Privacy policy

1. Who is responsible for your data

The data controller is WINEWORK, Copenhagen, Denmark, company number DK45753166. For any privacy question or request, write to support@wineworkgp.com.

When a business (a restaurant, a hotel or a group) opens an account on the platform and adds its team, that business is the controller of its learners' data, and WINEWORK processes that data on its behalf and on its instructions. See "Learners on the platform".

2. What we collect on the website

Contact and demo-request form: name, business name, email address, phone number and whatever you write in the message. We use it to get back to you, schedule a demo and run the sales conversation. Legal basis: steps you ask for before entering a contract, and our legitimate interest in answering people who contact us.

Website usage measurement: only if you agree in the banner, we use Google Analytics 4 to understand which pages are viewed and where visitors come from. Without your agreement nothing from Google is loaded and nothing is measured. Legal basis: your consent, which you can withdraw at any time.

Server logs: like every website, our servers record requests (IP address, browser, page, time) for security and reliability. These logs are kept briefly and are not used to profile visitors.

3. Cookies and browser storage

The site itself sets no marketing cookies. The only cookies are Google Analytics' (named _ga and names starting with _ga_), created only after you click "Agree" in the banner. They distinguish visits and measure usage, and last up to 13 months.

Your banner choice (agree or decline) is kept in your browser's local storage rather than in a cookie, so we do not ask again on every visit. You can change it at any time via "Cookie preferences" at the bottom of the site.

In the learning platform (after signing in) there is one strictly necessary sign-in cookie that keeps you signed in. It is not used for measurement or advertising.

4. Learners on the platform

The business that adds you to the platform gives us your name, email address and sometimes your role and restaurant, so we can open your access to the courses. As you learn, progress data is stored: which lessons you completed, quiz results, badges and certificates, and when you signed in.

This data runs your learning and feeds the reports your business's managers see (for example who completed which course, and the team's knowledge index). It is not sold and not passed to other businesses. WINEWORK treats it as the customer's data and processes it only to provide, support and improve the service.

Learners' requests about their data (access, correction, deletion) are handled together with the business's manager. You can also write to us directly and we will route and handle the request.

5. Who we share data with

We do not sell personal data. To run the site and the platform we rely on providers that process data on our behalf under data-processing agreements: Vercel (hosting the site and the platform; the servers that run the system are in Frankfurt), Supabase (database, sign-in and file storage, in the European Union), Resend (system emails), Mux (storage and streaming of the course videos; the video player reports an anonymous viewing id and the viewer's IP address to Mux for streaming quality), Inngest (background jobs such as reminders and reports; a job carries ids and the recipient's email address), Sentry (technical error reports, without identifying details), Anthropic (AI assistants that draft learning content; only course content is sent, never data about learners), Google Analytics (website usage measurement, only after consent) and Stripe (payment processing for business customers; card details go directly to Stripe and are never stored by us).

Some of these providers also operate outside the European Union. Where that happens, transfers rely on standard contractual clauses or other approved frameworks.

We disclose data to authorities only where the law requires it.

Data about businesses rather than people, such as wine menus, prices and what is poured by the glass, is not personal data. WINEWORK uses it in aggregated and anonymised form, and may also provide or sell such aggregated data and insights to third parties, under section 6 of the terms of use. No business is identified in it, and no personal data is part of it.

6. How long we keep data

Website enquiries: for as long as the sales conversation lasts, and up to 24 months after the last contact, unless a customer relationship is formed.

Google Analytics data: per Google's default setting, two months at user level; aggregated reports are kept without personal identification.

Platform accounts and learners: for the business's subscription term. When the business cancels, access ends at the close of the paid period and the team's history is kept for three more months so the business can come back. At the end of the three months the data is deleted. Earlier deletion is available on request, from the panel or by writing to us. Records the law requires us to keep (invoices, for example) are kept as the applicable law requires.

An employee deleted by the restaurant's manager: their identifying details are kept for 90 days from the deletion, so that registering again with the same email address within that period restores their history. At the end of the 90 days the identifying details are permanently erased by an automated process: the name, email, phone and sign-in account. The restaurant's aggregate learning data is kept without personal identification. After that erasure the history cannot be restored, and registering again creates a new employee.

7. Your rights

Under the GDPR, and under the Israeli Privacy Protection Law where it applies, you have the right to know what data we hold about you, to receive a copy, to correct it, to have it erased, to restrict processing, to object to processing based on legitimate interest, and to receive your data in a portable format.

If you consented to measurement, you can withdraw at any time via "Cookie preferences" at the bottom of the site. Withdrawal does not affect what was lawfully done before it.

To exercise a right, write to support@wineworkgp.com. We answer within 30 days. If you believe we have not handled your request properly, you can complain to the Danish Data Protection Agency (Datatilsynet) or to the Israeli Privacy Protection Authority.

8. Security

Data is stored on secured servers, transfers are encrypted (HTTPS), access inside WINEWORK is limited to those who need it for their work, and administrator access to customer accounts is logged. Course videos are served through short-lived signed links. No system is perfectly secure, but if an incident affects your data we will notify you and the authorities as required.

9. Children

The site and the platform are intended for businesses and their staff and are not directed at children. If we learn that data about a person under 16 was collected without appropriate consent, we will delete it.

10. Changes to this policy

We update this document whenever we change what we collect or do. The date of the last update is shown at the top of the page. A material change will be announced prominently on the site or by email to customers.

11. WINEPAGER: restaurant managers who register, and people who report content

Registering for the WINEPAGER repository: to open access to the full repository of wine pages we collect your full name, the name of the restaurant or business you work at, an email address and a password, and your two confirmations: that you are over 18, and that you work in the hospitality trade and use the materials for professional purposes only, under the Israeli Restriction of Advertising and Marketing of Alcoholic Beverages Law, 5772-2012. We also keep the time of registration, of email confirmation and of your last sign-in. No phone number, IP address or device identifier is collected.

Why, and on what basis: to open and operate the account you asked for (performance of our agreement with you), and to comply with the law above, which permits showing material about alcoholic beverages to trade professionals only. Your declaration is the condition of access, and its record is what shows the access was opened lawfully. The information is not used for marketing and is not passed to wine suppliers.

The free menu report: whoever sends a wine menu for a report sees a line under the upload saying that we may get back to them about WINEWORK's services, and that clicking the WINEWORK banner in the report lets us know they would like us to. By sending the menu you agree to this, and we keep which wording you saw and when. If you click the banner, one request opens on our side with the name, restaurant and email from your registration, so that we can get back to you; it is deleted after 90 days. This is the only exception to the information not being used for marketing, and it applies only to those who sent a menu after the line appeared.

How long: as long as the account is active. An account not signed into for 24 months is closed automatically. 30 days after closure, whether ours or at your request, the identifying details (name, workplace, email and the login account) are permanently erased by an automatic process, leaving only an unidentifiable record that a registration existed. You can ask for closure and deletion at any time at support@wineworkgp.com.

Notices of infringing content: anyone, including people who do not use the system, can notify us that content on a wine page infringes a right or the law (clause 18.4 of the WINEPAGER terms). For this we collect the reporter's name and email, an organisation if given, the page address, the reasons and the good-faith statement. The information is used to acknowledge receipt, examine the notice and deliver the decision, and is kept with the notice as the record of how it was handled. It is not passed to the supplier whose content it concerns. Basis: our and the reporter's legitimate interest in handling the notice, and compliance with the EU Digital Services Act. Retention: three years from the decision.

12. Restaurants' wine menus

What is kept: when a business, or a restaurant manager on WINEPAGER, uploads a wine menu, we keep the file, the lines read from it (wine, vintage, price by the glass and by the bottle, the menu heading), the time of upload and which account uploaded it. The menu is information about the business, not about a person, so it is not personal data under the Israeli Protection of Privacy Law, 5741-1981, or the GDPR; the details of the person who uploaded it are handled under the sections above.

Why: to build and fit the wine pages, the training and the menu report to the business; to count the menus each product appears on, which wineries and importers see without the business's name or prices; and for aggregated, anonymised data about the wine market, including for commercial purposes, under section 6 of the terms of use. Our commitment to every restaurant is written there: its menu, its prices and what it sends to its team are passed to no one and are not identified.

How long: as long as the account or the subscription is active, and within the periods in "How long we keep data": on the WINEPAGER repository the file is deleted together with the identifying details, 30 days after the account closes; on a subscription, at the end of the three months after it ends. Removing the menu from the panel deletes the file at once. The wine pages built and the aggregated data remain, since they are not attributed to the business.

Menus from public sources: we also read wine menus that restaurants publish themselves, to build wine pages and measure the market. Such a restaurant is not identified, its prices are not passed on individually, and the menu itself is not republished. A restaurant that asks us not to read its menu writes to support@wineworkgp.com.