Version date: 2022.04
We are committed to safeguarding your privacy. This policy sets out how we will treat your personal data. In this policy, "personal data" means information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified individual, or an individual who is reasonably identifiable.
The website www.cloudybay.com (the “Site”) is operated by Cloudy Bay Vineyards Limited, a New Zelander company having its registered address at Level Jacksons Road, Woodbourne, Marlborough, 7273 PO Box 376, New Zealand, with company number 271895, (“Cloudy Bay” or “we”) in its capacity of data controller for the purposes of applicable data protection laws and regulations, including the General Data Protection Regulation (GDPR) of 27 April 2016 and the Californian Consumer Privacy Act (CCPA) (or any replacing law, act or regulation regarding Data Protection in force in your country).
Outside Australia or unless otherwise indicated, the Moët Hennessy affiliate with which you are in contact or which is mentioned in the legal notices on the Site, in the Terms & Conditions of Use or in the Terms & Conditions of Sale, whether in your country of residence or abroad, has the capacity of joint controller with Cloudy Bay Vineyards Limited.
Personal data is collected directly from you when you use the Site and our services or automatically when you access the Site.
We may collect and process the following categories of personal data.
Information you provide to us :
Information automatically collected :
Personal data is collected directly from you, except when you are a gift recipient in which case the source of collection of your personal data is the gift purchaser. In such case, the following information is collected indirectly: first name, last name and email address. We may also collect indirectly from our social media partners the fact that you are using their social networks and your associated advertising identifiers. If we receive further information about you from someone else, we will take reasonable steps to ensure you are aware that we have collected personal information about you and the circumstances of the collection.
We may also collect information that you provide to us about other people, for example when you decide to purchase and send products to someone, or when you participate in a lottery/contest on our Site and want to invite friends to participate as well. We use this information only to respond to your requests and will not send marketing communications to your contacts unless they choose to receive communications from us.
We collect and process your personal data for the purposes listed below.
In order to perform a contract with you or in order to take steps at your request prior to entering into a contract (legal basis: Art. 6 (1) (b) GDPR):
In order to comply with our legal obligations (legal basis: Art. 6 (1) (c) GDPR):
Based on your prior consent (legal basis: Art. 6 (1) (a) GDPR):
Based on our legitimate interests (legal basis: Art. 6 (1) (f) GDPR) to (i) ensure the security of our Site and its users and the compliance with our Terms & Conditions of Use and (ii) improve our products and services and the client relationship, which are not overridden by your data protection rights:
When we ask you to supply us with personal data we will make it clear where there is a statutory or contractual (mandatory) requirement to provide personal data and the consequences of not providing the data (for example, that we will not be able to process your order). If you do not provide us with certain kinds of personal information, we may not be able to fulfil the applicable purposes of collection.
In accordance with law, Cloudy Bay may share your personal data with:
The Site may contain links to other websites for reference purposes only. We are not responsible for the content, privacy notices or practices of third party websites in these circumstances. Please contact them directly for more information.
We may transfer personal data to countries outside the European Economic Area ("EEA"), including to countries which have different data protection standards to those which apply in the EEA. Any transfer of your Data outside the EEA is covered by appropriate safeguards compliant with applicable data protection legislation. You have a right to ask us for a copy of these safeguards (by contacting us as set out below).
For any questions regarding data transfers outside the European Economic Area, you can contact Cloudy Bay at the address set out below “Contact DPO”.
|Data processing||Data retention period|
|Creation and management of your account on Cloudy Bay Site||Deletion after 3 years of inactivity|
|Handling of orders and delivery of products, experiences and services||6 years in archived after the validation of the order|
|Online payment processing||Relevant banking data is accessible to us until transaction is completed|
|Communication with you via contact form||Duration of the request resolution, then archived during 3 years starting from the resolve of the request|
|Legal claims management and compliance purposes||Duration of the claim and 5 years from the date of the resolution. If legal action : duration of the procedure until full execution of the Court decision or settlement agreement.|
|Sending of updates, news and other special offers from Cloudy Bay||3 years after the last contact from you|
|Show advertisements on your social network newsfeed and to other people like you||3 years after the last contact from you|
|Security and integrity of Cloudy Bay Site||Duration of security and integrity processes which may vary according to the operations carried out (3 to 6 months)|
|Fraud detection and prevention||Duration of the investigation (3 to 6 months) and then duration of the legal proceedings (if so)|
|Geolocation||No data retention|
We may update this notice from time-to-time by posting a new version on our Site.
