Privacy policy

1. Who the controller is

Controller: Enrique Romero González (Spanish tax ID 76050968L)
Address: C/ Río Aravalle, 2, 10004 Cáceres (Cáceres)
Contact: Contact form

We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). We collect the minimum necessary.

2. What data we process, why and on what basis

Data	Purpose	Legal basis	How long
Your Google account identifier (a code Google gives us to recognise you; it is not your email)	So you can sign in with your Google account. We do not receive your email or your photo, and we do not show it anywhere	Performance of the service you request (Art. 6.1.b GDPR)	While you have the account
Display name	Show it next to your comments. You choose it and can change it	Performance of the service	While you have the account
Ratings, flavour tags and comments	So the community can read them and to calculate scores and flavour profiles	Performance of the service	While you have the account
Cellar, taste profile, level and XP	Personalise your recommendations and your experience. They are private	Performance of the service	While you have the account
Contact form messages (name, email and the text of the message). We ask for your email nowhere else on the website	Read your message and reply. The form sends it to the website’s mailbox; it does not store it	Your consent when you send it (art. 6.1.a) and, for a rights request, compliance with a legal obligation (art. 6.1.c)	As long as needed to deal with your enquiry and any claims
Newsletter subscription (email and date of consent). There is no newsletter yet: this processing will start when there is one	Send you the newsletter	Your consent (Art. 6.1.a), with an unticked box and email confirmation	Until you unsubscribe
Browsing data (pages viewed, events such as searches or clicks to shops, device type, approximate location)	Learn what works and improve the site, with Google Analytics 4	Your consent, which you give in the cookie notice	14 months
Security data (anti-abuse checks and technical data such as the IP address on Cloudflare’s servers)	Protect the service against abuse, bots and fraud	Legitimate interest in security (Art. 6.1.f)	The time each provider sets for its technical logs
Reports (the reported comment, who reports it and why)	Review the content and apply the community guidelines	Legitimate interest and compliance with legal obligations (Arts. 6.1.f and 6.1.c)	While the content exists or as long as needed to handle complaints
Messages you send us by email	Reply to you	Your request or our legitimate interest in handling it	As long as needed to resolve it and, afterwards, as long as the law requires

If you sign in with Google, Google only tells us who you are (an identifier) and suggests a name, which you can change. We do not receive your email or your profile photo. We do not ask for any other data (no phone number, date of birth or address). By signing up you confirm that you are over 18.

3. What happens if you don’t create an account

The taste quiz, the quick-rating deck and “Your profile” work without an account. In that case your votes and your taste profile are stored only in your browser (local storage) and are not sent to our servers. If you create an account later, they move to it when you create it (we tell you before you confirm); until then they do not leave your device. When you sign out, we delete them from that browser and they stay in your account. Votes without an account do not count towards public scores. You can delete them by clearing the site’s data in your browser.

4. What is public and what is not

Public: your display name next to your comments and ratings, and the aggregated summaries (average scores, approval percentages).
Private: your cellar, your taste profile, your level and your badges, unless you decide to share something, for example your archetype as an image.

Do not write personal data about yourself or other people in comments. If you do, we may hide it.

5. Who we share your data with

We do not sell or pass on your data. We use providers that process it on our behalf and with the safeguards the GDPR requires:

Cloudflare, which hosts the site and the accounts database (kept in the European Union) and delivers it from its network: it processes your account data and technical data about each visit, such as the IP address, to serve the pages and protect them from attacks.
Google, so you can sign in with your Google account and, only if you accept it, Google Tag Manager and Google Analytics 4.
Brevo, to send the newsletter when there is one, only to those who subscribe.
Anthropic, only if we switch on an automatic comment classification system to help with moderation. In that case it would receive the text of the comment, without your name or your email. Today it may or may not be used; if that changes, we will update this policy.
Authorities and people under a legal obligation, when a law or a court order requires us to.

Shops. When you click a link to a shop you leave WhiskyMatch. We do not send them your personal data, but the shop and its affiliate network may use their own cookies under their policy. See the affiliate disclosure.

6. International transfers

Some providers, such as Cloudflare, Google and Anthropic, may process data outside the European Economic Area, particularly in the United States. They do so with the GDPR’s safeguards: an adequacy decision, such as the EU-US Data Privacy Framework for the companies that adhere to it, or the European Commission’s standard contractual clauses.

7. Your rights

You can exercise the following rights at any time:

Access and portability: download your data as a file from your profile.
Rectification: edit your display name, your ratings and your comments.
Erasure: delete your account from your profile. Your data, your ratings and your comments are deleted, and we unsubscribe you from the newsletter if you had subscribed.
Objection and restriction of processing.
Withdraw your consent (analytics or newsletter) whenever you like, without affecting what came before: with “Cookie settings” in the footer or with the unsubscribe link in each newsletter.

For anything you cannot do from your account, use the contact form saying what you want. If needed, we will ask you to prove who you are. We reply within one month at most.

If you believe we are not handling your data properly, you can complain to the Spanish Data Protection Agency (AEPD). Before that, we would like the chance to help you.

8. Minors

WhiskyMatch is aimed only at people over 18 and we do not knowingly collect data from minors. If we discover that an account belongs to a minor, we delete it.

9. Automatic recommendations

We calculate your taste profile and your recommendations automatically from your votes, the quiz and your cellar. It is a personalisation to help you discover whiskies and it has no legal effects and does not affect you in any significant way. How it works is explained in How it works. If you don’t want recommendations, you don’t need to take the quiz or vote, and you can delete your data whenever you like.

10. Security

We apply reasonable technical measures: encrypted connections, access rules that only let each person read and write their own data, anti-abuse controls and logs without personal data. We do not store your email: we do not even receive it. Of your session we only keep an encrypted fingerprint. No system is infallible; if there were a breach affecting you, we would tell you as the law requires.

11. Cookies

Cookies and local storage are explained, one by one, in the cookie policy.

12. Changes to this policy

If something important changes, for example a new provider or a new use of your data, we will announce it on the site and, when needed, ask again for your acceptance or your consent. The date at the top shows the latest version.

In short