Privacy and Cookies Policy

Version Date - April, 2021

We are committed to safeguarding your privacy. This policy sets out how we will treat your personal data.  In this policy, "personal data" means information about an identifiable individual.

1. Identity and contact details of the data controller

The website (the “Site”) is operated by Cloudy Bay Vineyards Limited, a New Zealander company having its registered  Office at Level Jacksons Road, Woodbourne, Marlborough, 7273 PO Box 376, New Zealand, with company number  N° 271895, (“Cloudy Bay”, "our" or “we”) in its capacity of data controller for the purposes of applicable data protection laws and regulations, including the General Data Protection Regulation (GDPR) of 27 April 2016 and the Californian Consumer Privacy Act (CCPA) (or any replacing law, act or regulation regarding Data Protection in force in your country). Cloudy Bay will collect and hold your personal data in relation to this policy. 

Unless otherwise indicated, the Moët Hennessy affiliate with which you are in contact or which is mentioned in the legal notices on the Site, the Terms and Conditions of Use or any other document you may receive, whether in your country of residence or abroad, has the capacity of joint controller with Cloudy Bay.

2. What information do we collect?

Personal data is collected directly from you when you use the Site and our services or automatically when you access the Site.

We may process the following categories of personal data.

Information you provide to us :

  • Identification data such as your first name, last name, gender, title, nationality, date of birth, postal address, location of residence , email address and phone number ;
  • Your preferences and interests ;
  • Information you may disclose when you contact us ;
  • Banking data such as payment details

Information automatically collected :

  • Login data such as your IP address, your terminal specificities and your logs.

Personal data is collected directly from you, except when you are a gift recipient in which case the source of collect of your personal data is the gift purchaser. In such case, the following information is collected indirectly: first name, last name and email address.  We may also collect from our social media partners the fact that you are using their social networks and your associated advertising identifiers. 

We may also collect information that you provide to us about other people, for example when you decide to purchase and send products to someone, or when you participate in a lottery/contest on our Site and want to invite friends to participate as well. We use this information only to respond to your requests and will not send marketing communications to your contacts unless they choose to receive communications from us.

3. How do we use your personal data?

We collect and process your personal data for the purposes listed below.

In order to perform a contract with you or in order to take steps at your request prior to entering into a contract (legal basis: Art. 6 (1) (b) GDPR):

  • Create an account our Site ;
  • Book visits;
  • Any other services, current or future, related to the services we provide and listed in the relevant Terms & Conditions.


In order to comply with our legal obligations (legal basis: Art. 6 (1) (c) GDPR):

  • Processing in connection with legal claims and compliance purposes (including disclosure of such information in connection with legal processes or litigation).


Based on your prior consent (legal basis: Art. 6 (1) (a) GDPR):

  • Use of certain types of cookies. For more information regarding cookies, please read our Cookies Notice
  • Send you information about our offers, news and events (newsletters, invitations and other publications) as well as offers, news and events related to other entities of the Moët Hennessy group either by e-mail, SMS, MMS, telephone or post ;
  • Personalize the content of our Site ;
  • Run satisfaction surveys for users in Germany and in Italy, where your consent is required ;
  • Show you targeted advertisements and find other people like you within your social media networks (by uploading and matching your personal data - e.g. email address - you have provided to us with information you have supplied to the relevant social media platform, such as Facebook) if your consent is required by law  (e.g. in Germany).


Based on our legitimate interests (legal basis: Art. 6 (1) (f) GDPR) to :

  • Ensure the security of our Site and its users and the compliance with our Terms & Conditions of Use
  • Improve our products and services as well as our client relationship with you by sending you information about our offers, news, and events (newsletters, invitations, and other publications) on analogous products and/or services further to a transaction ;
  • Produce general statistics regarding use of our services and the Site and to understand your preferences better ;
  • Communicate with you via “Contact Us” or similar forms ;
  • Create a profile for you based on your information, order history and preferences ;
  • Show you targeted advertisements and find other people like you within your social media networks, for users in countries where your consent is not required;
  • Run satisfaction surveys, for users in countries where your consent is not required ;
  • Detect and prevent fraud.

When we ask you to supply us with personal data we will make it clear where there is a statutory or contractual (mandatory) requirement to provide personal data and the consequences of not providing the data. If you do not provide us with certain kinds of personal data, we may not be able to fulfil the applicable purposes of collecting that data from you.

