Last Updated: December 20, 2023
Personal Information We Collect
We may collect certain personal information (also referred to as “personal data” in some jurisdictions) from you when you use our Services. Personal information is any information that relates to you, identifies you personally, or could be used to identify you. We collect the following categories of personal information:
- Identifiers, such as your name, address, email address, date of birth, telephone number, IP address.
- Commercial Information, including order and prior order information, and information provided in relation to customer service inquiries.
- Online Activity, such as internet activity information, including IP address, internet service provider, operating system, browser information, device information, browsing history, your interactions with the Services.
- Financial Information, such as credit card number or debit card number to pay for wine purchases.
- Communications Data, such as the nature and content of communications, date and time sent, etc.
- Other information you voluntarily provide, including web form and poll responses and posts on the Services.
How We Collect Personal Information
We collect personal information in the following ways:
- When you provide it directly to us or other parties. We may also collect other information that we request from you, and that you provide to us. In many cases, such information will be collected directly from you but information may also be gathered from our affiliated brands, third-party sources such as marketing and fulfillment companies, opt-in lists, publicly available data, and other companies and referrals.
- When we collect it automatically. We may also collect certain personal information gathered from you passively through automated means such as the referring URL, your IP address, which browser you used to come to the Sites, the country, state or province from which you access our Sites, cookie IDs and segment IDs associated with cookie IDs, the pages of our Sites that you viewed during your visit, duration and frequency of visit, any search terms entered on our Sites, demographic information, log file data, and/or other usage statistics.
For more information, please see the “Tracking Technology” section below.
Cookies and Other Tracking Technology
Cookies. When you visit our Services, we (or third-party data or ad networks we work with) may send one or more “cookies” to your computer or other devices. Cookies are alphanumeric identifiers stored on your computer through your web browser and are used by most websites to help personalize your web experience. Some cookies may facilitate additional site features for enhanced performance and functionality such as remembering preferences, allowing social interactions, analyzing usage for site optimization, providing custom content, allowing third parties to provide social sharing tools, and serving images or videos from third-party websites. Some features on the Services will not function if you do not allow cookies. The following types of cookies may be used on our Services:
- Essential Cookies
These cookies are essential because they enable you to use our Services as you reasonably expect. For example, strictly necessary cookies allow you to access secure areas on our Sites and provide necessary security functions. Without these cookies, some features cannot be provided. This category of cookies is essential for our Services to work and they cannot be disabled.
- Targeted Advertising Cookies
These cookies may be set through our Services by our marketing partners. Personal Information may be collected by these companies that enable them to serve up advertisements on other sites that are relevant to your interests.
- Personalization Cookies
We use functional cookies to remember your choices so that we may tailor our Services to provide you with enhanced features and personalized content. While these cookies can be disabled, this may result in less functionality during your use of our Services.
- Analytics Cookies
These cookies allow us to collect passive information about your use of our Services, for example, count page visits and traffic sources so we can measure and improve the performance of our Services and our marketing activities.
You have the right to decide whether to accept cookies. If you do not want us to deploy cookies in your browser, you may exercise your preference through our cookie preferences manager, which you can access by clicking on the cookie symbol in the bottom right hand corner of this screen, or by modifying your web browser setting to either (1) refuse some or all cookies or (2) notify you and ask for your permission when a website tries to set a cookie.
If you want to learn the correct way to modify your browser settings, please use the “Help,” “Tools” or “Edit” menu in your browser or review the instructions provided by the following browsers: Internet Explorer, Google Chrome, Mozilla Firefox, Safari Desktop, Safari Mobile; and Android browser. If you choose to disable cookies in your browser, you can still use our Sites, although your ability to use some of the features may be affected.
Mobile App Advertising
When you use our mobile application, we or our third party marketing partners may use one or more of several different identifiers for your mobile device, including Apple Identifier For Advertising (IDFA) or Android Advertising ID (AAID), to target and deliver ads to you in our app or other apps. This means that your device identifier may be accessed by third-party ad networks and used to (a) help manage the number and types of ads you see; (b) track the source of installs related to ads seen in other apps; and (c) identify your interests and behavior and target advertising to you based on those interests and behavior.
