Privacy Policy
1. Data Controller
The Cavacave website (cavacave.com) is published and operated by:
Wine Project S.A.S. Share capital: €80,373 SIRET: 793 730 086 00022 Registered office: 151 rue Marcadet – 75018 Paris – France Represented by Mr Stéphane DEUBEL, President
Contact: contact@cavacave.com — +33 1 84 21 85 70
2. Personal Data Collected
Depending on your use of the site, we collect the following data:
| Category | Data |
|---|---|
| Identification | Last name, first name, username, email address, phone number |
| Address | Postal address (billing and shipping) |
| Payment | Banking details (collected and hosted by Mangopay) |
| Identity verification (KYC) | Identity document (processed by Mangopay) |
| Browsing | IP address, browser type, pages viewed, interactions |
| Communication | Messages exchanged via support chat |
3. Purposes and Legal Bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Management of your account and user profile | Performance of contract (Art. 6.1.b) |
| Execution of auction transactions | Performance of contract (Art. 6.1.b) |
| Payment and transfers (via Mangopay) | Performance of contract (Art. 6.1.b) |
| Identity verification (KYC/AML) | Legal obligation (Art. 6.1.c) |
| Customer support via chat | Legitimate interest (Art. 6.1.f) |
| Audience analysis and service improvement | Consent (Art. 6.1.a) |
| Sending marketing communications | Consent (Art. 6.1.a) |
4. Recipients and Processors
Your personal data may be shared with the following processors, strictly within the scope of the purposes described above:
| Processor | Role | Location |
|---|---|---|
| Supabase | Database hosting and authentication | EU (Frankfurt) |
| Vercel | Website hosting | Global network (Edge) |
| Mangopay | Payment services, e-wallets, KYC | Luxembourg (EU) |
| PostHog | Audience analytics | EU (Frankfurt) |
| Crisp | Customer support chat | France (EU) |
| Brevo | Transactional and marketing emails | France (EU) |
We never sell your personal data to third parties.
5. International Transfers
The majority of your data is processed within the European Union.
Vercel may process certain data (IP address, HTTP headers) on its global Edge network. These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46.2.c of the GDPR.
6. Data Retention Periods
| Data | Retention period |
|---|---|
| Active user account | Duration of the business relationship |
| Transaction data | 10 years (accounting and tax obligation) |
| KYC data | 5 years after the end of the business relationship (AML obligation) |
| Analytics cookies | 13 months maximum |
| Support messages | 3 years after the last contact |
| Inactive account | Deletion after 3 years of inactivity |
7. Your Rights
In accordance with the GDPR (Articles 15 to 22), you have the following rights:
- Right of access: obtain confirmation that your data is being processed and receive a copy
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request the deletion of your data (except where legal retention is required)
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to the processing of your data on legitimate grounds
- Right to withdraw consent: withdraw your consent at any time (without affecting the lawfulness of prior processing)
- Right to restriction: request restriction of processing in certain cases
How to Exercise Your Rights
Send your request by email to: contact@cavacave.com
We will respond within one month of receiving your request.
Complaint to the CNIL
If you believe that the processing of your data does not comply with regulations, you may lodge a complaint with the French Data Protection Authority (CNIL):
- Website: www.cnil.fr
- Address: CNIL — 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
8. Cookies
Necessary Cookies
These cookies are essential for the website to function and cannot be disabled:
| Cookie | Purpose | Duration |
|---|---|---|
| Authentication session | Maintaining your login | Session |
| Language preferences | Remembering your language choice | 1 year |
| Cookie consent | Recording your cookie choices | 1 year |
Analytics Cookies
With your consent, we use PostHog to analyse site usage and improve our services. These cookies are hosted within the European Union (Frankfurt).
| Cookie | Purpose | Duration |
|---|---|---|
| PostHog | Browsing analysis and usage statistics | 13 months |
Support Cookies
With your consent, we use Crisp for customer support chat.
| Cookie | Purpose | Duration |
|---|---|---|
| Crisp | Chat session identification | 6 months |
Managing Cookies
You can change your cookie preferences at any time:
- From the consent banner displayed on your first visit
- Via your browser settings
Refusing analytics and support cookies does not affect your access to the site or its essential features.
9. Changes to This Policy
We reserve the right to modify this policy at any time. In the event of a substantial change, we will inform you by email or via a notification on the site.
The date of the last update is shown below.
Last updated: February 2026