Legal
Privacy Policy
This page explains what personal data we handle, why we handle it, and the choices you have. It is maintained by Costa Tasting Protocol.
Last updated: 28 July 2026
Who is responsible
Costa Tasting Protocol, Edificio Ulla 1, San Pedro de Alcántara, Málaga, Spain. For any privacy question, message us on WhatsApp at +34 653 568 651.
What we collect
- Enquiries: the venue or company, contact name, guest count, package interest and any notes you type into our forms. These are sent to us through WhatsApp when you submit the form.
- Tasting app: the display name you choose, your event code, a PIN, your scores, aroma selections and notes for each pour, and the AI-generated palate report.
- Shared results: if you create a share link, a snapshot of that result is stored so the link can be opened by anyone who has it.
We do not require an email address to use the tasting app, and we do not ask for payment card data on this website.
Why we use it
- To respond to your enquiry and organise the event you requested.
- To save your tasting progress so you can resume it, and to build your palate report.
- To produce anonymous group statistics shown to participants of the same event.
Legal bases
We rely on your consent (using the app, creating a share link), the performance of a contract or pre-contractual steps (organising your event), and our legitimate interest in running and improving the experience.
Who processes data for us
- Our hosting and database provider, which stores app data on our behalf.
- Our AI provider, which generates the written palate report from your scores.
- WhatsApp (Meta), when you choose to send your enquiry through it.
We do not sell personal data.
How long we keep it
Tasting data and reports are kept while your guest profile remains useful to you. Shared result snapshots remain available until you ask us to remove them. Enquiry conversations are kept for as long as needed to handle the booking and our records.
Your rights
You can request access, correction, deletion, restriction, portability, or object to processing. See our GDPR page for how to make a request and how we respond.
Children
This site and our events are for people aged 18 or over. We do not knowingly collect data from anyone under that age.