Apple requires app developers to ask for permission before they can track your activity across apps or websites they do not own in order to target advertising to you, measure your actions due to advertising, or to share your information with data brokers. If you previously gave our mobile app permission to track, you can tell our app to stop tracking your activity. On iOS or iPadOS, go to Settings, tap on our app, then tap to turn off Allow Tracking. You can also reset your IDFA from your mobile device’s settings page, which will prevent continued use of existing behavioral data tied to your previous IDFA.
If you have an Android device, and are running Android 12 or above, you can delete your AAID permanently by opening Settings, navigating to Privacy > Ads, tapping “Delete advertising ID,” then tapping it again on the next page to confirm. This will prevent any app on your phone from accessing it in the future. Please note that if you do so, you will still see advertisements, but they will not be tailored to your inferred interests.
You may also access industry-provided opt-out tools, although they are not tailored to our mobile applications. For instance, to opt-out of data collection by the Digital Advertising Alliance’s participating member companies for interest-based advertising across mobile applications, download the DAA’s App Choices mobile application opt-out offering at https://youradchoices.com/appchoices.
Website Interest-Based Advertising
Many advertising companies that collect information for interest-based advertising are members of the Digital Advertising Alliance (DAA) or the Network Advertising Initiative (NAI), both of which maintain websites where people can opt out of interest-based advertising from their members. To opt out of website interest-based advertising provided by each organization’s respective participating companies, visit the DAA’s opt-out portal available at http://optout.aboutads.info/, or visit the NAI’s opt-out portal available at http://optout.networkadvertising.org/?c=1.
Do Not Track
Some Internet browsers, such as Internet Explorer, Firefox, and Safari, include the ability to transmit “Do Not Track” or “DNT” signals. Since uniform standards for “DNT” signals have not been adopted, our Site does not currently process or respond to “DNT” signals.
Why We Collect Personal Information
- To process your requests and wine club orders
- To communicate with you about our products, services, offers, events and to offer customer support
- To offer you products and services we believe may be of interest to you
- To analyze trends and enhance our communications strategies with you
- To improve the quality of our online guest services
- To facilitate purchases and transactions
- To verify your identity
- To detect and protect against malicious, deceptive, fraudulent, or illegal activity, including violation of our policies and terms and conditions, security incidents, and harm to the rights, property, or safety of us and our users, employees, or others
- To comply with legal requirements, judicial process, and our policies
- To protect the safety and security of you and our personnel
- When it is necessary for other legitimate purposes, such as protecting our confidential and proprietary information
How We Share Personal Information
- Between Affiliated Entities
- To Comply with Our Legal Obligations
We may share personal information as needed to: (a) comply with applicable law or respond to, investigate, or participate in valid legal process and proceedings, including from law enforcement or government agencies; (b) detect, prevent, or investigate potential fraud, abuse, or safety and security concerns, including threats to the public; (c) meet our corporate and social responsibility commitments; (d) protect our and our customers’ rights and property; and (e) resolve disputes and enforce agreements.
- To Service Providers
We may also contract with other companies and individuals to perform certain functions and services, including processing, storing, tracking, and organizing information on our behalf. These third-party service providers may have access to your personal information to perform their functions and to provide services to us. We require our third-party service providers to maintain industry-appropriate security measures to protect your personal information.
- Third Party Marketing Partners
In some cases, we may partner with other companies, affiliates, clients, data vendors and third parties that we have carefully chosen to enhance your customer experience, usually through co-branded partnerships, promotions, and wine club experiences. Subject to the applicable law, you may need to opt in with those third-party partners to enable them to market their or other selected third parties’ products and services to you.
- As Part of a Corporate Transaction
We may share personal data with actual or prospective acquirers, their representatives and other relevant participants in, or during negotiations of, any sale, merger, acquisition, restructuring, or change in control involving all or a portion of our business or assets, including in connection with bankruptcy or similar proceedings.
- Professional Services Organizations
We may disclose your personal information to professional services organizations in connection with exercising our rights and conducting our business activities, such as our legal counsel or accountants.
