Legal information
Privacy and cookies
What information you share with us when you order wine, book a winery tour or get in touch, why we need it and how you stay in control of it.
Last updated ·
This notice explains how S.R.L. “DOINA VIN” processes personal data on doinavin.md under Law No. 195/2024 on personal data protection.
The Romanian text is the reference version; the Russian and English versions are provided for information only.
01 Who is responsible for your data
The controller of your personal data is S.R.L. “DOINA VIN”, IDNO 1003600017246, registered office str. Vasile Alecsandri 82A, MD-2012, Chișinău, Republic of Moldova.
For any question or request about your data, write to us at [email protected] with the subject “Date personale” (personal data).
02 Where this notice applies
This notice covers doinavin.md in all its languages: the online shop, visit and event bookings, the customer account, the site chat and the voting and review pages.
The site and the shop are for people aged 18 or over only: you confirm your age when you arrive, and on delivery you may be asked for an identity document, because the law forbids selling alcoholic drinks to minors. We do not knowingly collect data about minors; if you learn that a minor has sent us data, write to us and we will delete it.
03 What data we process and why
We process only the data we need for what you ask us to do.
- Shop orders and quick buy. Your name, phone, e-mail address, delivery address or chosen Nova Post branch, the products, the payment method, your notes and your confirmation that you are 18 or over; for an invoice, the company name and IDNO. With each order the shop platform also records your IP address and browser type, for security and fraud prevention. We use this to receive, prepare, deliver and invoice the order.
- Payments. When you pay by card or with MIA, where these methods are available, you enter your card details on maib bank’s secure page; we never see or keep them and only receive the result of the payment. For a bank transfer, we see the payment on our bank statement.
- Delivery. We pass your name, phone and address or chosen branch to the Nova Post courier. We save the shipment number with the order so we can send you the tracking link.
- Visits, tastings and events. The date and time you want, the number of guests (adults and children), the occasion, the language, transfer, your message, your preferred channel for the confirmation (phone, WhatsApp, Telegram or Viber) and, if you need an invoice, your company details. We use them to confirm and prepare the visit.
- Customer account. Your e-mail address, name, phone, addresses and order history (see “Customer account”).
- Doina Vin Rewards programme. If you have an account, we keep the history of your points (the date, the number of points, the reason and, where relevant, the order number) to keep track of the points you earn and use. This data is deleted together with your account. When you open an invitation link, your browser keeps the code in the “dv_inv” cookie for up to 30 days, so that the invitation discount is applied in your cart.
- Messages. When you write to us by e-mail, phone, WhatsApp, Viber, Telegram or the site chat, we process your contact details and the content of the message so we can reply.
- Votes and reviews. Your e-mail address when you vote in the Bubble Lab; your name (or “Anonymous”), an optional e-mail, the rating and the text of reviews written on the site (see “Votes and reviews”).
- Order tracking. The order number and the phone or e-mail you enter on the order tracking page are used only to find your order; we do not keep them.
- Age check. Your answer is kept only in your browser, in a cookie; we do not ask for an identity document on the site.
- Technical data. Our servers automatically record the IP address, browser type, date and time and the pages requested, to keep the site secure and working. Anti-abuse limits use the IP address only as a hash, for a short time.
- Our own statistics, without cookies or personal data. We count page visits, the source of the visit (only the domain of the site you came from, for example google.com, or the link’s utm parameters), the device type, the page language and the country (from the Cloudflare network). We set no cookies, use no browser storage and store no IP addresses. To count each visitor only once a day, we briefly use a hash of the IP address and the browser, made with a random key of the day; the key and the hashes are deleted an hour after the day ends, and the statistics keep only daily totals, for 400 days. If your browser sends the “Global Privacy Control” or “Do Not Track” signal, the visit is not counted. Legal basis: our legitimate interest in knowing how the site is used.
- Statistics, only with your consent. Google Analytics records the pages visited, where the visit came from, the device type and the steps towards an order, with pseudonymous identifiers. If you are signed in, we also pass it an internal account identifier, never your name or e-mail.
- Google maps and reviews, only with your consent or on click. The map and the reviews load from Google, which receives your IP address and browser data.
- Marketing messages. We do not send you marketing without your separate consent, given by ticking a box that is not pre-ticked and that your order does not depend on. You can withdraw it at any time with a simple message.
