Privacy Policy

Cork Pop Brothers ApS is the data controller for the personal data described in this policy. Our contact details are above. We have not appointed a Data Protection Officer — our processing doesn't meet the threshold that requires one — but the contact details above reach the people responsible for data protection at the company.

2.1 Placing an order. When you check out, we collect your name (and company name, if you're ordering as a business), email, phone number, shipping address, billing address if different, and — optionally — a VAT/CVR number for business invoicing. We use this to fulfil your order: reserving stock, invoicing, arranging delivery, and sending you the order confirmation, receipt, and any cancellation or credit note documents by email. Legal basis: performance of a contract with you (GDPR Art. 6(1)(b)), and, for the bookkeeping side of it, our legal obligation to keep accounting records (Art. 6(1)(c) — see retention periods below).

2.2 Creating an account. An account is optional — guest checkout is always available. If you create one, we collect your email address; your password is handled entirely by our authentication provider and is never visible to us in plain text. An account lets you see your order history and reuse saved shipping details. Legal basis: performance of a contract (Art. 6(1)(b)).

2.3 Joining a waitlist. If you ask to be notified when a sold-out wine becomes available, we collect your name, email, and any message you add, along with which wine you're interested in. Legal basis: legitimate interest (Art. 6(1)(f)) — specifically, ours and yours, in letting you know when something you asked about is back.

2.4 Age verification. Before you can browse the Site, we ask you to confirm you're of legal drinking age. This is a yes/no toggle stored only in your own browser (not sent to us or stored on our servers), so no personal data changes hands at this step.

2.5 Joining our newsletter. If you sign up using the newsletter link in our footer, we collect your email address so we can occasionally send you things we think are worth your time — a new arrival, the story behind a bottle, that sort of thing. This is opt-in only: we ask for your email and nothing else, and we only add you if you've actively signed up. Legal basis: your consent (Art. 6(1)(a)) — which you can withdraw at any time by unsubscribing (a link is in every email we send) or by asking us directly.

2.6 What we don't collect. Beyond the newsletter above, we have no marketing mailing list, and no advertising or behavioural-tracking cookies. If that changes in the future, we'll update this policy and ask for your consent before adding you to anything new.

We don't sell your data, ever. We do share it with a small number of parties who need it to actually get your wine to you:

• Supabase (database, account login, and file storage), hosted in the EU (Ireland).
• Resend, who send the transactional emails your order generates (confirmations, receipts, cancellations, credit notes), and — for those who've subscribed — our occasional newsletter, on our behalf. Resend processes EU customer data exclusively on EU-based infrastructure (Frankfurt, Germany) under their published data processing agreement — your data doesn't leave the EU on its way through them.
• Cloudflare, who sit in front of the Site for security and performance (this is where the one cookie described in Section 6 comes from).
• Lovable, our website hosting and development platform.
• Our carriers and storage/logistics partners (including our bonded-storage partner for bottles held off-site), who receive your name and delivery address for the sole purpose of shipping your order.
• Your bank and ours, incidentally, when you make a bank transfer — we don't collect your banking details ourselves; payment goes directly from you to our account.
• Danish tax and accounting authorities, where required by law.

Each of these processes data on our instructions, under a data processing agreement, and only for the purposes described here.

Your data stays within the EU. Supabase runs in Ireland, and Resend processes EU customer data on EU-based servers (Frankfurt) — so no international data transfer takes place in the ordinary course of running the Site.

Order and invoicing data: five years from the end of the financial year the order falls in, as required by the Danish Bookkeeping Act (bogføringsloven). We can't shorten this even on request, since it's a legal record-keeping obligation.

Account data: for as long as your account is open. Close it (or ask us to) and we'll delete what we're not separately obliged to keep for bookkeeping.

Waitlist entries: until we've notified you the wine is back — or after 12 months of no activity, whichever comes first.

Newsletter subscribers: three years from the last time you confirmed you wanted to hear from us (signing up counts as confirming). After three years without reconfirmation, we remove you automatically rather than let the list go stale. You can unsubscribe at any time before then, no reason needed.

We use exactly one cookie: __cf_bm, set by Cloudflare for security and bot protection. It's short-lived and doesn't identify you personally or track you across other sites. Under the Danish Cookie Order, this kind of strictly-necessary security cookie is exempt from consent — but we're telling you it's there anyway, in the spirit of not springing anything on you.

Your shopping cart and, if you create an account, your login session are stored in your browser's local storage rather than a cookie — same idea (letting the Site remember what you're doing), different mechanism. Neither is used to track you, and both disappear if you clear your browser data.

We don't use analytics, advertising, or cross-site tracking cookies of any kind. If you're wondering why there's no cookie consent banner on the Site, that's deliberate, not an oversight — we explain why on our No cookie banner? page.

Under GDPR, you can ask us to:
• Access the personal data we hold about you.
• Correct it, if it's wrong or out of date.
• Delete it, subject to what we're legally required to keep (see Section 5).
• Restrict or object to our processing of it in certain circumstances.
• Receive a copy of it in a portable format.

To exercise any of these, email hello@corkpopbrothers.com. We'll respond within a month.

If you're not satisfied with our answer, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark — dt@datatilsynet.dk, datatilsynet.dk — or to the data protection authority in your own EU country of residence.

This Site is for buying alcohol and isn't directed at anyone under the legal drinking age. We don't knowingly collect data from minors.

We may update this policy as the Site or our data practices change. The version in force at the time you use the Site is the one that applies.

Cork Pop Brothers ApS, Egernvænget 210, 2980 Kokkedal, Denmark · CVR no. DK45175529 · hello@corkpopbrothers.com · +45 40 16 05 05