Privacy Policy

This policy explains what personal data this website (“Ampeli”) collects, how it is used and what rights you have.

Last updated: 23 October 2026.

Who is responsible

The data controller is MTC SAFETY MANAGEMENT LTD. (registration number HE 159079), Amfissis 1, Anthoupoli, 2305 Nicosia (Lakatamia), Cyprus. Email: a.nemeth@mtcsafety.com. Phone: (+357) 99465672.

Event updates (email sign-up)

If you subscribe, we collect your email address and the fact that you agreed, which you confirm by ticking a box before subscribing. We use the address only to send you news about wine events on the seven Cyprus wine routes.

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time with the unsubscribe link in every email; withdrawing does not affect the lawfulness of what was done before.

Who else handles data

Email addresses are stored, and emails are sent, through Brevo (formerly Sendinblue), an email service provider based in France. The website is hosted and delivered by Cloudflare, which processes technical data such as your IP address and request details to deliver the site and keep it secure. Fonts are loaded from Google Fonts, so your IP address is sent to Google when a page opens. The animation code (GSAP and Lenis) is loaded from the public code libraries cdnjs, run by Cloudflare, and jsDelivr, which receive your IP address and technical request data in the same way. We do not sell your data or use it for advertising.

Your account

If you create an account, we store your email address, your username, a scrambled (hashed) version of your password, the dates you signed up and confirmed your email, and, while you are logged in, a login token in your browser. We never see or store your password itself. We also store what you do with the account: the wineries you save or mark as visited, and your ratings. Ratings are private: they are never shown publicly; only the winery’s Premier dashboard sees their number and averages, without names. Legal basis: performing our agreement with you (Article 6(1)(b) GDPR). Account data is stored in a database at Cloudflare, and the confirmation and password-reset emails are sent through Brevo. We keep the account until you ask us to delete it; write to us and we will delete it together with your lists and ratings.

You can also save named routes (a name and the wineries on it, in order). A saved route has its own link: anyone you give the link to sees its name, its stops and your username. A public profile is off unless you switch it on in your account; when it is on, anyone can see your username, the wineries you marked as visited, your ratings and your badges, never your email address or your “Want to visit” list. If you change your email address, we send a confirmation link to the new address and keep the new address, unconfirmed, until you open it.

Maps

The Wine Atlas shows an interactive map that this website draws itself from open map data; no map images are loaded from other services. Links labelled “Directions on Google Maps” open Google Maps in a new tab only if you click them, and Google’s own privacy policy then applies. Map data © OpenStreetMap contributors, available under the Open Database Licence; relief from the Terrain Tiles open elevation dataset.

How long we keep it

Your email address is kept until you unsubscribe. After that we may keep a minimal record of the unsubscription so that you are not contacted again.

Winery registration

If you submit the winery registration form, we receive the details you enter (the winery’s name and village, a contact person, email address, phone number, website and social profiles, and a short description) by email through Brevo. We use them only to review your request, to answer you and, if we list the winery, to publish the details you provide. Legal basis: taking steps at your request (Article 6(1)(b) GDPR) and our legitimate interest in running the directory (Article 6(1)(f)). We keep the request while it is being handled and for as long as the winery is listed; write to us to have it removed.

Winery accounts and payments

A winery account also holds the details the winery publishes on its page (description, address, phone, website, social profiles and opening hours) and its photos, which are stored at Cloudflare. If a winery chooses a paid plan, the payment is handled by Stripe (Stripe Payments Europe, Ltd., Ireland). We receive a customer reference and the state of the subscription, never the card details. When you buy a ticket or book a tasting, we keep your name, your email address and the order (what, when, how much, whether it was used at the door or refunded) to send and check your tickets, to handle cancellations and to keep our accounting records; the seller sees your name and email for its guest list, and Stripe handles the payment. Legal basis: performing our agreement with the winery (Article 6(1)(b) GDPR) and our legal duty to keep accounting records (Article 6(1)(c)).

Visitor statistics

To see how the site is used, we count page views without cookies: the address of the page, the website you came from (its domain only), your country as reported by Cloudflare, whether you use a phone or a computer, and clicks from a winery page to its website, directions, phone or social pages. To count each visitor only once a day, a one-way code is made from the date, your IP address, your browser type and a secret; it is kept for at most two days and then deleted. We never store your IP address, and the counts cannot be traced back to you. Visits are not counted if your browser sends a Do Not Track or Global Privacy Control signal. Wineries on the Premier plan see the counts for their own page. Legal basis: our legitimate interest in running and improving the site (Article 6(1)(f) GDPR).

Cookies and local storage

Ampeli sets no cookies of its own. It keeps a few preferences in your browser (the language, and whether the short welcome animation has already played during your visit), a copy of the public winery details so that pages open faster, and a login token while you are logged in. The visitor statistics use no cookies; the browser only notes, for the length of your visit, that the visit has already been counted. See the Cookie Policy.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format and to withdraw your consent. To use these rights, write to the address above.

You also have the right to complain to the supervisory authority: the Office of the Commissioner for Personal Data Protection of Cyprus (www.dataprotection.gov.cy).

Changes

We may update this policy. The date at the top shows the latest version.