You should check this page occasionally to ensure you are happy with any changes. We may also notify you of changes to our notice by email.
You may ask us for a copy of your information, to correct it, erase it or to transfer it to other organisations at your request. You also have rights to establish instructions for the management of your data after death, to object to some processing and, where we have asked for your consent to process your data, to withdraw this consent. In particular, you have rights to object to direct marketing at any time. Where we process your data because we have a legitimate interest in doing so (as explained above), you also have a right to object to this. These rights may be limited in some situations (for example, where we can demonstrate that we have a legal requirement to process your data).
In order to respond to your request we may need to ask you to provide proof of identity or additional information. We will endeavour to respond your request as soon as possible.
These rights may be exercised at any time by sending a letter or an e-mail to the following addresses:
“Data Protection Officer – 30/F, PCCW Tower, 979 King's Road, Takikoo Place – Quarry Bay, Hong Kong”, or to email@example.com.
California residents’ rights. If you reside in California and are not a job applicant, employee or employee of another company interacting with us in your job role, you have the right to ask us what information we collect and use. You also have the right to ask what information we disclose and sell. You also have the right to request that we delete information we have collected from you. To exercise your rights contact us at +1 (888) 914-9661 (use the pin 412774 when prompted to submit your request) or here. We will use information you provide to us to verify your request by matching the information you give us with information we already have about you. We will not discriminate against you because you have exercised any of your rights under the California Consumer Privacy Act. You can designate someone else to make a request by having them execute a notarized power of attorney to act on your behalf.
Sales of information. Under California law we are required to tell California residents if we “sell” information as that term is defined by applicable law. Sell means to share personal information with a third party for monetary or other valuable consideration. California residents, we do not do this based on our understanding of that term. We do not have actual knowledge that we sell personal information of minors under the age of 16.
Should you have any question about the collection and processing of your Data by Cloudy Bay, please contact the Data Protection Officer of Cloudy Bay by writing at “Data Protection Officer – 30/F, PCCW Tower, 979 King's Road, Takikoo Place – Quarry Bay, Hong Kong”, or by sending an e-mail to DPO.AP@moethennessy.com
We hope that we can satisfy queries you may have about the way we process your data. However, if you have unresolved concerns you also have the right to complain to data protection authorities.
If you are not satisfied with the response or do not receive a response within a reasonable timeframe, you may have the right to take your complaint to the applicable regulator in your jurisdiction. In Australia, the applicable regulator is the Office of the Australian Information Commissioner (OAIC). Current contact details for the OAIC are available on the OAIC's website at www.oaic.gov.au.
A "cookie" is a piece of information, like a tag, that is stored on your computer, tablet or phone when you visit a website. It can help identify your device (like your PC or mobile phone) whenever you visit that website.
Cookies are used by most major websites including Cloudy Bay’s. To make the best use of our Site, on whichever device you use, you'll need to make sure your web browser is set to accept cookies.
A cookie will typically hold:
We use the following categories of cookies on our Site:
You can access to the list of the cookies we use and manage your consent by clicking here.
You can access to the list of our trusted affiliates and partners using cookies on our Site here.
Session cookies - these cookies only last until you close your browser. They are not stored on your hard drive. They are usually used to track the pages that you visit so that information can be customised for you for that visit.
Persistent cookies - these cookies are stored on your hard drive until you delete them or they reach their expiry date. These may, for example, be used to remember your preferences when you use the Site. The lifespan of such cookies will not exceed twelve (12) months from date of consent.
If you decline cookies, some aspects of the Site may not work on your computer or mobile phone and you may not be able to access areas you want on the Site. For this reason we recommend that you accept cookies.