4. Recipients of personal data

In accordance with law, Cloudy Bay may share your personal data with:

  • Its affiliates, to provide you with relevant content and services ;
  • Its service payment providers;
  • Its processors providing it with hosting services ;
  • Its processors providing it with support and other marketing services (emailing tools, customer care, ticketing services, statistical analysis services) ;
  • Social networks ;
  • Law enforcement, governmental agencies, or authorized third-parties, in response to a verified request relating to a criminal investigation, alleged or suspected illegal activity or any other activity that may expose it, you, or any of its other users to legal liability ;
  • The purchaser, or prospective purchaser, of any business or asset which Cloudy Bay is, or is contemplating, selling ;
  • And its sub-processors.

The Site may contain links to other websites for reference purposes only. We are not responsible for the content, privacy notices or practices of third party websites in these circumstances. Please contact them directly for more information.

5. Data transfers

We may transfer personal data to countries outside the European Economic Area ("EEA"), including to countries which have different data protection standards to those which apply in the EEA. We have put in place European Commission approved standard contractual clauses to protect this data. You have a right to ask us for a copy of these clauses (by contacting us as set out below).

When we transfer your personal data to the U.S., we make sure that the data is transferred to a company that adheres to the Privacy Shield or we put in place appropriate guarantees that comply with applicable regulations relating to the protection of personal data.

For any questions regarding data transfers outside the European Economic Area, you can contact Cloudy Bay at the address set out below :

6. Data retention

Data retention periods are listed in the table below.

Please note however that appropriate data related to subscription of current services will be deleted one (1) month after you have notified us that you want to unsubscribe to such services.

Data processing

Data retention period

Creation and management of your account on Cloudy Bay Site

Deletion after 3 years of inactivity

Handling of orders and delivery of products, experiences and services

10 years in archived after the validation of the order

Online payment processing

Relevant banking data is accessible to us until  transaction is completed

Communication with you via contact form

Duration of the request resolution, then archived during 3 years starting from the resolve of the request

Legal claims management and compliance purposes

Duration of the claim and 5 years from the date of the resolution.

If legal action : duration of the procedure until full execution of the Court decision or settlement agreement.

Sending of updates, news and other special offers from Cloudy Bay

3 years after the last contact from you

Show advertisements on your social network newsfeed and to other people like you

3 years after the last contact from you

Security and integrity of Cloudy Bay Site

Duration of security and integrity processes which may vary according to the operations carried out (3 to 6 months)

Fraud detection and prevention

Duration of the investigation (3 to 6 months) and then duration of the legal proceedings (if so)


No data retention













7. Amendments

We may update this notice from time-to-time by posting a new version on our Site.

You should check this page occasionally to ensure you are happy with any changes. We may also notify you of changes to this Privacy & Cookies Policy by email.

8. Your rights 

You may ask us for a copy of your information, to correct it, erase it or to transfer it to other organisations at your request. You also have rights to establish instructions for the management of your data after death, to object to some processing and, where we have asked for your consent to process your data, to withdraw this consent. In particular, you have rights to object to direct marketing at any time. Where we process your data because we have a legitimate interest in doing so (as explained above), you may also have a right to object to this. These rights may be limited in some situations (for example, where we can demonstrate that we have a legal requirement or other legal basis to process your data).

In order to respond to your request we may need to ask you to provide proof of identity or additional information. We will endeavour to respond your request as soon as possible and otherwise in accordance with applicable law.

These rights may be exercised at any time by sending a letter or an e-mail to the following addresses:

Data Protection Officer (DPO) – 38  rue de Sèvres – 75007 PARIS or by sending and e-email. 

9. California residents’ rights (California Consumer Privacy Act (CCPA)

California residents’ rights. If you reside in California and are not a job applicant, employee or employee of another company interacting with us in your job role, you have the right to ask us what information we collect and use. You also have the right to ask what information we disclose and sell. You also have the right to request that we delete information we have collected from you. To exercise your rights contact us at +1 (888) 914-9661 (use the pin 412774 when prompted to submit your request) or Here . We will use information you provide to us to verify your request by matching the information you give us with information we already have about you. We will not discriminate against you because you have exercised any of your rights under the California Consumer Privacy Act. You can designate someone else to make a request by having them execute a notarized power of attorney to act on your behalf.

