← My Next Wine

Privacy & GDPR Policy

Version 2026-09-02-US1 · Last updated 2 September 2026

This policy explains the controller processing carried out by Greg Bowe trading as MyNextWine, an Irish sole trader, for My Next Wine, including the My Next Wine Wine Finder service and proportionate business-to-business retailer outreach.

1. Information we process

2. Why we use it

We process information to provide requested services, connect and support merchants, map catalogues, generate and improve recommendations, secure the service, prevent fraud, administer contracts and billing, communicate with users and merchants, and meet accounting, tax, regulatory and legal obligations.

For processing where we are controller, the legal basis is performance of a contract where the individual is personally party to it or asks us to take pre-contract steps, legitimate interests in operating and protecting the service and conducting proportionate B2B activity, compliance with legal obligations, or consent where specifically requested. Where My Next Wine acts as a processor, the merchant must identify its own lawful basis and we process only on its lawful documented instructions; an instruction is not itself an Article 6 lawful basis.

3. Wine Finder shoppers

The shop is the seller and normally controls its customer relationship. My Next Wine processes the shopper's current wine-preference request to return recommendations; no My Next Wine account or email address is required. Original free-text wine preferences, food-pairing requests, AI-derived narrative interpretations and per-wine narrative explanations are cleared within 90 days. Structured category tags, selected wine references, numeric results and non-identifying outcomes may be retained longer for service improvement and aggregate reporting. Attributed WooCommerce order records are limited to the identifiers, currency, totals, items and quantities needed for merchant reporting.

4. Business retailer outreach

For carefully selected wine retailers, we may record the store name, country, ecommerce platform, public website, public role-based business contact details, the particular source, subscriber/corporate-status assessment, marketing-permission evidence, contact dates, outcome and do-not-contact status. These details may be gathered from the retailer's public website or another recorded public business source. They are used for personalised, manual B2B outreach based on legitimate interests, subject to applicable direct-marketing rules.

For UK electronic mail, unsolicited outreach is sent only after we have recorded evidence that the recipient is a corporate subscriber, or that a valid consent or soft opt-in applies. A sole trader, ordinary partnership or recipient of unknown status is treated as an individual subscriber and is not emailed without a qualifying permission. For Irish recipients, we apply the applicable Irish ePrivacy rules, including consent requirements and the right to object. More detail is in our Business Contact Privacy Notice.

We do not use tracking pixels or automated mass outreach for this business-to-business outreach. A prospect may receive an initial message and at most one follow-up unless they engage or opt in. Every message identifies the recorded source and provides a simple reply and secure-link opt-out. Opt-outs are applied promptly. Email/domain hashes and minimal suppression evidence may be retained as long as reasonably needed to prevent future contact; they are not used for another purpose.

5. Recipients, location and transfers

Information may be processed by contracted hosting, database, monitoring, communications, billing and AI providers listed on our subprocessor page. The service is operated by the Irish controller and may use providers in Ireland, the EEA, the UK and other countries. Where a restricted transfer requires safeguards, we use an applicable adequacy decision, the EU Standard Contractual Clauses and, for UK transfers where appropriate, the UK International Data Transfer Addendum or another lawful safeguard. A safeguard must be in place before the relevant transfer. Shopify, Stripe, WooCommerce merchants and other platforms may also act as independent controllers for their own relationships.

6. Retention and security

We retain information only for the service, support, security, contract, billing, accounting, legal-claims or suppression period applicable to it, then delete or anonymise it through normal operational and backup cycles. Measures include access controls, encryption of sensitive credentials and selected records at rest, signed requests, replay protection, rate limits and restricted production access. No system can be guaranteed completely secure.

7. Your rights and complaints

Depending on applicable law, you may request access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. You have an absolute right to object to use of your personal data for direct marketing. Contact the merchant first where it controls the relevant shopper/customer data; contact us for our controller records or to opt out of outreach.

To make a data-protection complaint, email the privacy contact above with the subject “Data protection complaint” and describe what happened and the outcome you want. You may also write to the business address or, if a UK representative is listed above, contact them. We will help you make the complaint, acknowledge it within 30 days, investigate and keep you informed, and communicate the outcome without undue delay.

You may complain to the Irish Data Protection Commission or another competent supervisory authority. Where UK data-protection law applies, you may also complain to the UK Information Commissioner's Office (ICO). You do not have to complain to us first, and mandatory rights are not limited by this policy.

8. Changes

We may update this policy when services, providers or law change. The current version and date will remain published here, and material merchant changes will be notified through a reasonable channel.