Privacy policy
This document explains which personal data we process, why, on what legal basis and for how long, and what your rights are under the General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter: GDPR). Effective from 22 October 2026.
1. Controller
| Business name | VERALDA, zajednički obrt za poljoprivredu, vl. Olga Visintin i Luciano Visintin |
|---|---|
| Registered address | Kršin 3, HR-52474 Brtonigla – Verteneglio |
| OIB | 52046688986 |
| VAT | registered for VAT in Croatia |
| Craft registration number | 91616280 |
| Craft licence number | 18010400888 |
| Craft register entry | Decision of the Istria County KLASA UP/I-311-03/24-01/77, 8. 7. 2024. |
| info@veralda.hr | |
| Phone | +385 (0)52 774 111 |
| IBAN | HR6723400091160444458 (PBZ) |
For any questions about personal data and to exercise your rights, write to us at info@veralda.hr or by post to Kršin 3, HR-52474 Brtonigla – Verteneglio, Croatia.
We have not appointed a data protection officer, as we are not required to do so under Article 37 GDPR.
2. What data we process and why
Enquiries by phone, e-mail or at the cellar
| Data | name, e-mail, phone number, content of the enquiry |
|---|---|
| Purpose | answering the enquiry and preparing an offer |
| Legal basis | steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in replying (Art. 6(1)(f)) |
| Retention period | one year from the last message; if the enquiry led to an order, the retention period for orders applies |
Orders by phone or e-mail and delivery
| Data | name, delivery address, phone number, e-mail, products ordered, amount, payment and delivery details, correspondence about the order, withdrawal and defects |
|---|---|
| Purpose | concluding and performing the contract, delivery, refunds on withdrawal, handling defects |
| Legal basis | performance of the contract (Art. 6(1)(b) GDPR) and legal obligations under consumer and civil obligations law (Art. 6(1)(c)) |
| Retention period | 3 years from delivery (the period of liability for defects and the time limit for exercising the related rights under the Civil Obligations Act) or, if proceedings have been brought, until they are finally concluded. Invoices are kept longer (see Invoices). |
Invoices
| Data | details shown on the invoice (name, address where stated, products, amount, date) |
|---|---|
| Purpose | compliance with tax and accounting obligations |
| Legal basis | legal obligation (Art. 6(1)(c) GDPR) |
| Retention period | 10 years from the start of the limitation period, unless a longer period is prescribed by a special regulation (General Tax Act, Article 66) |
Complaints
| Data | name, contact details, content of the complaint and our reply |
|---|---|
| Purpose | handling complaints and keeping the required records |
| Legal basis | legal obligation (Art. 6(1)(c) GDPR, Consumer Protection Act, Article 10) |
| Retention period | one year from receipt of the complaint (Consumer Protection Act, Article 10), longer if needed for a dispute |
Wine tasting bookings (web form)
| Data | name, e-mail, phone number, date and time, number of persons, chosen tasting, message |
|---|---|
| Purpose | receiving and confirming the booking, contacting you about it |
| Legal basis | pre-contractual steps and performance of the contract (Art. 6(1)(b) GDPR) |
| Retention period | 12 months after the date of the tasting, after which the booking is deleted automatically |
Newsletter
| Data | e-mail address (and name, if you provide it), time of subscription and confirmation |
|---|---|
| Purpose | sending news about our wines, events and offers |
| Legal basis | consent (Art. 6(1)(a) GDPR), which you can withdraw at any time using the unsubscribe link in every newsletter or by e-mail |
| Retention period | until you unsubscribe or withdraw consent |
Visiting the website (technical logs)
| Data | IP address, time of access, requested page, browser information |
|---|---|
| Purpose | operation and security of the website |
| Legal basis | legitimate interest (Art. 6(1)(f) GDPR) |
| Retention period | no longer than 2 months |
Cookies and third-party tools
| Data | your cookie choice, IP address and browser information (when third-party content is loaded) |
|---|---|
| Purpose | necessary cookies: site operation and remembering your language and cookie choices; others: third-party content (map) |
| Legal basis | necessary cookies: legitimate interest (Art. 6(1)(f) GDPR); all others: consent only (Art. 6(1)(a)) |
| Retention period | see the Cookies page |
Age verification
We sell wine only to adults (legal obligation, Art. 6(1)(c) GDPR). Age is checked by looking at an identity document when the goods are handed over (at the cellar or by the courier). We do not copy the document or store any data from it.
Third-party tools on the website
The following tools are used only with your consent, which you give and withdraw in the cookie settings (see Cookies):
- Google Maps (map on the website): the map is loaded only when you click on it or accept external content in the cookie settings. Google then receives your IP address and browser information.
3. Recipients
We do not sell personal data. We share it only with recipients who need it for the purposes listed above:
- DPD CROATIA d.o.o. (DPD DIREKTNA PAKETNA DISTRIBUCIJA CROATIA d.o.o.), Slatinska ulica 7, 10360 Sesvete, Croatia, courier: name, address, phone number and e-mail for delivery.
- SETCOR d.o.o. (MyDataKnox), Ulica Roberta Frangeša Mihanovića 9, 10000 Zagreb, Croatia, hosting provider of the website and e-mail. The servers are located in a data centre in Jastrebarsko, Croatia.
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Maps), only with consent.
- competent authorities, where required by law.
Transfers outside the EU/EEA
Google may also transfer data to its affiliate Google LLC in the USA. The transfer is based on the European Commission adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), in which Google LLC participates. DPD and the hosting provider process data within the EU.
4. Do you have to provide your data
We need the data listed above for orders, delivery and bookings. Without them we cannot conclude or perform the contract. Providing data for the newsletter and consenting to cookies is voluntary. We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you.
5. Your rights
Under the GDPR you have the right:
- of access to your data (Art. 15);
- to rectification of inaccurate data (Art. 16);
- to erasure (Art. 17), except where we are required by law to keep the data;
- to restriction of processing (Art. 18);
- to data portability (Art. 20);
- to object to processing based on legitimate interest (Art. 21);
- to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
Send your request to info@veralda.hr. We reply without undue delay and at the latest within one month (Art. 12(3)).
Complaint to the supervisory authority. If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, azop@azop.hr, azop.hr.
6. Changes
We update this policy when the way we process data changes. The current version is always published on this page.