Sales of information. Under California law we are required to tell California residents if we “sell” information as that term is defined by applicable law. Sell means to share personal information with a third party for monetary or other valuable consideration. California residents, we do not do this based on our understanding of that term.  We do not have actual knowledge that we sell personal information of minors under the age of 16.

10. Protection of persons under legal alcohol drinking and purchasing age

As the access to the Site is governed by Terms of Use, Cloudy Bay does not collect any Data or information concerning persons who are under legal alcohol drinking and/or purchasing age in their location of residence.

11. Contact details of the Data Protection Officer (DPO) and right to lodge a complaint

Should you have any question about the collection and processing of your Data by Cloudy Bay, please contact the Data Protection Officer of Cloudy Bay by writing at “Data Protection Officer (DPO)” – 38 rue de Sèvres – 75007 PARIS or by sending an e-mail

We hope that we can satisfy queries you may have about the way we process your data. However, if you have unresolved concerns you also have the right to complain to the New Zealand Privacy Commissioner by contacting them on 0800 803 909 (Monday to Friday, 10:00am to 3:00pm) or by email to


12. Cookies


A "cookie" is a piece of information, like a tag, that is stored on your computer, tablet or phone when you visit a website. It can help identify your device (like your PC or mobile phone) whenever you visit that website.

Cookies are used by most major websites including Cloudy Bay’s. To make the best use of our Site, on whichever device you use, you'll need to make sure your web browser is set to accept cookies.


We use cookies and some other data stored on your device to:

  • Give you a better online experience by displaying a customised editorial content based on what you have previously viewed.
  • Allow you to set personal preferences (e.g. to remember your login detail, choose a country and a language).
  • Protect your security and the security of the Site.
  • Measure and improve our service.
  • Work with our partners and measure the audience of the services that we provide.


A cookie will typically hold:

  • The name of the website that it has come from.
  • How long the cookie will stay on your device.
  • A value (usually a randomly generated unique number).


We use the following categories of cookies on our Site:

  • Strictly Necessary Cookies: These cookies are essential in order to enable you to move around the Site and use its features. Without these cookies, services you have asked for such as remembering your login details cannot be provided.
  • Performance Cookies: These cookies collect non-directly identifiable information on how people use our Site. For example, we use Google Analytics cookies to help us understand how customers arrive at our Site, browse or use our Site and highlight areas where we can improve, such as navigation, shopping experience and marketing campaigns. The data stored by these cookies never shows personal details from which your individual identity can be established.
  • Functionality Cookies: These cookies remember choices you make such as the location you visit our Site from, language and search parameters such as size, colour or product line. These can then be used to provide you with an experience more appropriate to your selections and to make the visits more tailored and pleasant. The information these cookies collect may be non-directly identifiable and they cannot track your browsing activity on other websites.
  • Targeting cookies or advertising cookies: These cookies collect information about your browsing habits in order to make advertising more relevant to you and your interests. They are also used to limit the number of times you see an advert as well as help measure the effectiveness of an advertising campaign.
  • Social Media Cookies: The cookies are usually placed by third party advertising networks and allow you to share what you’ve been doing on the website you visit. For example, we use third party companies to provide you with more personalised adverts when visiting other websites. These cookies are not within Brand control. Please refer to the respective privacy notices of the relevant social media networks to find out how their cookies work.

You can access to the list of the cookies we use and manage your consent by clicking here

You can access to the list of our trusted affiliates and partners using cookies on our Site here 


There are two types of cookies that we use on the Site – these are called session cookies and persistent cookies.

Session cookies - these cookies only last until you close your browser. They are not stored on your hard drive. They are usually used to track the pages that you visit so that information can be customised for you for that visit.

Persistent cookies - these cookies are stored on your hard drive until you delete them or they reach their expiry date. These may, for example, be used to remember your preferences when you use the Site. The lifespan of such cookies will not exceed twelve (12) months from date of consent.


You can accept or refuse cookies per categories of cookies by clicking Here


If you decline cookies, some aspects of the Site may not work on your computer or mobile phone and you may not be able to access areas you want on the Site. For this reason we recommend that you accept cookies.