Version: 1.1 Effective: March 28, 2026 Jurisdiction: European Union

This Privacy Policy explains how Skywine collects, uses, stores, and protects your personal data when you use our platform, book a wine travel experience, or purchase from our online shop. We use Google Tag Manager to manage our tracking tools, including Google Analytics 4, to help us understand how people discover and navigate our platform. This policy applies to all users of Skywine's website, mobile application, and related services.

Contents

1. Who we are
2. Data we collect
3. How we use your data
4. Legal basis for processing
5. Data sharing
6. Cookies, GTM & analytics
7. Data retention
8. Your rights
9. Data security
10. International transfers
11. Children's privacy
12. Contact & complaints

01 — Who we are

Skywine is the data controller responsible for your personal data. We operate a premium wine travel and e-commerce platform, connecting wine enthusiasts with curated vineyard experiences and exceptional bottles from around the world. For all data-related enquiries, contact us at hello@skywine.vin.

Where required by applicable law, Skywine has appointed a Data Protection Officer (DPO). Contact details for the DPO are available upon request.

02 — Data we collect

We collect personal data in the following categories depending on how you interact with our platform:

• Identity data — full name, date of birth (for age verification), and proof of identity where required
• Contact data — email address, phone number, and postal address
• Account data — login credentials, preferences, saved items, and subscription details
• Transaction data — order history, payment method details (processed securely via third-party providers), and booking records
• Travel data — experience bookings, dietary requirements, accessibility needs, and travel party details
• Usage & analytics data — pages visited, events triggered, session duration, scroll depth, device type, browser, and anonymised IP address; collected via Google Analytics 4 through Google Tag Manager
• Marketing data — communication preferences and responses to campaigns

We do not store full payment card numbers. Payment processing is handled by PCI-DSS compliant third-party providers.

03 — How we use your data

Your data is used only for the purposes outlined below:

• To process and manage bookings, orders, and payments
• To verify your age and identity in compliance with alcohol regulations
• To create and maintain your Skywine account
• To communicate with you about bookings, orders, and account activity
• To personalise recommendations for wine experiences and products
• To measure platform performance and user behaviour via Google Analytics 4
• To send marketing communications where you have given consent
• To comply with legal obligations including tax, fraud prevention, and regulatory requirements

We will never use your data in ways that are incompatible with the purposes for which it was collected without seeking your consent.

04 — Legal basis for processing

Under GDPR and applicable data protection law, we process your personal data on the following legal bases:

• Contractual necessity — to fulfil your bookings and orders
• Legal obligation — to comply with age verification, tax, and regulatory requirements
• Legitimate interests — to improve our services, prevent fraud, and maintain platform security
• Consent — for analytics tracking via GTM/GA4 and marketing communications; you may withdraw consent at any time via our Cookie Settings panel

05 — Data sharing

Skywine does not sell your personal data. We share data only where necessary with the following categories of recipients:

• Experience providers & vineyards — to fulfil wine trip bookings (limited to name, contact, and booking details)
• Delivery & logistics partners — to process and ship orders
• Payment processors — to handle transactions securely
• Google (via GTM & GA4) — anonymised behavioural and usage data for analytics purposes; governed by Google's data processing terms
• Technology providers — hosting, CRM, and email platforms operating under data processing agreements
• Legal & regulatory authorities — where required by law or court order

All third-party partners are contractually required to protect your data and may only use it for the specific purpose for which it was shared.

06 — Cookies, GTM & analytics

Skywine uses Google Tag Manager (GTM) as its tag management system. GTM itself does not collect personal data — it acts as a container that loads and manages third-party scripts based on your consent choices. The primary tool deployed via GTM is Google Analytics 4 (GA4).

Google Tag Manager

GTM is a tag management system that loads tracking scripts only after consent is confirmed. It does not set cookies or collect personal data itself. All tags within our GTM container are configured to fire based on the consent signals provided by our Cookie Settings panel.

Google Analytics 4 (GA4)

GA4 is our primary analytics platform, deployed via GTM. It collects anonymised data about how visitors interact with the Skywine platform — including pages viewed, events triggered (such as searches, bookings initiated, and purchases), session duration, device type, and approximate location derived from anonymised IP.

We have enabled IP anonymisation and do not use GA4's advertising features or share data with Google's advertising products.

GA4 sets first-party cookies — including _ga and _ga_<container-id> — to distinguish users and sessions. These cookies are only set after you have given consent via our Cookie Settings panel.

GTM Consent Mode v2: Our GTM container is configured with Consent Mode v2. Analytics tags will only fire after a user has actively accepted analytics cookies. If consent is declined or not yet given, tags remain blocked and no data is sent to Google.

Cookie categories

You can manage or withdraw your cookie consent at any time via the Cookie Settings panel in the site footer. You may also opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.

07 — Data retention

• Account data — retained for the duration of your account plus 2 years after closure
• Transaction and booking records — 7 years for financial compliance purposes
• Age verification records — as required by applicable alcohol regulations
• Google Analytics data — retained for 14 months within GA4, after which it is automatically deleted; event-level data is not retained beyond this period
• Marketing data — until consent is withdrawn or 3 years of inactivity

When data is no longer required, it is securely deleted or anonymised in accordance with our internal data lifecycle procedures.

08 — Your rights

Under GDPR and applicable data protection law, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at hello@skywine.vin. We will respond within 30 days. We may need to verify your identity before processing your request.

09 — Data security

Skywine implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include encrypted data transmission (TLS/SSL), secure server infrastructure, access controls, and regular security assessments.

In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

10 — International transfers

Google Analytics 4 data is processed by Google LLC, which may involve transfers of data to the United States and other countries outside the EEA. These transfers are covered by Google's Standard Contractual Clauses and Google's EU–US Data Privacy Framework certification. For more information, see Google's Privacy Policy.

For all other international data transfers, we ensure appropriate safeguards are in place — including SCCs approved by the European Commission — before any data leaves the EEA.

11 — Children's privacy

Skywine's services are strictly intended for individuals of legal drinking age (minimum 18 years). We do not knowingly collect personal data from anyone under the age of 18. If we become aware that data from a minor has been collected, it will be deleted promptly. Please contact us at hello@skywine.vin if you believe a minor has provided data.

12 — Contact & complaints

For any questions or requests relating to this Privacy Policy or your personal data, contact us at hello@skywine.vin. We aim to respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. In Greece, this is the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.

We reserve the right to update this Privacy Policy from time to time. Material changes will be communicated to registered users by email or via a prominent notice on the platform.

© 2026 Skywine. All rights reserved. — Version 1.1, March 2026