04 Legal bases
Each processing operation rests on one of the bases in Article 6(1) of Law No. 195/2024. We do not take decisions based solely on automated processing that produce legal effects for you.
- Contract (point b). Orders, delivery, payment, visit bookings and the customer account: the data is needed to enter into and perform the contract at your request; without it we cannot take the order or the booking.
- Legal obligations (point c). Accounting and tax records of sales, the age check when selling alcoholic drinks and answers to requests from public authorities.
- Legitimate interest (point f). Replying to messages, site security and abuse prevention, the team’s internal order notifications, showing public Google reviews and defending our rights in a dispute. You may object to this processing at any time.
- Consent (point a). Google Analytics statistics, Google maps and reviews loaded automatically, voting in the Bubble Lab and marketing messages. Consent can be withdrawn as easily as it was given, without affecting processing carried out before.
05 Who we share data with
We never sell or rent your data. We share it only with the providers we need for the site and orders to work, who process it on our behalf, or where the law requires it.
- Nova Post. The courier receives your name, phone and address or chosen branch to deliver the order.
- maib. The bank you pay through by card or MIA receives the amount, the order number and what you enter on its secure page.
- Banks. For a bank transfer, the payment details pass through your bank and ours.
- Microsoft (Azure). Hosting of the site, the shop and the database on servers in Sweden (European Union), and the server backups.
- Cloudflare. The network that delivers our pages to you: the secure connection, protection against attacks, hiding e-mail addresses from bots and a technical page-speed statistic without cookies. We also keep encrypted backups with Cloudflare.
- Brevo. Sending the site’s e-mails: order confirmations, sign-in codes and replies.
- Google. Only if you choose or allow them: sign-in with Google, Google Analytics statistics, Google maps and reviews.
- Telegram. Messages from the site chat reach the team through a Telegram group; sign-in with Telegram; the team’s internal notifications of new orders (order number, name, phone, delivery address and products).
- Public authorities. Only when the law requires it, for example the tax authorities or the courts.
06 Transfers outside the Republic of Moldova
The site’s servers are in the European Union (Sweden), and Brevo is a company based in France. Transfers to European Economic Area countries need no special authorisation (Article 44(2) of Law No. 195/2024).
Google and Cloudflare may also process data outside the European Economic Area, including in the USA; their contract terms for customers include the standard data protection clauses adopted by the European Commission (Article 46(2)(c) of Law No. 195/2024). Telegram (Telegram Messenger Inc.) processes chat messages and Telegram sign-in data on its own servers, which may be outside the Republic of Moldova and the European Economic Area; this is why the chat and Telegram sign-in are optional, and you can always e-mail or call us instead.
You can ask us about the safeguards used by writing to [email protected].
07 How long we keep data
We keep data only as long as needed for the purpose we received it for, or as long as the law requires. These are the periods the site applies today.
- Orders, bookings and accounting records. For the period that accounting and tax law sets for primary documents and invoices.
- Customer account. As long as you keep the account; when you ask, we delete it, except for orders the law requires us to keep.
- Site chat. 90 days after the last message, after which the conversation is deleted from the site automatically; copies in the team’s Telegram group are deleted on request.
- Sign-in codes sent by e-mail. 15 minutes.
- Messages by e-mail or messenger. As long as needed to resolve your request.
- Bubble Lab votes. Until you ask us to delete them.
- Reviews written on the site. While the review is published, or until you ask us to delete it.
- Google reviews shown on the site. The technical copy is refreshed daily and kept for at most 29 days.
- Your cookie choice. The dv_consent cookie lasts 180 days; the log of choices, without IP addresses, is kept for 3 years, the longest time limit for a complaint (Article 72 of Law No. 195/2024).
- Google Analytics statistics. According to the data retention setting of the winery’s Google Analytics account; the _ga cookies expire after 2 years at most.
- Server technical logs. Overwritten automatically as they fill up (at most 30 MB per service).
- Backups. Daily database copies: 7 days on the server; encrypted off-site copies: at most 3 months; whole-server copies: 30 days.
08 Your rights
Law No. 195/2024 on personal data protection, aligned with the EU General Data Protection Regulation (GDPR), applies from 23 August 2026 and repealed Law No. 133/2011. You can exercise the rights below free of charge by writing to [email protected]. We reply without undue delay and within one month at the latest; for complex requests this may be extended by two months, and we will tell you. To protect your data, we may ask you to confirm that the request comes from you.