We have appropriate organizational, technical and administrative security measures to protect again the loss, misuse and alteration of personal information under our control, including encryption and anonymization. While we make reasonable efforts to ensure the integrity and security of our network and system, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure or is ever completely secure or error-free. Please recognize that protecting your Personal Information is also your responsibility. We ask you to be responsible for safeguarding your password, secret questions and answers and other authentication information you use to access our Services.
How Long We Keep Your Information
International Data Transfers
Individuals Under the Legal Drinking Age
Our Sites are not intended for people under the legal drinking age of 21. We do not seek or knowingly collect any personal information from or about individuals under the age of 21. If we become aware that we have unknowingly collected personal information from an individual under the legal drinking age, we will make commercially reasonable efforts to delete such information from our database.
Third Party Links
Information collected by a third party is governed by its privacy policies, and we have no control over, and shall not be responsible for, the third party’s use of your personal information. We encourage you to read the privacy policies of those websites and applications. Our Site may also contain links to social media platforms, and you may be given the choice of connecting to or engaging with one or more social media platforms from this Site. If you choose to do so, then depending upon your social media privacy settings, the personal information that you post, transmit, or otherwise make available on the social media platform may be viewed and/or used by third parties, and we will have no control over such viewing and use. We do not control, and are not responsible for, any use of your information by or through any of the social media platforms. By linking to or engaging with any social media platform, you will be assuming the risk that the information you provide on that platform may be viewed and/or used by third parties for any purposes, and agree that we have no control or responsibility for such third party viewing and uses.
- Marketing Communications
To opt out of receiving electronic marketing communications from us, you may (1) follow the “unsubscribe” instructions contained in any emails you receive, (2) send a blank email with “unsubscribe” in the subject line, to firstname.lastname@example.org from the email address you would like removed, or (3) send us a request at the address in the Contact Us section below. We will endeavor to comply with all requests as soon as reasonably practicable as required by applicable law. Not all of our communications are for marketing, and even is you unsubscribe from marketing, you will continue to receive transactional messages such as those related to an order you placed, an inquiry you made, or a legally required notice.
- Access, Correction & Deletion
You may request to view, update or delete your personal information. Subject to certain exceptions prescribed by law, you will be given reasonable access to your personal information, entitlement to challenge the accuracy and completeness of the information, and the ability to have it amended or deleted as is appropriate. You may submit updated personal information or deletion requests to us as set out in the Contact Us section below. In your request, please make clear what information you would like to have changed or deleted.
If you are a California resident, please see the section below entitled, “Notice for California Residents” for more information about your privacy rights.
If you are located in the European Economic Area, Switzerland or the United Kingdom (“European Countries”) at the time we collect your personal information please see the section below entitled “Notice for Individuals in the EEA, Switzerland and the United Kingdom” for more information about your privacy rights.
Notice for California Residents
This Privacy Notice for California Residents supplements the information contained above and applies solely to all visitors, users, and others who reside in the State of California. All references to a “consumer” in this Notice shall include the categories of data subjects covered by this Notice who are residents of the State of California.
Categories of Information Collected
We have collected the categories of personal information described in the “Personal Information that We Collect” section above from its customers within the last twelve (12) months. We receive this information from you (including through your use of our Services); from partners; from customers; and from publicly available sources. We do not knowingly collect or process personal information of individuals under the age of 21.
Business and Commercial Purposes
We may use the categories of personal information listed above for the purposes described in “Why We Collect Personal Information” section above, and with the parties listed in the “How We Share Personal Information.” In addition, for CCPA compliance purposes, we collect and share personal in performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytics services, providing storage or providing similar services:
- Helping to ensure security and integrity;
- Debugging to identify and repair errors that impair existing intended functionality;
- Undertaking internal research for technological development and demonstration;
- Providing advertising and marketing services;
- Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance; and
- Short-term, transient use, such as non-personalized advertising shown as part of your current interaction with us.
We do not collect or process Sensitive Personal Information (as defined by the CCPA) for the purpose of inferring characteristics about individuals.
To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.
