Privacy policy

1. Who we are

The Vault by Kemme Wines is a trade name of KEMME WINES, registered with the Dutch Chamber of Commerce under number 90807065, VAT number NL004843119B19, located at Overschiestraat 184, 1062 XK Amsterdam, the Netherlands.

KEMME WINES is the controller of the personal data we collect through thevaultbykemme.com. We handle your data with care, in accordance with the General Data Protection Regulation (GDPR).

Questions about privacy can be sent to contact@thevaultbykemme.com or via our contact page.

2. What data we process

Data you provide to us

• name, e-mail address and, if you enter it, phone number (a phone number is not required at checkout);
• billing and delivery address, and the delivery day and time slot you choose at checkout;
• your confirmation that you are 18 or older (we do not ask for your date of birth);
• your account: login details, saved addresses and order history;
• the wines you save as favourites. We keep them with your account, so you see them on every device where you log in;
• your member club membership: your level and the period over which it is calculated;
• an invitation code you redeem, and whether you requested the link to the WhatsApp group for Prestige members;
• messages you send us, for example with a question, complaint or return;
• your e-mail address, the wine and your language if you ask to be notified when a sold-out wine is available again;
• a review you post. With a review we show your first name and the first letter of your surname, together with your rating and your text.

Data that arises when you use the web shop

• the contents of your shopping cart, as soon as you enter your e-mail address at checkout;
• technical data such as IP address, browser and device, needed to make the web shop work and keep it secure;
• your cookie choice and the moment you made it;
• with your consent: data about your website visit via Google Analytics and the Meta Pixel (see our cookie statement).

Payment details are entered with our payment provider Mollie. We receive the status of the payment and a payment reference, not your full account or card details.

3. What we use your data for, and on what legal basis

Reminder for an abandoned cart. If you enter your e-mail address at checkout and do not complete the order, we may send you one reminder. We only do so if you chose "Accept all" in your cookie choice and you are logged in with an e-mail address you have confirmed is yours. We send at most one reminder per cart and at most one per e-mail address per seven days, only during the daytime and not if you have since placed an order.

Member club. Your membership level is calculated automatically based on your purchases over a twelve-month period. It determines which benefits you receive, such as free shipping. Prestige can only be reached with a personal invitation.

Withdrawing consent is always possible, without affecting what we did with your consent before. For cookies you do this via "Cookie settings" at the bottom of every page, for the selection letter via the unsubscribe link in every e-mail.

4. Who we share your data with

We do not sell your data. We only share it with parties we need in order to serve you, and never more than necessary. Service providers that process data on our behalf do so in accordance with our instructions and under agreements on security and confidentiality. Some parties, such as Mollie, PostNL, Meta and Google, also process data partly as independent controllers; for that part their own privacy policy applies.

WhatsApp group for Prestige members. If you join the group, WhatsApp (Meta) processes your phone number and profile details in accordance with WhatsApp's own privacy policy, and the other members of the group can see your phone number. Joining is voluntary. We only record that you requested the link, and when.

We may also disclose data where the law requires us to, for example to the tax authorities.

5. Transfers outside the European Economic Area

Some of our service providers are US companies (Vercel, Cloudflare, Resend, Microsoft, Meta, Google, Supabase and Sentry). As a result, your data may end up in the United States or be accessible from the United States. This only happens on the basis of appropriate safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

Where possible, we choose storage or processing in the EU, as with Supabase (Frankfurt), Resend (Ireland) and Sentry (EU region).

6. How long we keep your data

We do not keep your data longer than necessary for the purpose for which we collected it. After that we delete it or make it anonymous.

7. Your rights

You have the right to:

• access the data we hold about you;
• have incorrect data corrected;
• have your data deleted;
• have the processing restricted;
• object to processing based on legitimate interest;
• receive or have transferred your data in a common format (portability);
• withdraw your consent, for cookies via "Cookie settings" at the bottom of every page and for the selection letter via the unsubscribe link.

Deleting your account. You can delete your account yourself in My account, or ask us to do it for you. We then erase your personal data and your membership level, including your saved addresses, favourites and shopping cart. If you later sign up again with the same e-mail address, you start again at the first level. Data we are legally required to keep, such as orders and invoices, is retained in anonymised form.

Send a request to contact@thevaultbykemme.com or via our contact page. We respond within one month. To prevent someone else from requesting your data, we may ask you to confirm that the request comes from you.

If you disagree with how we handle your data, please let us know. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

8. Security

We protect your data with appropriate technical and organisational measures. The web shop only works over an encrypted connection, the database is shielded from outside access, the back office is only reachable after an additional verification, and we do not process your payment details ourselves.

9. Minors

We sell alcoholic beverages and are aimed exclusively at people aged 18 and over. We do not knowingly process data of minors.

10. Changes

We may amend this statement, for example when we start using a new service. The most recent version is always on this page, with the date at the top. If our use of cookies changes substantially, we will ask for your choice again.