Access
To find out whether we hold data about you, what it is, and to receive a copy.
Rectification
To have inaccurate data corrected and incomplete data completed.
Erasure
To have data deleted that we no longer need or have no right to keep.
Restriction
To ask us to limit processing, for example while we look into an objection.
Portability
To receive the data you gave us in a structured format another controller can use.
Objection
To object to processing based on our legitimate interest and, at any time, to marketing.
Withdrawing consent
At any time, for example under “Cookie settings”, without affecting processing carried out before.
Complaint
To the National Centre for Personal Data Protection: str. Serghei Lazo 48, MD-2004, Chișinău; tel. +373 22 820 801; [email protected]; www.datepersonale.md. You can also write to us first.
09 Cookies and local storage
Cookies are small files a site saves in your browser; local storage works in a similar way. We use them in three categories.
Strictly necessary: without them the cart, checkout, your account, the language and the age check do not work, so they need no consent. Statistics (Google Analytics) and Google maps and reviews: switched on only if you allow them in the cookie banner. Until then the site does not load Google Analytics and sends no data to Google.
You can change your choice at any time in Cookie settings; the link is also at the bottom of every page. If you withdraw consent to statistics, the _ga cookies are deleted from your browser. You can also delete cookies in your browser settings; you will then be asked again about your age and cookies.
10 Customer account and sign-in with Google or Telegram
A customer account is optional: you can order without one. If you create an account, we keep your e-mail address, name, phone and the addresses you enter, your orders and, if you choose them, your preferred messengers, so we can show your orders and fill in your next order faster.
You can sign in with a code sent by e-mail, with Google or with Telegram. With Google we receive your name, e-mail address and sometimes your profile photo; with Telegram we receive your name, username and Telegram account identifier. We never receive your password and never post anything on your behalf.
Deleting your account. You can ask us to delete your account at any time: write to [email protected] with the subject “Ștergerea contului” (account deletion) from the account’s e-mail address. We delete the account within one month and confirm by e-mail; invoice data and orders already delivered are kept only as long as the law requires. You can also remove Doina Vin’s access in your Google or Telegram account settings.
11 The site chat
The chat in the “Write to us” window is optional. If you write there, we keep your messages and our replies, the language and the address of the page you wrote from, your preferred channel, your phone number or e-mail address and, if you fill it in, your name. We use them only to reply to you. We ask for the phone or e-mail before the first message so we can reply even after you close the page; if you are signed in, we take it from your account.
Messages reach the Doina Vin team in Telegram: the site’s bot posts them in a team group, and replies given there come back to the page. Telegram (Telegram Messenger Inc.) processes them on its own servers, which may be outside the Republic of Moldova. Please do not write card details, passwords or other sensitive data in the chat.
To show you the conversation, your browser keeps the strictly necessary dvchat_s cookie, set only after you open the chat. On the site, conversations are deleted automatically 90 days after the last message; copies in the team’s Telegram group are deleted on request. You can ask us to delete a conversation sooner by writing to [email protected].
12 Votes and reviews
Bubble Lab. To vote you give us your e-mail address; we use it only to count one vote per person and to show you your picks. We do not publish it or use it for advertising. Your browser keeps it locally (dvbl_email) so you do not have to type it again. You can ask us to delete your vote and address at any time.
Reviews written on the site. We publish your name (or “Anonymous” if you choose), the rating and the text. The e-mail address is optional and never published; if it matches an order, the review may get the verified purchase mark. We do not keep the author’s IP address.
Google reviews. Some pages show public reviews of the winery from Google (the name, photo and text their authors published there), linked to Google. The technical copy is kept for at most 29 days, and authors manage their reviews directly in Google.
13 Data security
The site works only over an encrypted connection (HTTPS). Only the team members who need them can see orders and customer data, each with their own account and role. Off-site backups are encrypted.
If a personal data breach could put your rights at risk, we notify the National Centre for Personal Data Protection within 72 hours of finding it and, if the risk is high, we tell you as well.
14 Changes to this notice
When we change how we process data, we update this page and the date at the top. If a change affects you directly, for example a new purpose that needs your consent, we will ask you again beforehand.