Privacy policy

2. The short version

• We do not use advertising pixels or tracking cookies. To count visits we use Cloudflare Web Analytics, which sets no cookies and does not track you across sites.
• We collect what you type into our site audit form and what you give us when you book a call.
• We use it to reply to you, carry out the audit you asked for and talk about a possible project.
• We do not sell or share your personal data for advertising.
• We do not add you to a marketing list unless you ask us to.

3. What we collect

When you fill in the site audit form (Contact page):

• Your name, email address and winery name (required)
• Your current website and the platforms you use (optional)
• Your message (optional)

We need the required fields to reply to you. If you leave them out, we cannot send the audit.

When you book a call through Calendly: the details you enter in Calendly's booking page, such as your name, email, chosen time and any answers to booking questions.

When you email us: your email address, the content of your message and anything you choose to attach.

When you visit any page: like every website, our hosting providers receive technical data needed to deliver the page and keep the site secure. This includes your IP address, browser type, device information, the page requested and the time of the request. On the Contact page, Cloudflare Turnstile checks that the form is being used by a person and not a bot (see section 6).

Cookieless analytics: every page loads Cloudflare Web Analytics so we can count visits and see how fast pages load. It records the page URL, the referring page, your browser, your device type and the country derived from your IP address. According to Cloudflare, it uses no cookies or local storage, does not track you across sites and does not store your IP address (see section 5).

We do not ask for and do not want sensitive data, such as health information or government ID numbers. Please do not include it in the form.

4. Why we use it and our legal basis

For visitors in the EU, UK and Switzerland, the GDPR requires us to state a legal basis for each use.

We do not use your data for automated decisions or profiling that has legal or similar effects on you.

Marketing. We do not send marketing emails to people who fill in the form. If you ask to receive news from us, we will only send it with your consent, and you can withdraw that consent at any time.

5. Who we share it with

We use a small number of service providers who process data on our behalf, under their own terms and data protection agreements:

Cloudflare states that it also acts as an independent controller for Turnstile signals it uses to improve its bot detection. Calendly's own booking pages are covered by Calendly's own privacy notice and cookie settings.

We may also disclose data if the law requires it, to protect our rights, or to a buyer or successor if our business is sold or reorganised. We do not sell personal data.

6. Spam protection on the form

The Contact page loads Cloudflare Turnstile to block automated spam. According to Cloudflare, Turnstile processes signals such as your IP address, TLS fingerprint, browser user agent and the site key, and Cloudflare says it cannot directly identify individuals from these signals. In our tests Turnstile set no cookies on this site. Turnstile runs only on the Contact page.

7. International transfers

We are based in the USA, and our providers process data in the USA and other countries. If you are in the EU, UK or Switzerland, your data is transferred to the USA.

Each provider states the following safeguards in its public privacy information:

• Webflow: participates in the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. Data Privacy Framework, and offers Standard Contractual Clauses to customers.
• Cloudflare: relies on its certifications under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. Data Privacy Framework.
• Calendly: relies on the EU-U.S. Data Privacy Framework, Standard Contractual Clauses and the UK Addendum.
• Google: complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension, and its data processing terms provide for Standard Contractual Clauses or another recognised transfer solution.

WolfxTech LLC itself receives your data in the USA in order to reply to you, which is necessary for the steps you asked us to take (GDPR Art. 49(1)(b)).

8. How long we keep it

• Audit requests, emails and booking details: for up to 24 months after our last contact with you, unless you become a client. Client records are kept for the length of the project and as long as tax and legal rules require after it ends.
• Technical and security data: kept by our hosting and security providers for the short periods set out in their own policies.
• You can ask us to delete your data sooner (see section 9).

9. Your rights

If you are in the EU, UK or Switzerland, you have the right to:

• access the personal data we hold about you
• correct it
• have it deleted
• restrict how we use it
• receive it in a portable format
• object to our use of it based on legitimate interests
• withdraw consent at any time, where we rely on consent

You also have the right to complain to a data protection authority. In Italy this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it. You can also complain to the authority in the country where you live or work.

If you are in the USA, privacy laws in California and several other states give residents rights to know what personal data we hold, to access and correct it, to have it deleted, and to opt out of its sale, sharing for targeted advertising or profiling. You will not be treated differently for using these rights. You may use an authorised agent, and we may need to verify your request. For California residents, in the last 12 months we have collected these categories of personal information:

• identifiers (name, email address, IP address)
• professional information (winery name, website, platforms you use)
• internet or network activity (technical data from your visit)
• the content of messages you send us

We collected them from you and your device, for the purposes in section 4, and disclosed them only to the service providers in section 5. We do not sell or share personal information (as those terms are defined in the CCPA/CPRA), and we have not done so in the last 12 months. We do not collect or use sensitive personal information. We do not knowingly sell or share the personal information of anyone under 16.

To use any of these rights, email joel.hipkins@wolfxtech.com. We will reply within one month (EU/UK) or 45 days (US), and tell you if we need more time as the law allows.

10. Security

We use reputable providers, encrypted connections (HTTPS) and access limited to the people who need it. No system is perfectly secure, so we cannot guarantee absolute security.

11. Children

This website is for wine businesses. It is not aimed at children and we do not knowingly collect data from anyone under 16. If you think a child has sent us data, contact us and we will delete it.

12. Links to other sites

Our site links to other sites, such as Calendly and wolfxtech.com. Their own privacy policies apply when you visit them.

13. Changes

We will update this policy when the site or our practices change, and change the effective date at the top. If a change is significant, we will make it clear on this page.

14. Contact

WolfxTech LLC (WolfxWine), 9 Raintree Rd, Chadds Ford, PA 19317, USA

joel.hipkins@wolfxtech.com