This policy explains what personal data vin/tr handles, why, and the rights you have. vin/tr is operated by [company name to be confirmed], based in Hong Kong (“vin/tr”, “we”, “us”), which is responsible for this data. Contact: hello@vintr.co. We follow Hong Kong’s Personal Data (Privacy) Ordinance (PDPO) and, because we work with producers and importers worldwide, we also apply the standards of the EU and UK General Data Protection Regulation (GDPR).
1. Who this policy covers
Two groups of people, with the same rights:
Producers and website visitors: wineries that fill in our onboarding form, book a call, write to us or become clients, and anyone who browses vintr.co;
Importer and trade contacts: the business contacts in our outreach database, who may receive campaigns we run on behalf of our producer clients.
2. What we collect
2.1 What you give us
When you fill in our onboarding form, book a call or write to us, we collect what you choose to share: your name and role, your winery, region, country and website, your email and phone number, information about your wines (volume, farming, price range, story), the markets you want to reach, the importers you want us to leave out, and any message you add. When you book a call, the booking is stored in our Google Calendar and you receive a calendar invitation, with the video link for a Google Meet call; if you choose a WhatsApp call, we use the number you give only to call you. When you become a client, we also keep your billing details; payments are processed by Stripe; we never see or store full card numbers.
2.2 When you visit the website
Our hosting and security provider, Cloudflare, receives the technical data any website receives, such as your IP address, browser, device and the pages you request. On the Book a call page, Cloudflare Turnstile checks that a booking comes from a person. For cookies and what is kept in your browser, see section 3.
2.3 Importer and trade contacts
Our outreach database holds business contact details of importers, distributors and trade buyers: name, role, company, business email, country and the kind of wines the company imports. It is built from publicly available business sources, from our team’s professional network in the wine trade, and through research and data enrichment. Because some of these details are not collected from the contacts themselves, we publish this policy so they can see how their data is used, and every message we send states clearly who it is from and why.
2.4 Viny, the assistant in your client space
The questions you ask Viny in your client space, and his answers, are stored with your client space, and the vin/tr team may read them to answer you and improve the service. To write Viny’s answers, your question and the details of your campaign are sent to Anthropic, our AI provider, which does not use them to train its models. We keep these questions and answers for 12 months, and delete them with your client space.
3. Cookies
vintr.co uses no advertising, analytics or tracking cookies, and we build no profile of visitors. Our hosting and security provider, Cloudflare, may set cookies that are strictly necessary to keep the website secure and working. The onboarding form keeps your unsent answers in your own browser (local storage) so you can finish later; they reach us only when you send the form, and you can clear them in your browser settings at any time.
Because we use only what is strictly necessary, no cookie banner is shown. If we ever add audience measurement, we will update this section and, where the law requires it, ask for your consent first. You can block or delete cookies in your browser settings.
4. Why we use data, and on what basis
Producers and clients: to answer your inquiry, prepare your outreach plan, hold the calls you book and provide the service we agreed (our contract), to meet legal duties such as invoicing and tax, and for our legitimate interest in running and improving vin/tr.
Website visitors: to run and secure the website (legitimate interest).
Importer and trade contacts: to run business-to-business outreach on behalf of our producer clients. Where the GDPR applies, our basis is our legitimate interest in B2B prospecting. Where a country requires prior consent for commercial email, as Canada does, we follow that rule. Every message says who it is from and why the contact is approached, and includes a simple way to opt out. As the PDPO requires, the first time we use a contact’s details for outreach we tell them, free of charge, that they can opt out. When someone opts out or objects, we stop contacting them and record it, so their choice is respected in every later campaign.
5. Who we share data with
We do not sell personal data. We share it only as follows:
Service providers acting on our instructions: Stripe (payments), Airtable (forms and records), Cloudflare (hosting, storage and security), Google Workspace (email, calendar and video calls), Anthropic (AI tools used in parts of our work), WhatsApp (calls you choose to take on WhatsApp), and the email sending and deliverability services that run campaigns.
Our producer clients: when an importer replies to a campaign, the reply and the replier’s contact details go to the producer it was sent for, so they can continue the conversation. We do not hand over the rest of our database.
Where required: to comply with the law, to enforce our terms or protect our rights, or to a successor if vin/tr’s business is reorganized, merged or sold, in which case this policy continues to apply.
6. Data processed outside your country
We are based in Hong Kong and several of our providers are in the United States and other countries, so your data may be processed outside your own country. We remain responsible for data our providers handle for us, and we rely on contractual safeguards: the model clauses recommended by Hong Kong’s Privacy Commissioner and, for data from the European Economic Area or the United Kingdom, standard contractual clauses or our providers’ approved transfer frameworks.
7. How long we keep data
Clients: for as long as we work together, then as long as tax and accounting law requires (seven years in Hong Kong).
Inquiries and calls that do not lead to a campaign: as long as needed to follow up, and no longer than two years.
Importer and trade contacts: as long as the details remain useful and accurate for outreach. When someone opts out or asks us to delete their details, we delete them but keep a minimal record (the email address or company, and the date) so that they are never contacted again.
When data is no longer needed, we delete or anonymize it.
8. Your rights
Depending on the law that applies to you (for example the Hong Kong PDPO, the EU or UK GDPR, or the privacy laws of US states, Canada, Australia, New Zealand or Brazil), you can ask to see the personal data we hold about you, correct it, delete it, receive a copy, limit how we use it or object to its use, including for outreach, and withdraw any consent you gave. Importer and trade contacts can opt out at any time with the link in our messages or by replying.
To exercise a right, email hello@vintr.co; we answer within the time the law sets. You can also complain to your data-protection authority, such as Hong Kong’s Privacy Commissioner for Personal Data or the authority of your EU country.
9. Security
We protect personal data with reasonable technical and organizational measures, including access controls and encrypted connections. No system is completely secure. If a breach affects your data and the law requires it, we will tell you and the relevant authority.
10. Children
vin/tr is for businesses and is not aimed at children. We do not knowingly collect data from anyone under 18.
11. Changes and contact
We may update this policy when our practices or the law change, and we will update the date at the end of this page. For any question or request about your data, write to hello@vintr.co.
Last updated: October 28, 2026.