Last Updated: March 8, 2024

At Scantrust (“we”, “us”, “our”), we take your right to privacy seriously and we are committed to protecting your personal data. This privacy notice applies specifically to our EU digital wine label solution and outlines the information we collect and how we use this information. You can find more information about the digital wine label solution at https://www.scantrust.com/e-label-overview/. This privacy notice may be updated at any time. We will post changes on this site and strongly encourage you to visit this section of our site for the latest version of the privacy notice.

Scantrust S.A. (“Scantrust”)

EPFL Innovation Park, 

PSE-D CH-1015, 

Lausanne, 

Switzerland

The digital wine label solution is designed for wine producers who are required by law to publish correct localised information, in an official language of the EU, about the origin and content of wines distributed and marketed within the EU under Regulation (EU) 2021/2117 of the European Parliament and of the Council of 2 December 2021. We provide this digital wine label solution, including its hosting for producers.

When you scan the wine label with your device, we processes information about your device, such as the date and time of scan, your IP address, the user agent (browser), the device model and operating system for our legitimate interest of determining abuse attempts effectively, and monitoring systems and infrastructure for performance and load so that load and future use can be determined, and sufficient resources can be made available. Scan logs are aggregated such that you can no longer be identified and log files are stored for a period of 5 weeks. Scantrust does not make individual scan data available to the producer, only aggregated data.

Processing of location and language data

When you scan the QR code found on the wine bottle with your device, your device or browser language and your IP for geo localisation are processed to determine the country you are accessing the information from, so that the correct digital wine label containing nutritional information, geographic indications, country specific details and symbols in the local language can be displayed. When we process location and language data, we act as a data processor and process information based on the instructions of, and for the purpose of the producer. For details about the privacy practices of the producer, please access their privacy notice on the e-label. 

Our e-label solution is used by producers to host and display the digital wine label to you. After you scan the e-label, the last octet of your IP address is truncated to enhance your privacy, make it difficult to identify you and mitigate potential privacy risks. 

Scantrust is located in Switzerland, a country with an adequacy decision by the European Commission and which guarantees the adequate protection of personal data and the exercise of data subject rights.

Scantrust strives for data security through various hardware and software methodologies. Most importantly, the connection is always secured through SSL (https-connection), and log files and databases are encrypted at rest and in transit and are only accessible by a limited number of staff based on ScanTrust’s access control policy.

Scantrust makes use of Amazon Web Service to host the service. In the case of international data transfer, Scantrust relies on EU Standard Contractual Clauses or the Data Privacy Framework in the data processing agreement to guarantee an adequate level of data protection rights and obligations. A copy of these safeguards may be requested by contacting Scantrust.

No cookies or other tracking technologies are used to provide the e-label service. 

Under the GDPR, the following rights are available to you:

You have the right to receive the personal data held about you in a structured, commonly used, machine-readable format, and to request the direct transmission of that data to another organisation of your choice.

You have the right to request the rectification of inaccurate data or the completion of incomplete data.

You have the right to request deletion of your data in the following cases: 

• Data is no longer necessary 
• You have objected to the processing under our legitimate interests and no convincing evidence was provided that these interests override your freedoms and liberties
• The processing takes place unlawfully

You have the right to request that your data is restricted for further processing in the following cases: 

• You contest the accuracy of the data; 
• You believe the processing is unlawful;
• You believe your data is no longer needed in relation to the purpose of its collection.

You have the right to object to processing carried out in our legitimate interest. Processing will be ceased until we have been able to demonstrate compelling legitimate grounds overriding your rights and freedoms.

• You have the right to contact a data protection authority of your choice and formulate a complaint. We kindly request that you contact us first to mutually find a solution in case of any concerns. 

A list of the data protection authorities in the EU is available here: 

https://edpb.europa.eu/about-edpb/about-edpb/members_en 

Response and handling of your requests related to these rights would typically require proof that a particular IP address was assigned to you at a given point in time so that we are able to locate data relating to you.

To exercise your rights with Scantrust or the producer, or in case of questions about the processing of your data, please contact us using the information provided below. 

Scantrust S.A. (“Scantrust”) 

By email: 

dpo@scantrust.com 

By post: 

Attn: Data Protection Officer 

Scantrust S.A. 

1015 Lausanne 

Switzerland