Privacy policy
This page explains how personal data processed through this website is collected, used and protected in accordance with the applicable data-protection regulations.
1. Data controller
The controller responsible for personal data collected through this website is Javier Uriarte Ormaeche, with tax identification number 14960840Fand registered address at Elexalde neighbourhood, Eguzkitza Farmhouse, 48113 Gamiz-Fika, Bizkaia, Spain The contact email address is tienda@txakoli-uriarte.com .
The principal website associated with this activity is https://txakoli-uriarte.com/.
2. Purposes of data processing
Personal data provided by users may be processed for the following purposes:
Responding to enquiries and contact requests: managing communications sent through the contact form, email, telephone or other means available on the website.
Managing visits, bookings and wine-tourism experiences: processing requests concerning winery visits, tastings, groups, availability enquiries and other wine-tourism activities.
Managing orders and commercial relationships: when the online shop is enabled, processing purchases, orders, payments, shipments, returns, incidents, customer service and the administrative or tax obligations arising from contracting.
Complying with legal obligations: meeting accounting, tax, commercial and consumer-protection obligations, and any other applicable legal obligation.
Improving the website, security and user experience: where applicable, managing the technical operation of the site, preventing abuse or fraud, protecting the website against unauthorised access and analysing use of the site where there is a sufficient lawful basis for doing so.
3. Lawful basis for processing
The lawful basis for processing will depend on the specific purpose for which the data is collected:
Consent of the data subject: where users voluntarily send an enquiry, request information, agree to receive certain communications or consent to cookies or specific processing activities.
Taking pre-contractual steps or performing a contract: where processing is necessary to manage a booking, respond to a request relating to winery services or process a purchase through the online shop.
Compliance with legal obligations: where processing is necessary to comply with tax, accounting, commercial, consumer or any other obligations required by the applicable regulations.
Legitimate interests: where necessary to ensure website security, prevent fraud, respond appropriately to technical incidents or defend the controller’s rights and interests, always within the limits established by law.
4. Categories of data processed
Depending on how users interact with the website, the following data may be processed, among other categories:
Identification and contact data: first name, surname, email address, telephone number and any other information users provide in their message or enquiry.
Data relating to bookings or visits: number of people, preferences, specific requests, date of visit and any information necessary to manage the requested experience.
Data required for contracting and purchasing: billing details, delivery address, order information and all information essential to the commercial and administrative management of the transaction.
Technical browsing data: IP address, technical identifiers, device data and information derived from the use of cookies, where applicable according to the site configuration and the consent given.
5. Mandatory or optional nature of the data
As a general rule, information requested in form fields marked as mandatory is necessary to respond to an enquiry, manage a request or provide the service correctly.
Failure to complete mandatory fields may prevent the request from being processed, the enquiry from being sent or the corresponding relationship from being established.
6. Recipients of the data
Personal data will not be disclosed to third parties except where required by law or where necessary to provide the requested service correctly.
Depending on the functions enabled at any given time, certain providers acting on behalf of the controller may have access to personal data, for example:
hosting and technical-support providers, email providers, form and anti-spam tools, analytics services, payment gateways, e-commerce platforms, carriers, accounting or tax advisers and other technology providers required to operate the website or manage the activity.
Where applicable, they will process the data as processors or under their own legal framework when acting as independent controllers, as appropriate.
7. International data transfers
Some technology providers used by the website may be located outside the European Economic Area or process data from territories outside it.
In such cases, international data transfers will be carried out with the appropriate safeguards required by applicable law, such as adequacy decisions, standard contractual clauses or other valid mechanisms provided for by current legislation.
8. Data retention
Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected and, subsequently, for the periods required by the applicable regulations or for as long as necessary to address possible legal liabilities.
As a general guide:
Enquiries and communications: for as long as necessary to respond to the request and, where applicable, for the period required to follow up the relationship or defend against possible claims.
Bookings or visits: for as long as necessary to manage the corresponding activity and for the subsequent period required to address incidents or related liabilities.
Customer and order data: for the duration of the contractual relationship and the retention periods required by tax, accounting, commercial or consumer regulations.
9. Rights of data subjects
Data subjects may exercise the following rights under the terms established by applicable law:
access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw consent where processing is based on that consent.
To exercise these rights, send a request to tienda@txakoli-uriarte.com , clearly stating the right you wish to exercise and providing the information required to verify your identity where necessary.
If you believe your rights have not been properly addressed, you may also lodge a complaint with the Spanish Data Protection Agency (AEPD).
10. Minors and the sale of alcoholic products
This website is intended for adults insofar as it may contain information and services concerning alcoholic products and, in the future, offer them for sale.
The controller reserves the right to establish controls, verification mechanisms or warnings designed to prevent minors from accessing, purchasing or requesting products or services where legally required or advisable.
Users undertake to provide accurate data and use the website in accordance with applicable law.
11. Data security
The controller adopts reasonable technical and organisational measures to protect personal data and prevent its loss, alteration, unauthorised processing or improper access, taking into account the nature of the data, the risks of processing and the state of the art.
Nevertheless, absolute security cannot be guaranteed on the Internet, so users must also act diligently when using their devices and communications.
12. Third-party links
This website may contain links to third-party websites or services. The controller accepts no responsibility for the privacy policies, content or practices of those external sites.
We recommend reading each third party’s corresponding policies before providing personal data or interacting with their services.
13. Changes to this privacy policy
Javier Uriarte Ormaeche may amend this Privacy Policy where necessary to adapt it to regulatory, technical or organisational changes or to changes in the services offered through the website.
If it is updated, the new version will be published on this page.
Last updated: 23 April 2026