Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how Public House Entertainment Company Limited ("Tattoo Wine", "we", "our", or "us") collects, uses, stores, and protects personal data in connection with the New World Wine Discovery 2026 voting platform (the "Platform").

By accessing or using the Platform, you acknowledge that you have read and understood this Policy and agree to the collection and use of your personal data as described herein. If you do not agree, please do not use the Platform.

This Policy should be read alongside our Terms of Use, which govern your use of the Platform.

2. Who We Are

The data controller for personal data collected through the Platform is Public House Entertainment Company Limited, a company incorporated in Hong Kong. For any questions about this Policy or your personal data, please contact us at happy@tattoowine.com.

Where required by applicable law, including the GDPR, Tattoo Wine acts as data controller in respect of personal data collected from users in the European Union and European Economic Area.

3. Personal Data We Collect

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• To create and manage your account and authenticate your identity;
• To record, validate, and process your vote in the Competition;
• To detect and prevent fraudulent, manipulated, or ineligible votes;
• To maintain the security and integrity of the Platform;
• To respond to your support requests or enquiries;
• To comply with our legal and regulatory obligations; and
• To communicate with you regarding material changes to the Platform or these policies, where required.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, other than automated fraud detection measures applied to protect the integrity of the Competition.

5. Lawful Basis for Processing

We process your personal data on the following lawful bases:

• Performance of a contract: processing necessary to provide you with access to the Platform and to record your vote, in accordance with our Terms of Use.
• Legitimate interests: processing necessary for our legitimate interests in maintaining the security and integrity of the Platform and the Competition, provided those interests are not overridden by your rights.
• Legal compliance: processing necessary to comply with applicable legal obligations, including data protection, anti-fraud, and audit requirements.
• Consent: for any optional communications or non-essential uses of your data. Where we rely on consent, you may withdraw it at any time by contacting us at happy@tattoowine.com, without affecting the lawfulness of processing carried out prior to withdrawal.

6. Sharing of Personal Data

We do not sell your personal data. We may share your personal data with:

• Service providers who assist us in operating the Platform, including authentication providers (Privy, Apple), hosting and infrastructure providers, and analytics services, where such providers are bound by contractual obligations to protect your data;
• Professional advisors, including legal counsel, where necessary to protect our rights or comply with legal obligations;
• Law enforcement or regulatory authorities, where required by applicable law or court order; and
• A successor entity in the event of a merger, acquisition, or sale of assets, subject to the successor assuming obligations equivalent to those in this Policy.

Where we share personal data with third-party service providers, we require them to process data only on our instructions and in accordance with applicable data protection law.

7. International Data Transfers

Tattoo Wine is based in Hong Kong. Your personal data may be transferred to and processed in jurisdictions outside your country of residence, including Hong Kong and other jurisdictions where our service providers operate.

For users in the European Union or European Economic Area: where we transfer your personal data outside the EU/EEA to a jurisdiction not recognized by the European Commission as providing an adequate level of data protection, we implement appropriate safeguards, which may include standard contractual clauses approved by the European Commission or other lawful transfer mechanisms. You may request details of the safeguards applied to your data by contacting us at happy@tattoowine.com.

8. Data Retention

We retain your personal data for no longer than is necessary for the purposes for which it was collected, taking into account our legal obligations and legitimate business needs. Our retention practices are as follows:

• Account data and voting records: retained for a minimum of 12 months following the Competition date of 3 June 2026, for the purposes of audit, dispute resolution, and Competition administration, after which they will be deleted or anonymized.
• Support correspondence: retained for up to 24 months following the date of correspondence.
• Technical and device data (including IP logs): retained for up to 12 months.
• Cookie data: retained in accordance with the cookie-specific retention periods set out in Section 9.

Where we are required by law to retain data for a longer period, we will do so. Where data is no longer required, we will delete or anonymize it securely.

9. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies to support functionality and improve your experience. We use the following categories of cookies:

• Strictly necessary cookies: required for the Platform to function, including session management and authentication. These cannot be disabled without affecting Platform functionality.
• Functional cookies: used to remember your preferences and settings across sessions.
• Analytics cookies: used to understand how users interact with the Platform, in aggregate and anonymized form, to improve performance and usability.

You can manage your cookie preferences through your browser settings. Disabling cookies may affect your ability to use certain features of the Platform. Instructions for managing cookies are typically available in your browser's "Help" or "Settings" menu.

We do not use cookies for advertising or cross-site tracking purposes.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encrypted data transmission, access controls, and regular review of our security practices.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and, where required, the relevant supervisory authority, in accordance with applicable law.

11. Your Rights

Subject to applicable law, you have the following rights in respect of your personal data:

• Access: to request a copy of the personal data we hold about you.
• Rectification: to request correction of inaccurate or incomplete data.
• Erasure: to request deletion of your personal data, subject to our legal obligations to retain certain data.
• Restriction: to request that we restrict our processing of your personal data in certain circumstances.
• Objection: to object to processing based on legitimate interests.
• Portability: to receive your personal data in a structured, commonly used, and machine-readable format, where processing is based on consent or contract and carried out by automated means.
• Withdrawal of consent: to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at happy@tattoowine.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are located in the EU/EEA and believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your national data protection supervisory authority.

12. Children's Privacy

The Platform is not directed at children under the age of 18, or the minimum legal drinking age in your jurisdiction of residence, whichever is higher. We do not knowingly collect personal data from individuals below this age threshold. If we become aware that we have collected personal data from an underage user, we will take prompt steps to delete it.

If you believe an underage individual has registered on the Platform, please notify us at happy@tattoowine.com.

13. Third-Party Services

The Platform integrates third-party services including Privy (privy.io) and Sign in with Apple (Apple Inc.) for authentication purposes. These services operate under their own privacy policies, which govern their collection and use of your data. We encourage you to review those policies before using these authentication methods. Tattoo Wine is not responsible for the privacy practices of any third-party service.

14. Changes to This Policy

We may update this Policy from time to time. Changes will be posted on this page with an updated effective date. Where changes are material, we will provide reasonable notice. Your continued use of the Platform after any changes are posted constitutes your acceptance of the revised Policy.

15. Contact

For any questions about this Policy, to exercise your data rights, or to raise a concern about how we handle your personal data, please contact us at: