Privacy Policy

Last updated: 5 June 2026

This Privacy Policy explains how Bottles handles your personal data when you use bottles.pt and the Bottles mobile apps. We’ve written it in plain English. If anything is unclear, write to us at info@bottles.pt and we’ll explain it properly. Bottles is an online auction marketplace for fine wine and spirits, based in Portugal and operating across the European Union. We take data protection seriously — both because the GDPR requires it and because we’d rather have your trust than your contact details.

1. Who We Are

Bottles operates bottles.pt. We are the data controller for the personal data described in this policy, which means we decide what data is collected and what happens to it. Registered Address: BOTTLES EU LDA Praceta Fundo De Vila, N.º 50, 3.º Esq. K, São João da Madeira, Aveiro, Portugal VAT No.: 518 377 385 Contact for privacy matters:

• Email: info@bottles.pt
• Postal contact: available on request via the email above
• Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Portugal

For one specific area — seller identity verification (KYC) — Stripe acts as an independent data controller. We explain this in Section 5.

2. What Data We Collect

We collect only what we need to run the marketplace, complete your transactions, keep the platform secure, and meet our legal obligations. Identity and account

• Full name and the public nickname shown on your bids and listings
• Email address and phone number
• Date of birth (we use this to confirm you are 18 or older — see Section 11)
• Country of residence and shipping address

Authentication

• A securely hashed version of your password (we never store or see the plain text)
• OAuth tokens from Apple or Google if you sign in with those providers, via Firebase
• Session tokens, refresh tokens, and CSRF tokens used to keep you signed in
• Firebase Cloud Messaging (FCM) device tokens, if you enable push notifications

Payment and payout

• Your Stripe customer ID
• Tokenised payment method references — we never receive or store your full card number, CVC, or expiry. Card data goes directly from your device to Stripe. Bottles is compliant with PCI DSS SAQ A.
• For sellers: payout account details, held by Stripe Connect

Seller verification (KYC) If you sell on Bottles, Stripe Connect collects and verifies your identity documents directly. Bottles does not store your ID documents, selfies, or proof of address. See Section 5. Activity on the platform

• Bids you’ve placed and listings you’ve created
• Your watchlist and “Looking to buy” requests
• Browsing history within the app and site, used to power features like recommendations and recently viewed

Content you create

• Photos of bottles for your listings, and your profile photo
• Messages you send through support chats or dispute conversations
• Listing descriptions and any text you contribute

Technical data

• IP address — used for fraud prevention and bot protection (Cloudflare Turnstile)
• Device and browser user-agent
• FCM device identifier for push delivery

3. Why We Use Your Data, and Our Legal Basis

Under the GDPR we have to tell you both what we use your data for and the legal ground that lets us. Here is the full breakdown.

Performance of a contract — Article 6(1)(b) We need this data to deliver the service you signed up for.

• Creating and maintaining your account
• Authenticating you when you sign in
• Running auctions, accepting bids, and processing the sale
• Taking payment from buyers and paying out sellers
• Arranging shipping with Eurosender
• Operating the dispute and customer support systems

Legal obligation — Article 6(1)(c) We have to do this whether you’d like us to or not.

• Keeping transactional and tax records for ten years under Portuguese tax law
• Cooperating with Stripe’s KYC obligations under EU anti-money-laundering directives
• Responding to lawful requests from competent authorities

Legitimate interests — Article 6(1)(f) We use a small set of data on the basis that it’s reasonably necessary for running the platform safely and that your rights and interests are not overridden.

• Fraud prevention and detection of abuse on the marketplace
• Protecting signup, login, and password-recovery flows from bots using Cloudflare

Turnstile

• Basic anti-bot and security analytics
• Defending Bottles against legal claims

You can object to processing based on legitimate interests at any time — see Section 8. Consent — Article 6(1)(a) We only do these when you explicitly say yes.

• Sending you marketing emails about Bottles
• Setting optional analytics cookies (if and when we add any — none are active in v1)
• Sending you push notifications

You can withdraw consent at any time, easily, in the same place you gave it (account settings, notification settings, or the cookie banner). Withdrawing consent does not affect anything we did legitimately before you withdrew it.

4. Who We Share Your Data With

We don’t sell your data. We share it only with the service providers we need to run Bottles, and only the parts they need to do their job.

• Stripe Payments — Processes buyer payments and stores payment methods. United

States, with EU data residency where available. stripe.com/privacy

• Stripe Connect — Onboards sellers, runs KYC, manages payouts. United States. stripe.com/connect/legal
• Firebase / Google — OAuth sign-in (Apple/Google), push notifications via FCM. United

States. policies.google.com/privacy

• Amazon Web Services — Hosts your uploaded photos (S3) and sends transactional email (SES). Paris region (eu-west-3). aws.amazon.com/privacy
• Cloudflare Turnstile — Bot detection on signup and password recovery. Global edge network. cloudflare.com/privacypolicy
• Eurosender — Arranges shipping for sold bottles. European Union. eurosender.com/en/privacy

We may also share data with our professional advisors (lawyers, accountants, auditors) where strictly necessary, and with competent authorities where the law requires.

5. Stripe’s Role in Seller Verification

When you onboard as a seller, Stripe Connect collects your identity verification documents — passport or national ID, proof of address, and any other information required under EU anti-money-laundering rules. For this verification, Stripe acts as an independent data controller, not as a processor working on our behalf. Bottles never receives or stores those documents. Stripe tells us whether you passed verification and that’s it.

6. International Data Transfers

Some of our providers — notably Stripe, Firebase, and Cloudflare — are headquartered in the United States and may process some of your data there. Where data leaves the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses (SCCs) with the provider, plus any additional technical and organisational safeguards that provider has in place (such as encryption in transit and at rest). For Google services we also rely on the EU–US Data Privacy Framework where applicable. You can ask us for a copy of the relevant transfer safeguards at info@bottles.pt.

7. How Long We Keep Your Data

• While your account is active: for as long as you keep your Bottles account open.
• After you delete your account: we keep your account in a recoverable state for 30 days so you can change your mind. After that we anonymise it.
• Transactional records (orders, invoices, payments): retained for 10 years to satisfy

Portuguese tax and accounting law.

• Bid history: retained in an anonymised form — your past bids continue to exist as part of the auction record under a generic bidder counter, with no link back to you.
• Support and dispute messages: kept for as long as needed to handle the case and any follow-up.
• Logs and security data: kept for short rolling windows (typically days to a few months), long enough to investigate incidents.

8. Your Rights

Under the GDPR you have a clear set of rights over your personal data. You can use any of them, free of charge, and we’ll respond within one month.

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct anything that’s wrong or out of date.
• Erasure — ask us to delete your data (subject to the legal retention rules in Section 7).
• Restriction — ask us to pause processing while we sort something out.
• Portability — ask for your data in a structured, machine-readable format, or have it sent to another provider.
• Objection — object to processing that’s based on legitimate interests, including for any direct marketing.
• Withdraw consent — for anything we do based on your consent, at any time.
• Automated decisions — we don’t make decisions about you that have legal or similarly significant effects using fully automated processing.

How to use these rights

• Delete your account yourself in the app or on the web: Settings ? Delete account.
• For anything else, email info@bottles.pt. To protect you, we may ask for proof that you are who you say you are before acting on a request.

Lodge a complaint If you believe we’re not handling your data properly, we’d very much rather you told us first — but you’re entitled to complain directly to the Portuguese supervisory authority: Comissão

Nacional de Proteção de Dados (CNPD) — www.cnpd.pt

9. How We Keep Your Data Secure

• TLS for all traffic between your device and our servers
• Encryption at rest for stored data
• Hashed passwords (never stored in plain text)
• Tokenised payment data held by Stripe — never on our servers
• Strict access controls and logging for our staff
• Cloudflare Turnstile and rate limiting against bots and abuse

10. Cookies and Similar Technologies

Bottles uses a small set of cookies and browser storage items to keep you signed in, remember your preferences, and protect the site from abuse. We don’t use advertising or profiling cookies. The full breakdown is in our Cookie Policy (/cookies).

11. Children

Bottles is a marketplace for fine wine and spirits and is only for adults. You must be at least 18 years old to create an account, bid, sell, or buy. We enforce this at signup using your date of birth, and we will close any account we identify as belonging to a minor.

12. Changes to This Policy

We may update this policy from time to time — for example, when we add a feature, change a provider, or sharpen the wording. When we do, we’ll update the “Last updated” date at the top. If the change is significant, we’ll let you know directly by email or with an in-app notice before it takes effect.

13. Getting in Touch

Questions, requests, or feedback about how we handle your data — we’d genuinely like to hear from you. BOTTLES EU LDA Praceta Fundo De Vila, N.º 50, 3.º Esq. K São João da Madeira, Aveiro, Portugal VAT No.: 518 377 385 Email: info@bottles.pt Customer Support Contacts: Portuguese Line: +351 914 021 381 English Line: +1 973 975 6042 French Line: +33 6 88 90 74 26