Personal Information We Sell or Share (for Cross-Context Behavioral Advertising)
The categories of personal information we may sell or share for advertising purposes to third parties include:
Categories of Third Parties
Categories of Personal Information
-Providing marketing and advertising services
-Engaging in cross-context behavioral advertising
This section describes California consumers’ rights and explains how to exercise those rights.
- Right to Access
You may have the right to obtain a copy, or a list of categories of the personal information that we hold about you, as well as other supplementary information, such as the purposes of processing, and the entities to whom we disclose your personal information.
- Right to Portability
You have the right to receive a copy of the personal information we have collected about you in a structured, commonly used and machine-readable format.
- Right to Correct
You may have the right to correct any of your personal information in our records and systems. You may request us to rectify, correct or update any of your personal information held by us that is inaccurate.
- Right to Delete
Under certain circumstance, you may have the right to request that we delete the personal information that we hold about you. This right is not absolute, and we may refuse such a request if there are compelling legitimate grounds for keeping your personal information, for legitimate purposes, or as required by law. In addition, in the event your deletion request is honored, we may retain a record of your deletion request as required under applicable law.
- Right to Opt-Out of Sale and Sharing for Targeted Advertising Purposes
- Right to Limit Use and Disclosure of Sensitive Personal Information
To the extent your Sensitive Personal Information, as defined by the CCPA, is used to infer characteristic about you, you have the right to object to our processing of your Sensitive Personal Information. We do not process such information to infer characteristics about you.
- Right Against Discrimination
You have the right not to be discriminated against for exercising any of the rights described in this section. We will not discriminate against you for exercising your rights.
Submitting a Request to Exercise Your Rights
Access, Portability, Correction and Deletion
You may exercise these rights by: (i) emailing us at with the subject line “CCPA Rights Request”, or (ii) calling us toll-free at 800-355-8008, or sending an email with the request to Stonestreet. In addition, you may submit a written rights request to the appropriate address listed in the “Contact Us” section. In your request, please make clear which right you would like to exercise. Before fulfilling your request, we may be required by law to have you to verify the personal information we already have on file to confirm your identity. If we cannot verify your identity based on the information we have on file, we may request additional information from you, which we will only use to verify your identity, and for security or fraud-prevention purposes.
You may use an authorized agent to submit a rights request on your behalf. If you use an authorized agent to submit requests on your behalf, we will require you to directly verify your identity with us, or have you directly confirm with us that the authorized agent has been authorized to act on your behalf.
We will not charge a fee or refuse to process or respond to a verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee or refusal, we will notify the customer of such and, if applicable, provide a cost estimate before completing the customer’s request.
Selling and Sharing
You may exercise your right to opt-out by clicking on the cookie in the bottom right hand corner of this page, and moving the toggle under “Do Not Sell or Share My Personal Information” to the right. For information about how to opt-out of sharing or selling on our mobile application, please see Tracking Technologies section above.
California residents may also opt-out of sharing and sales by using an opt-out preference signal for each participating browser system that you use. We will honor and process the opt-out preference signal in a frictionless manner. To start using an opt-out preference signal, please refer to the instructions provided here. You will need to submit a separate opt-out of sharing request on each device and browser you use to visit our Sites. Please note that you may still receive generalized ads after opting out of targeted advertising.
California’s Shine the Light Law
California Civil Code Section 1798.83, also known as “Shine The Light” law, permits California residents to annually request information regarding the disclosure of your personal information (if any) to third parties for the third parties’ direct marketing purposes in the preceding calendar year. Upon request, we will identify the categories of information shared, and will include a list of the names and addresses of third parties with which it has been shared, for the immediately preceding calendar year. If you are a California resident and would like a copy of this notice, please submit a written request using the contact information set forth below. Please note that we are only required to respond to one request per customer each year.
Notice to Individuals in the European Economic Area (EEA), the United Kingdom and Switzerland
This section provides additional information to individuals located in the EEA, the United Kingdom or Switzerland at the time their personal information is collected by Us. All capitalized terms in this Section have the meaning as defined in the General Data Protection Regulation (GDPR) and/or, as applicable, the GDPR as it is saved and incorporated into United Kingdom law following Brexit (UK-GDPR) or the Swiss Data Protection Act (including, but not limited to “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Consent”).
