited Company by joint operators in accordance with Art. 26 GDPR.

  • Privacy Policy of these platforms:

2.11 Zone for members and zone for market traders

The website contains closed sections accessible only to members or marketers. When accessing these sections, we process the data necessary to verify identity (e-mail, password, or name).

  • Purpose: providing content, documents and communications intended for members or marketers.

  • Legal basis: performance of the membership agreement or participation in the event (Art. 6 (1) (b) GDPR).

  • Retention period: during the duration of access + 1 year after its cancellation.

3. To whom we provide personal data

We can provide your personal data to these categories of recipients, always only to the extent necessary and on the basis of a contract on the processing of personal data according to Art. 28 GDPR:

Recipient Category Specific Recipient Purpose Web Platform Provider Squarespace Ireland Ltd. (Ireland) /Squarespace Inc. (USA) Web Hosting, Forms, Email Campaigns, Ticket Sales Payment Gateway [ADD — Stripe /PayPal /GoPay /Other] Ticket Payment Processing and Member Bot Protection Provider Google Ireland Ltd. / Google LLC (USA) reCAPTCHA Web Translation Provider ConveyThis Inc. (USA) Translation of web content into other languages Social network providers Meta Platforms Ireland Ltd., LinkedIn Ireland Unlimited Company Operation of FB/IG/LinkedIn pages, statistics Accounting service provider external accounting firm Accounting management Service providers in the organization of events suppliers of catering, techniques, protection Implementation of events City of Blue, partners City of Blue, Bratislava Region Travel, Malé Karpaty Travel, Ministry of Tourism and Sports Cooperation on events and promotion of the region Legal representatives, courts, public administration bodies — Only if it is necessary to protect our rights or fulfill legal obligations

4. Transfer of data outside the European Economic Area

Some of our suppliers have their registered office or server infrastructure outside the European Economic Area, in particular:

  • United States of America — Squarespace Inc., Google LLC, Meta Platforms Inc., LinkedIn Corporation, ConveyThis Inc.

  • United Kingdom — part of the Squarespace infrastructure.

The transfer of personal data to these countries takes place on the basis of:

  • Decisions of the European Commission on adequacy (United Kingdom: decision of 28. 6. 2021; USA: EU–US Data Privacy Framework effective from 10. 7/2023, to which the designated providers are certified), or

  • Standard contractual clauses according to Commission Decision (EU) 2021/914.

You can verify the company's current certification status at dataprivacyframework.gov.

5. Your rights

As a data subject, you have the following rights under the GDPR:

  • Right of access to your personal data (Art. 15 GDPR).

  • Right to rectification (Art. 16 GDPR).

  • Right to erasure („right to be forgotten", Art. 17 GDPR). This right does not apply absolutely —, it does not apply especially where the law requires us to keep data (e.g. accounting documents for 10 years).

  • The right to restrict processing (Art. 18 GDPR).

  • Right to data portability (Art. 20 GDPR).

  • Right to object against processing based on legitimate interest (Art. 21 GDPR), including a photo recording of the event you are depicted in.

  • The right to withdraw consent at any time (Art. 7 para. 3 GDPR). The appeal does not affect the legality of the processing before the appeal.

  • Right to lodge a complaint to the supervisory authority: Personal Data Protection Office of the Slovak Republic, Galvaniho Business Center II, Galvaniho 7/B, 821 04 Bratislava, www.dataprotection.gov.sk.

You can exercise your rights by e-mail at [ADD] or in writing to the address of the registered office. We will comply with your request without undue delay, no later than 30 days. In justified cases, we can extend this period, which we will inform you about.

We may ask you for additional information to verify your identity.

6. Security of personal data

We take appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, destruction or misuse. This mainly includes encrypted communication (HTTPS), access authorizations, backup and personal data processing contracts with our suppliers.

7. Automated decision-making and profiling

When processing personal data, there is no automated individual decision-making with legal effects for the persons concerned, nor profiling in accordance with Art. 22 GDPR.

8. Changes to this policy

We may update this policy from time to time. We will inform you about significant changes. The current version is always published on this page. The date of the last update is indicated at the top of the document.