Privacy Policy

1. Who we are (data controller)

This website, www.carpediem.md, is operated by SRL Vinfoteca & Co, trading as Casa Vinicolă Luca / Carpe Diem ("we", "us").

Address: 17 Buna Vestire Street, Cricova, MD-2084, Republic of Moldova. Phone: +373 795 78 818. Email for privacy requests: info@wineshop.md.

This policy applies to www.carpediem.md.

2. What personal data we collect and why

Blog comments. Comments are reviewed before they are published. If we publish your comment, your name and your comment become public on the blog. Your email address is never published. Please do not include personal data in a comment that you do not want to be public.

Allergies and dietary requirements (health-related information). We do not ask for health data. However, if you book a tasting that includes food, you may tell us in advance about a food allergy or dietary requirement, in the "Message" field or by email, so that we can adapt your visit. Please share only what is necessary (for example, "allergic to nuts"). We use this information only to prepare your visit, and we delete it after the visit. By sending us this information you give your explicit consent to this use. You may withdraw your consent at any time by writing to info@wineshop.md; withdrawal does not affect what we did before, and we may then be unable to adapt your visit.

Website statistics. With your consent only, we use Google Analytics 4 to measure how visitors use the website (for example pages viewed, time on site, approximate location, device and browser type, and whether a form was sent successfully or an email or phone link was clicked (without the content of the form or the address)). It sets analytics cookies in your browser only if you click "Accept analytics" in the cookie banner. See section 7. According to Google's documentation, in Google Analytics 4 IP addresses are not logged or stored (Google Analytics Help, checked 20 October 2026).

Providing your data is voluntary. The fields marked as required in our forms are needed to answer you; without them we cannot reply to you or arrange your visit. We do not make decisions about you based solely on automated processing, including profiling.

3. Legal basis

We process your data because:

• it is needed to respond to your request and to take steps to organise a visit you ask for (pre-contractual steps and performance of a contract);
• it is in our legitimate interest to run, secure and keep records of our business correspondence;
• for confirmed and invoiced bookings, we must keep accounting and tax records (legal obligation);
• you ask us to publish your blog comment, and you give us your consent by submitting it (you can withdraw it by asking us to remove the comment);
• for allergy and dietary information, we rely on your explicit consent (see section 2);
• for website statistics (Google Analytics), we rely on your consent, which you give by clicking "Accept analytics" in the cookie banner. You can withdraw it at any time through the "Cookie settings" link in the footer of the website.

This policy follows the Law of the Republic of Moldova on personal data protection and, where applicable, the EU General Data Protection Regulation (GDPR).

4. How long we keep your data

• Enquiries that do not lead to a booking, and comments that are not published: we delete them 12 months after our last contact with you. This applies both to our mailbox and to the copy of form submissions stored by Webflow.
• Confirmed and invoiced bookings: we keep the related records for as long as accounting and tax rules require.
• Allergy and dietary information: we delete it after your visit.
• Published blog comments stay on the blog until you ask us to remove them or we remove them.
• Website statistics (Google Analytics): we have set Google Analytics to keep event-level and user-level data for 14 months, after which Google deletes it automatically. Aggregated statistical reports (for example, the number of visitors per month or per country) are not affected by this setting. The analytics cookies themselves last as shown in section 7.

After these periods we delete or anonymise the data.

5. Who receives your data

• Our team at the winery. Messages sent through our forms are delivered by email to info@wineshop.md. The mailbox is hosted by our email service provider, which acts as our processor.
• Website host and form processor: Webflow, Inc. (USA). Our website is built and hosted on Webflow. When you send a form (contact form or blog comment), the information you enter, and the address of the page you sent it from, are transmitted to and stored by Webflow on our behalf, and Webflow keeps a copy of the submission. Webflow acts as our processor under its Data Processing Addendum. Webflow may host and process data in the United States; its hosting sub-processors include Amazon Web Services, MongoDB and Cloudflare (see its list of sub-processors and its Privacy Policy).
• Our accounting firm, engaged by us under a contract and acting as our processor, receives data only for confirmed and invoiced bookings.
• Google LLC (Google Analytics), only if you accept analytics in the cookie banner. Google acts as our service provider and processes the statistics data on our behalf, including in the United States.
• The public, only for blog comments we choose to publish (your name and comment).
• Authorities, if the law requires it.

Apart from the recipients listed above and the third-party services listed in section 7, we do not share your data with anyone else. We do not sell your personal data.

Transfers outside the Republic of Moldova / the EU. Webflow may process data in the United States. According to Webflow's Data Processing Addendum, for transfers of personal data from the EU/EEA, the UK and Switzerland it relies on the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. framework) and, where applicable, the European Commission's Standard Contractual Clauses. Google, as our email provider and, if you accept analytics, as our analytics provider, may also process data outside the Republic of Moldova and the European Economic Area, including in the United States.

6. Your rights

You have the right to: be informed about how we use your data; access your data; have inaccurate data corrected; have your data deleted; restrict or object to processing; receive your data in a portable format; and withdraw a consent you have given, in each case as provided by applicable law.

To exercise your rights, write to info@wineshop.md. We will reply within the time limits set by applicable law.

You may also complain to the supervisory authority: the National Centre for Personal Data Protection of the Republic of Moldova (https://datepersonale.md). If you are in the EU, you may also complain to the data protection authority in your country.

7. Cookies and third-party services

We do not use advertising or social-media tracking cookies.

Strictly necessary cookie. Based on our review of the website code (20 October 2026), when you visit www.carpediem.md without accepting analytics, the only cookie set is one strictly necessary security cookie, set by the network of our hosting provider (Cloudflare, which delivers the website on behalf of Webflow):

Analytics cookies (only with your consent). When you first visit, a cookie banner asks whether you accept analytics. Analytics cookies are not set unless you click "Accept analytics"; if you click "Reject", they are not set. With your consent, Google Analytics 4 (a service of Google LLC) sets these cookies:

The durations are those published in Google's cookie reference and in Google Analytics Help (checked 20 October 2026). We have set Google Analytics to keep event-level and user-level data for 14 months (see section 4). According to Google's documentation (checked 20 October 2026), in Google Analytics 4 IP addresses are not logged or stored. Google acts as our processor and may process the data in the United States (see section 5). We use the statistics only to understand and improve our website.

You can change your choice at any time through the "Cookie settings" link in the footer of every page, and you can block or delete cookies in your browser settings; the website will still work. We store your cookie choice in your browser's local storage (key cd_consent). It contains only your choice and the date you made it, and we ask you again after 6 months. We do not store information in your browser's local storage for tracking purposes.

Third-party services. To display the website, your browser loads some files directly from third-party servers. These providers receive the technical data every browser sends, such as your IP address, browser type and the page that requested the file. Based on our review, none of them sets cookies on our website.

Files such as images and page code are delivered by Webflow's own servers (see section 5). Links to our Facebook, Instagram and YouTube pages are plain links: nothing is loaded from these platforms until you click a link, and their own privacy policies apply once you are on their sites.

8. Children

This website is intended for adults aged 18 and over. We do not knowingly collect data from persons under 18. If you believe a minor has sent us data, contact us and we will delete it.

9. Changes to this policy

We may update this policy. The date at the top shows the latest version, and we publish changes on this page.

10. Contact

SRL Vinfoteca & Co – 17 Buna Vestire Street, Cricova, MD-2084, Republic of Moldova – info@wineshop.md – +373 795 78 818.