Effective date: 6 October 2025
Last updated: 6 October 2025

1. Scope and Data Controller
This Privacy Policy describes how the online store APICIVS, operated by DPWEA – Agência de Exportação de Vinhos do Douro e do Porto, Lda., tax number 510 616 992, with registered office at Avenida Rainha Santa Isabel, Lote 10-B, Loja 7, 5000-434 Vila Real, Portugal, and registered with the Vila Real Commercial Registry under the same number, processes personal data collected through the website www.apicivs.com and its associated digital channels.

By accessing this website, the user confirms that they have read and understood this Privacy Policy and accept its terms, together with the applicable Cookie Policy.

APICIVS is the data controller for the purposes of Regulation (EU) 2016/679 of 27 April (General Data Protection Regulation – GDPR) and Law No. 58/2019 of 8 August, which implements the GDPR in Portugal.

Privacy enquiries:
dsv@apicivs.com | info@apicivs.com
APICIVS – Avenida Rainha Santa Isabel, Lote 10-B, Loja 7, 5000-434 Vila Real, Portugal

APICIVS has not appointed a Data Protection Officer (DPO), as the nature and volume of its data processing do not require one. Nevertheless, data subjects may contact APICIVS regarding any privacy-related matter using the above details.

Accessing the website does not in itself involve the collection of personal data, except for information necessary for its proper operation and the use of cookies, as described in the Cookie Policy.

2. Categories of Personal Data Collected
APICIVS may process the following categories of personal data:
– Identification and contact details: name, surname, title, address, email address, telephone number and tax identification number;
– Payment and billing data: information provided through payment service providers, such as references, cards or IBAN;
– Transaction data: purchase history, products acquired, amounts paid, returns, consumer preferences and commercial interactions;
– Technical and browsing data: IP address, device type, operating system, browser, pages visited, session time and cookies;
– Profile and marketing data: communication preferences, subscriptions, interactions with campaigns, responses to surveys and brand events.

APICIVS does not collect or process special categories of personal data (such as health data, religious beliefs, sexual orientation or ethnic origin).

3. Data Collection Methods
Personal data may be collected in several ways:
– Directly, when the user places an order, creates an account, subscribes to a newsletter or communicates with APICIVS;
– Automatically, through cookies, pixels and other tracking technologies during website browsing;
– Indirectly, via service providers, carriers, payment platforms, marketing partners or social networks.

4. Purposes of Processing
Personal data are processed for the following legitimate purposes:
– Processing and management of orders, payments, deliveries and returns;
– Customer communication and support;
– Creation and management of customer accounts;
– Sending newsletters, invitations, commercial communications and personalised campaigns (subject to prior consent);
– Improving user experience and website performance;
– Compliance with legal, accounting, tax and regulatory obligations;
– Fraud prevention, misuse or unauthorised access;
– Management of complaints, warranties and disputes;
– Verification of the minimum legal age for the purchase of alcoholic beverages.

Marketing communications are based on the data subject’s explicit consent, which may be withdrawn at any time using the unsubscribe link included in every communication.

5. Legal Bases for Processing
APICIVS processes personal data on the following legal grounds:
– Performance of a contract or pre-contractual steps (orders, deliveries, invoicing);
– Compliance with a legal obligation (fiscal, accounting or product safety requirements);
– Consent of the data subject, where applicable (e.g. marketing communications or optional cookies);
– Legitimate interest of APICIVS (service improvement, security, fraud prevention and customer relationship).

Processing for age verification is required for compliance with legal obligations relating to the sale of alcoholic beverages, under Decree-Law No. 9/2002 of 24 January.

Failure to provide information necessary for contract performance or legal compliance may render APICIVS unable to provide the requested service.

6. Data Disclosure and Sharing
APICIVS only shares personal data with third parties in the following situations:
– Service providers (carriers, web hosting, payment systems, digital marketing and technical support);
– External consultants (accountants, legal advisers, audit entities);
– Public authorities and regulators, when legally required;
– Partner companies involved in promotional campaigns, always with the data subject’s consent.

All processors act on behalf of APICIVS and strictly comply with confidentiality and data-security obligations.

7. International Data Transfers
APICIVS does not currently transfer personal data outside the European Economic Area (EEA).
Should this ever occur, APICIVS will ensure the application of the European Commission’s Standard Contractual Clauses or other recognised data-protection mechanisms, guaranteeing the level of protection required by the GDPR.

8. Data Retention
Personal data are retained only for as long as necessary to fulfil the purposes for which they were collected:
– Billing and transaction data: 10 years (legal accounting and tax-retention period);
– Marketing data: until consent is withdrawn or two years of inactivity;
– Browsing data and cookies: in accordance with browser settings or the cookie-management tool.

After these periods, data will be securely deleted or anonymised.

9. Data Security
APICIVS implements appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised access or disclosure.
The website www.apicivs.com uses a secure (HTTPS) connection with SSL/TLS certificate and servers located within the European Union.
Internal confidentiality policies, access controls and periodic security audits are applied.

10. Rights of Data Subjects
Under the GDPR, data subjects have the following rights:
– Right of access and to obtain a copy of their data;
– Right to rectification of inaccurate or incomplete data;
– Right to erasure (“right to be forgotten”);
– Right to restriction of processing;
– Right to object to processing, including for marketing purposes;
– Right to data portability;
– Right to withdraw consent at any time, without affecting the lawfulness of prior processing;
– Right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt;
– Right to pursue judicial or administrative remedies provided by law.

Requests may be submitted in writing to:
dsv@apicivs.com | info@apicivs.com
APICIVS – Avenida Rainha Santa Isabel, Lote 10-B, Loja 7, 5000-434 Vila Real, Portugal

APICIVS will respond within one month of receiving the request, extendable by two additional months in complex cases, with prior notice to the data subject.

11. Cookies and Tracking Technologies
This website uses cookies and similar technologies to:
– Ensure technical operation of the site;
– Analyse traffic and performance;
– Personalise content and offers;
– Measure advertising effectiveness.

Non-essential cookies (analytical and marketing) are activated only after the user’s explicit consent through the cookie-management tool (“cookie banner”), in compliance with Article 5(3) of the ePrivacy Directive and CNPD guidelines.
Users may change their preferences at any time via browser settings or the cookie-management tool.

12. Links to Third-Party Websites
The APICIVS website may contain links to third-party websites.
APICIVS is not responsible for the content or privacy practices of such websites and recommends that users read their respective privacy policies before providing any personal data.

13. Changes to Processing Purposes
Should APICIVS need to use personal data for a purpose different from that for which it was collected, the data subject will be notified in advance and informed of the applicable legal basis.

14. Privacy and Legal Drinking Age
The APICIVS website is intended solely for persons of legal drinking age in their country of residence.
By accessing the website, users declare that they are of legal age for that purpose.
APICIVS does not knowingly collect personal data from minors. If this occurs inadvertently, such data will be deleted immediately.

15. Changes to this Policy
APICIVS reserves the right to update this Privacy Policy whenever necessary.
Significant changes will be communicated through the website or, where applicable, by email.
The most recent version will always be available at www.apicivs.com.

16. Contact and Supervisory Authority
Data Controller:
DPWEA – Agência de Exportação de Vinhos do Douro e do Porto, Lda.
dsv@apicivs.com | info@apicivs.com
Avenida Rainha Santa Isabel, Lote 10-B, Loja 7, 5000-434 Vila Real, Portugal

Supervisory Authority:
Portuguese Data Protection Authority (CNPD) — www.cnpd.pt