Privacy Policy
Last updated: 8 October 2026
This Privacy Policy explains how Bottles handles your personal data when you use bottles.pt and the Bottles mobile apps (the "Platform"). It is written in plain English. If anything is unclear, write to info@bottles.pt and we will explain it properly. Bottles is an online auction marketplace for fine wine and spirits, based in Portugal. The Platform can be used from anywhere in the world; transport is arranged within the European Union only. This Policy applies to everyone who uses the Platform, wherever they live.
1. Who we are
BOTTLES EU LDA operates the Platform and is the data controller for the personal data described in this Policy. Registered office: Rua Comandante Amorim, Bloco 3, N.º 106, Arrifana, 3700-423 São João da Madeira, Aveiro, Portugal. Tax and company number 518 377 385. Contact for privacy matters: info@bottles.pt Postal contact: the registered office above Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Portugal, www.cnpd.pt For one specific activity, seller identity verification, Stripe acts as an independent data controller. See section 5.
2. What data we collect
We collect only what we need to run the marketplace, complete your transactions, keep the Platform secure and meet our legal obligations. Identity and account Full name and the public nickname shown on your bids and listings Email address and phone number Date of birth, used to confirm you are old enough to use the Platform (section 11) Country of residence, billing address, delivery address and, for sellers, collection address Whether you sell as a private individual or as a trader and, for traders, company name, registration number and VAT number Tax identification number and country of tax residence, which we ask sellers for and which we use for tax reporting (section 3), and the VAT number a business gives for invoicing Authentication A securely hashed version of your password; we never store or see the plain text Tokens from Apple or Google if you sign in with those providers, via Firebase Session, refresh and CSRF tokens used to keep you signed in Bottles - Privacy Policy · BOTTLES EU LDA1 / 6
Firebase Cloud Messaging device tokens, if you enable push notifications Payment and payout Your Stripe customer ID Tokenised payment method references. We never receive or store your full card number, CVC or expiry; card data goes directly from your device to Stripe. Bottles is compliant with PCI DSS SAQ A. For sellers: payout account details, held by Stripe Connect Seller verification If you sell on Bottles, Stripe Connect collects and verifies your identity documents directly. Bottles does not store your ID documents, selfies or proof of address. See section 5. Activity on the Platform Bids you have placed, lots you have won and listings you have created Your favourites, watchlist and "Looking to buy" requests Pages and lots you have viewed, used for features such as recently viewed Non-payment strikes, missed collections, disputes and their outcomes Content you create Photographs of bottles for your listings, and your profile photo Messages you send through support chats, order conversations or dispute conversations Listing descriptions and any text you contribute Technical data IP address, used for fraud prevention, rate limiting and bot protection Device and browser user agent, app version and language With your consent, analytics events about how the Platform is used and technical error reports (section 3)
3. Why we use your data, and our legal basis
Performance of a contract (Article 6(1)(b) GDPR) Creating and maintaining your account and signing you in Running auctions, accepting bids and processing the sale Taking payment from buyers and paying out sellers Booking transport with our carrier and telling you where your bottle is Operating order conversations, disputes and customer support Issuing the fee documents for our commission and buyer's fee Enforcing the Terms, including strikes, suspensions and recovery of amounts owed Legal obligation (Article 6(1)(c) GDPR) Keeping transactional and tax records for ten years under Portuguese tax law Bottles - Privacy Policy · BOTTLES EU LDA2 / 6
Cooperating with Stripe's know-your-customer obligations under EU anti-money-laundering rules Reporting sellers who reach the thresholds of Council Directive (EU) 2021/514 (DAC7) to the Portuguese tax authority once a year, including name, address, tax identification number, bank account and sales figures Collecting and publishing trader information required by Regulation (EU) 2022/2065 (Digital Services Act) and handling notices of illegal content Checking users against sanctions lists where the law requires it Responding to lawful requests from competent authorities Legitimate interests (Article 6(1)(f) GDPR) Preventing fraud and detecting abuse on the marketplace, including bid manipulation and counterfeit Protecting signup, email verification and password recovery from bots, using Cloudflare Turnstile Basic security logging and rate limiting Keeping an anonymised record of past sales as market data Defending Bottles against legal claims You can object to processing based on legitimate interests at any time (section 8). Consent (Article 6(1)(a) GDPR) Sending you marketing emails about Bottles Analytics: Google Analytics 4 and Grafana Faro, which measure how the Platform is used and record technical errors and page speed, run only after you accept analytics in the cookie banner on bottles.pt. Without consent, Google Analytics sends only anonymous, cookieless signals and Faro is switched off. The mobile apps do not run analytics. Sending you push notifications You can withdraw consent at any time, in the same place you gave it. Withdrawing consent does not affect what we did lawfully before.
