Skip to content
Tsiakkas Winery

Privacy Policy

Last updated: 27/10/2026

1. Introduction

At Tsiakkas Winery Ltd, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website www.tsiakkaswinery.com, attend an event, or interact with us in any way.

We process your data in accordance with the General Data Protection Regulation (EU 2016/679) and the laws of the Republic of Cyprus.

2. Who We Are

3. What Data We Collect

When you book an event on our website, we collect:

  • Identification Data: first name, last name, email address, mobile number, date of birth
  • Booking Data: the event, number of tickets, amounts paid and refunded, your booking language, and your acceptance of our Terms & Conditions (with the date and version accepted)
  • Notes About Your Needs (optional): any note you add about allergies, dietary or accessibility needs. This may include health information, so we treat it as sensitive data (see §6 and §11)
  • Booking History: the events you have booked with us before
  • Payment Data: your payment is processed by Stripe. We receive only the payment status, the amount and a Stripe reference — never your card details
  • Technical Data: to protect our website from abuse, we briefly keep a scrambled (hashed) form of your IP address

When you contact us by email or phone, we keep what you send us.

When you visit us or buy wine at the winery, we do not usually record who you are. In some cases we may record your name, email address and phone number, together with an internal customer category we use to organise our customer records, in our sales system (Odoo).

We do not send marketing emails, and we do not use analytics, advertising or tracking tools on our website.

4. How We Collect Your Data

We collect data in the following ways:

  • When you book an event on our website
  • When you contact us via email or phone
  • When you visit us or attend an event

Table reservations are made through Resos, a third-party booking service, which collects your reservation details under its own privacy policy.

5. Why We Collect Your Data

We use your data for the following purposes:

  • To take your booking and payment, and send your confirmation email
  • To email you about cancellations, refunds, or changes to the date or time of your event
  • To email you other practical information about an event you have booked
  • To confirm you are 18 or over, as wine is served at our events (this is why we ask for your date of birth)
  • To prepare your visit, using any note you add about allergies, dietary or accessibility needs
  • To recognise you as a returning guest (see below)
  • To keep records of customers who buy from us at the winery, so we can look after them well
  • To support you through inquiries or issues
  • To maintain accurate records for accounting
  • To protect our website from fraud and abuse

Returning guests: when you book again with the same mobile number and email address, we link the new booking to your earlier ones, so we can welcome you properly. The booking form never shows your stored details to anyone.

6. Legal Basis for Processing

We rely on the following legal grounds to process your data:

  • Contract – when taking and managing your bookings, payments, refunds and booking emails
  • Legal obligation – where we are required to keep accounting records, and to make sure we do not serve alcohol to anyone under 18
  • Legitimate interests – recognising returning guests, keeping records of customers who buy from us at the winery, handling your inquiries, and protecting our website from abuse
  • Explicit consent – for any note you choose to add about allergies, dietary or accessibility needs. You can ask us to delete it at any time

7. Sharing Your Data

We do not sell your data. We share it only with the service providers that help us run bookings and sales, each of which handles it only to provide its service to us:

  • Stripe – processes your payment, sends your receipt and handles refunds (EU and USA). Stripe also acts on its own account for fraud prevention and legal duties, under its own privacy policy
  • Brevo – sends our booking emails (EU)
  • Netlify – hosts our website (USA and global network)
  • Neon – hosts our booking database (EU)
  • Odoo – our sales system, where we keep records of customers who buy from us at the winery (EU)

All third-party providers are contractually obligated to maintain the confidentiality and security of your data. Where data is transferred outside the EU, it is protected by the EU–US Data Privacy Framework or the EU’s standard contractual clauses. We may also share data where the law requires it, for example with the tax authorities.

8. Data Storage & Retention

Your data is stored securely. We retain data for as long as necessary:

  • Your details and booking history: until 5 years after your last booking, or earlier if you ask us to delete them. We then anonymise them: your name, email address, mobile number, date of birth and notes are removed, and only the bare booking and payment amounts remain, with no link to you
  • Records of customers who buy at the winery: until 5 years after your last purchase, or earlier if you ask us to delete them
  • Accounting records: up to 7 years (for legal compliance). Anonymised records are used for this
  • Technical data (hashed IP address): deleted within a day
  • Stripe and Brevo keep their own records of payments and emails under their own retention rules

9. Your Rights Under GDPR

You have the right to:

  • Access your personal data
  • Request corrections
  • Request deletion of your data
  • Receive a copy of your booking data in a common format (data portability)
  • Withdraw consent at any time (for example, for a note about your needs)
  • Object to processing based on our legitimate interests
  • File a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy)

To make a request, email visit@tsiakkaswinery.com or contact@tsiakkaswinery.com, preferably from the email address you booked with. We may ask you to confirm your identity, and we reply within one month.

10. Cookies

Our public website does not use analytics, advertising or tracking cookies. When you pay, you are taken to Stripe’s checkout page, where Stripe sets its own cookies to process your payment and prevent fraud.

You may manage or disable cookies in your browser settings. See our Cookie Policy for more.

11. Data Security

We use secure servers, encryption, and access controls to protect your personal data. Only authorized team members can access sensitive information. Notes about allergies, dietary or accessibility needs are visible only to winery staff and are used only to prepare your visit.

12. Third-Party Links

Our website may include links to third-party services or websites. We are not responsible for their privacy practices, and we encourage you to read their privacy policies before sharing personal data.

13. Policy Updates

We may update this Privacy Policy from time to time. We encourage you to revisit this page to stay informed. The “Last updated” date reflects the latest version.

14. Contact Us

If you have questions about this Privacy Policy or how we use your data, please reach out to:

📧 visit@tsiakkaswinery.com / contact@tsiakkaswinery.com
📞 +357 96 844 111 – Andreas Tsiakkas (Visits & Events)
📞 +357 99 244 777 – Kyriaki Orphanou (Office & Accounting)