Last Updated: September 2026
About This Notice
The General Data Protection Regulation (GDPR) is a European Union regulation that provides enhanced data protection rights for individuals within the EU and EEA. Although Vine-sage is based in South Africa, we are committed to respecting the privacy rights of all our website visitors, including those from European jurisdictions.
This page outlines specific information relevant to GDPR compliance and supplements our main Privacy Policy.
Data Controller
Vine-sage acts as the data controller for personal information collected through our website. This means we determine the purposes and means of processing personal data.
Contact Details:
Vine-sage
42 Bree Street
Cape Town, 8001
South Africa
Email: [email protected]
Lawful Basis for Processing
Under GDPR, we must have a valid legal basis for processing your personal data. Depending on the context, we rely on the following bases:
Consent
Where you have given clear, informed consent for us to process your personal data for specific purposes. This applies to:
- Non-essential cookies and analytics
- Marketing communications (if applicable)
You may withdraw consent at any time by contacting us or adjusting your browser settings.
Contractual Necessity
Processing necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract. This applies to:
- Processing enquiry forms to respond to service requests
- Facilitating artisan introductions and commissions
- Managing service bookings and payments
Legitimate Interests
Processing necessary for our legitimate interests, where those interests do not override your fundamental rights. This applies to:
- Improving our website and services
- Ensuring website security
- Maintaining business records
Your Rights Under GDPR
If you are located in the EU or EEA, you have the following rights regarding your personal data:
Right to Access
You have the right to request a copy of the personal data we hold about you, along with information about how it is processed.
Right to Rectification
You have the right to request that we correct any inaccurate personal data or complete any incomplete data.
Right to Erasure
You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected or when you withdraw consent.
Right to Restrict Processing
You have the right to request that we limit the way we use your data in certain circumstances, such as when you contest the accuracy of the data.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.
Right to Object
You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.
Exercising Your Rights
To exercise any of these rights, please contact us using the details provided above. We will respond to your request within one month. In certain circumstances, we may extend this period by two months if the request is complex or if we receive multiple requests.
We may ask you to verify your identity before processing your request to ensure we are responding to the correct individual.
International Data Transfers
As Vine-sage is based in South Africa, any personal data you provide will be transferred to and stored in South Africa. When transferring data from the EU/EEA, we ensure appropriate safeguards are in place, which may include:
- Standard contractual clauses approved by the European Commission
- Ensuring the recipient country provides an adequate level of data protection
- Obtaining your explicit consent for the transfer
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws. Specific retention periods are detailed in our Privacy Policy.
Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures are reviewed and updated as necessary to maintain adequate protection.
Complaints
If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with your local data protection supervisory authority. We would, however, appreciate the opportunity to address your concerns directly before you approach a supervisory authority, so please contact us in the first instance.
Changes to This Notice
We may update this GDPR notice from time to time. Any changes will be posted on this page with an updated revision date.