4. Who we share your data with
We do not sell your data. We share it only with the providers we need to run Bottles, and only the parts they need. Stripe Payments (United States, with EU data residency where available): processes buyer payments and stores payment methods. stripe.com/privacy Stripe Connect (United States): onboards sellers, verifies identity, manages payouts. stripe.com/connect/legal Firebase / Google (United States): Apple and Google sign-in, push notifications. policies.google.com/privacy Google Analytics 4 (United States): aggregated usage analytics, with your consent. policies.google.com/privacy Grafana Labs, Grafana Cloud (European Union): error and performance monitoring, with your consent. grafana.com/legal/privacy-policy Bottles - Privacy Policy · BOTTLES EU LDA3 / 6
Amazon Web Services (Paris region, eu-west-3): hosts your uploaded photographs and sends transactional email. aws.amazon.com/privacy Cloudflare Turnstile (global edge network): bot detection on signup, email verification and password recovery. cloudflare.com/privacypolicy Eurosender (European Union) and the carriers it books: transport of sold bottles; they receive the seller's and buyer's name, address, phone and email. eurosender.com/en/privacy InvoiceXpress (Portugal): issues our fee documents; receives the name, address and tax identification number on the document. invoicexpress.com/privacy We share the buyer's name and delivery address with the seller, and the seller's name and collection address with the buyer, only to the extent the carrier's documents and the order require it. Bidder names shown on the Platform are masked. Where a buyer raises a reasonable claim of counterfeit, misdescription or third-party ownership after the seller has been paid, we may disclose the seller's name and contact details to the buyer so that the claim can be pursued, and to the authorities; the legal basis is our and the buyer's legitimate interest in the establishment of legal claims. Automatic translations of listings and messages run on servers operated by Bottles; no third party receives that text for translation. We may also share data with our professional advisers (lawyers, accountants, auditors, insurers) where strictly necessary, with a buyer of our business in the event of a merger or sale, subject to this Policy, and with competent authorities where the law requires.
5. Stripe's role in seller verification
When you onboard as a seller, Stripe Connect collects your identity verification documents: passport or national ID, proof of address and any other information required under EU anti-money-laundering rules. For this verification Stripe acts as an independent data controller. Bottles never receives or stores those documents; Stripe tells us whether you passed verification, and that is all.
6. International data transfers
Bottles is established in the European Union and processes your data there. If you use the Platform from outside the European Economic Area, your data is transferred to the EU when you use it. Some of our providers, in particular Stripe, Google and Cloudflare, are headquartered in the United States and may process some of your data there. Where data leaves the EEA we rely on the European Commission's Standard Contractual Clauses with the provider, plus the technical and organisational safeguards that provider has in place, such as encryption in transit and at rest. For Google and Stripe we also rely on the EU-US Data Privacy Framework where applicable. Grafana Cloud, Eurosender, InvoiceXpress and our AWS region are in the European Union. You can ask for a copy of the transfer safeguards at info@bottles.pt.
7. How long we keep your data
While your account is active: for as long as you keep it open. When you delete your account: your personal data is anonymised immediately. The deletion cannot be undone, so the app asks you to confirm. Open orders must be completed first. Bottles - Privacy Policy · BOTTLES EU LDA4 / 6
Transactional records (orders, fee documents, payments): 10 years, to satisfy Portuguese tax and accounting law. Tax reporting records (DAC7): 10 years from the end of the reporting period. Bid history and past sales: kept in anonymised form as part of the auction record, under a masked bidder label, with no link back to you. Support, order and dispute messages: for as long as needed to handle the case and any follow-up, and thereafter for the limitation period of legal claims. Fraud and abuse records: up to 5 years after the account is closed, to prevent re-registration by banned users. Logs and security data: short rolling windows, typically days to a few months. Analytics data: Google Analytics keeps events for the retention period set on our property, 14 months at most; Faro sessions are not persisted between visits.
8. Your rights
Under the GDPR you may, free of charge and with an answer within one month: Access: ask for a copy of the personal data we hold about you. Rectification: ask us to correct anything wrong or out of date. Erasure: ask us to delete your data, subject to the retention rules in section 7. Restriction: ask us to pause processing while something is sorted out. Portability: receive your data in a structured, machine-readable format. Objection: object to processing based on legitimate interests, including direct marketing. Withdraw consent: for anything based on consent, at any time. Automated decisions: we do not make decisions about you with legal or similarly significant effects by fully automated means. Strikes and suspensions are applied by rules but a person reviews any contested case. If you live outside the European Union, the law of your country may give you similar or additional rights, for example under the UK GDPR, the Swiss Federal Act on Data Protection, the Brazilian LGPD or a US state privacy law. You can exercise them through the same contact, and we apply the GDPR standard to everyone. How to use these rights Delete your account yourself in the app or on the web: Settings > Delete account. For anything else, email info@bottles.pt. We may ask for proof of identity before acting on a request. Lodge a complaint We would rather you told us first, but you are entitled to complain to the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or to the supervisory authority of the EU country where you live or work.
9. How we keep your data secure
TLS for all traffic between your device and our servers Bottles - Privacy Policy · BOTTLES EU LDA5 / 6
Encryption at rest for stored data Hashed passwords, never stored in plain text Tokenised payment data held by Stripe, never on our servers Strict access controls and logging for our staff Cloudflare Turnstile and rate limiting against bots and abuse If a personal data breach is likely to result in a high risk to you, we inform you and the CNPD as the GDPR requires.
10. Cookies and similar technologies
Bottles uses a small set of cookies and browser storage items to keep you signed in, remember your preferences and protect the Platform from abuse, and, only with your consent, analytics cookies. We do not use advertising or profiling cookies. The full list is in our Cookie Policy.
11. Children
Bottles is only for adults. You must be at least 18 to create an account, bid, sell or buy, or older where the law of your country sets a higher age for alcohol. We check this at signup using your date of birth and close any account we identify as belonging to a minor.
12. Changes to this Policy
We may update this Policy when we add a feature, change a provider or sharpen the wording. We update the date at the top when we do. If the change is significant, we tell you by email or with an in-app notice before it takes effect.
13. Getting in touch
BOTTLES EU LDA, Rua Comandante Amorim, Bloco 3, N.º 106, Arrifana, 3700-423 São João da Madeira, Aveiro, Portugal. Tax and company number 518 377 385. Email: info@bottles.pt. Customer support: Portuguese line +351 914 021 381; English line +1 973 975 6042; French line +33 6 88 90 74 26. Bottles - Privacy Policy · BOTTLES EU LDA6 / 6