Your Data Protection Rights
You have the following rights pursuant to the GDPR, where applicable, which can be exercised using the contact details of the Controller listed above:
- Right of Access, to obtain from us confirmation as to whether or not Personal Data has been Processed and, if so, access to that Personal Data and additional information about the categories of Personal Data and its source, and how it has been Processed;
- Right to Rectification, to request the correction of incorrect Personal Data or any completed Personal Data we store;
- Right to Erasure, to request the deletion of the Personal Data that we store, except for the allowed continued uses permitted by the GDPR;
- Right to Restriction, to demand the restriction of the Processing of the Personal Data where one of the following applies: (i) as far as the accuracy of the Personal Data is disputed by you; (ii) the Processing of the Personal Data is unlawful, but you reject its deletion; (iii) we no longer need the Personal Data, but you require it to exercise or defend legal claims; or (iv) you have objected to the Processing in accordance with GDPR Article 21;
- Right to Data Portability, to receive your Personal Data in a structured, common and machine-readable format or to request the transfer to another Controller;
- Right to Withdrawal, you have the right to withdraw, at any time, your consent. Such withdrawal does not affect the lawfulness of the Processing based on such consent before such withdrawal; and
- Right to Lodge a Complaint with a Supervisory Authority, complain to a Supervisory Authority (e.g. that of Your usual place of residence or work or place of the alleged infringement). You can find details of EEA Supervisory Authorities here: https://edpb.europa.eu/about-edpb/board/members_en. The Supervisory Authority in the UK is the Information Commissioner’s Office (ICO): email@example.com or 0303 123 1113 / +44 1625 545 700; www.ico.org.uk.
If you have any other questions about our Processing of your Personal Data, please send a request at the contact details specified in the Contact Us section below. Please note that we may request you to provide us with additional information in order to confirm your identity and ensure that you are entitled to access the relevant Personal Data.
Legal Basis for Processing Personal Data
- We only use your information in a lawful, transparent, and fair manner. Depending on the specific Personal Data concerned and the factual context, when we Process Personal Data as a controller for individuals in regions such as the EEA, Switzerland, and the UK, we rely on the following legal bases as applicable in your jurisdiction:
- As necessary for our contract. When we enter into a contract directly with you, we process your Personal Data on the basis of our contract in order to prepare and enter into the contract, as well as to perform and manage our contract. If we do not process your personal data for these purposes, we may not be able to provide you with our Services.
- Consent. Consistent with specific revocable consents, we rely on your prior consent in relation to certain Processing activities, including in order to utilize cookies to engage advertising and analytics partners to deliver tailored advertising and analysis of our website usage. You have the right to withdraw your consent at any time by visiting our cookie management tool, which can be accessed by clicking on the cookie symbol in the right hand corner of our Site.
- To comply with our legal obligations. We Process your Personal Data for compliance purposes as may be required by applicable laws or regulations or as requested by any judicial process or governmental agency (including without limitation for Company’s tax reporting) or as may be requested e.g. under any subpoena or court order.
- Vital interests. We process certain Personal Data in order to protect vital interests for the purpose of detecting and preventing illicit activities that impact vital interests and public safety.
- Legitimate Interest. As necessary for our (or others’) legitimate interests, unless those interests are overridden by your interests or fundamental rights and freedoms, which require protection of Personal Data: We Process your Personal Data based on such legitimate interests to (i) develop, test, and improve our Services and troubleshoot our Services; (ii) ensure authentication, integrity, security, and safety of accounts, activity, and products and services, including detect and prevent malicious conduct and violations of our terms and policies, prevent or investigate bad or unsafe experiences, and address security threats; (iii) send marketing communications, advertising, and promotions related to the products and services; and (iv) comply with non-EEA laws, regulations, codes of practice, guidelines, or rules applicable to us and respond to requests from, and other communications with, competent non-EEA public, governmental, judicial, or other regulatory authorities, as well as meet our corporate and social responsibility commitments, protect our rights and property and the ones of our customers, resolve disputes, and enforce agreements.
International Data Transfers