WNLQ9 Privacy Notice

1. Who we are and how to contact us

• Data controller: WNLQ9 Co., Ltd., Bangkok, Thailand
• Privacy requests: winenowsommelier@gmail.com, or message our team on LINE (link on every page)
• We have not appointed a Data Protection Officer. Privacy questions go to the email above.

2. What we collect

When you create an account (both sites)

• Email address and password. The password is stored only in hashed form by our login provider.
• Your confirmation that you are 20 or older, with the date and time you confirmed.
• A member code (wnlq9.shop, starting MB-) or activation code (b2b.wnlq9.shop, starting TL-).

wnlq9.shop

• Username (made from your email at first, and you can change it) and an optional profile photo. Both are public.
• Lists and the bottles you save in them. New lists are public unless you make them private.
• Tasting notes and ratings you write. If you allow it, we may quote your note publicly.
• Reports you make about other people's reviews.
• Your taste profile from Find Your Match, saved to your account when you are logged in.
• If you take part in a tasting as a guest: the nickname you enter and your 20+ confirmation.
• An optional note you add when you ask for price access.

b2b.wnlq9.shop

• Business details: business name, venue type, province, contact name, mobile number, and optionally LINE ID, tax ID, monthly purchasing range and whether the business holds a licence.
• Your Venue Match answers (venue type, cuisine, service, price level, main guest nationalities, role, and any "Other" text you type).
• Documents you upload to verify the business (for example a company certificate or VAT registration), up to 10 files.
• How you reached us: the advertising campaign or referral link (UTM tags, click ids, a sales representative's referral code).
• Whether you asked to receive product and style updates, and by which channel.

From our retail partners Wine-Now and LIQ9 (Thailand)

• If you are a customer of our retail partners Wine-Now or LIQ9 in Thailand, in store or online, they share your customer group and order history with us (order dates, products, quantities and prices, from more than 10 years of sales). We receive it whether or not you have a WNLQ9 account, so that if you sign up with the same email, your history is matched to your account straight away. We do not store your email address with it: we store a scrambled code made from your email with a secret key (a keyed hash), and match it when you sign in. We use it to show your Verified list and the "verified" badge on your reviews, to give price access to known customers, and, for business customers, to pre-approve trade accounts.

When you browse

• Visit counts and how the sites are used, through Google Analytics (both sites). Without your consent, Google Analytics counts visits without cookies and without an identifier for you. If you accept cookies, it also uses cookies for more detailed statistics, such as repeat visits. Page addresses can include public usernames.
• Anonymous visit counts and page speed through Vercel Analytics (wnlq9.shop), which sets no cookies and does not identify you.
• Security signals from the Cloudflare Turnstile check on sign-up, log-in, password reset and guest sign-in.
• If you accept marketing cookies: Meta (both sites) and TikTok (b2b.wnlq9.shop) cookies that measure our advertising. On b2b.wnlq9.shop, when you create an account after accepting, we send Meta and TikTok a scrambled (hashed) copy of your email and account id so they can count the sign-up. We never send your name, phone number or business name.

We do not collect payment details. WNLQ9 takes no payments.

3. Why we use it, and on what legal basis

If you do not give the data a form marks as required, we cannot open the account.

4. What is public

• On wnlq9.shop: your username, profile photo, public lists, and reviews that you allowed us to quote. If your partner order history shows you bought the bottle you review, the review shows a "verified" badge, which tells others you bought it. Guest tasting notes are not public.
• Nothing on b2b.wnlq9.shop is public. Trade lists are always private.

5. Who we share it with

We do not sell personal data. We share it only with:

• Service providers that run the sites for us: Supabase (accounts, database, file storage and account emails), Vercel (hosting and Vercel Analytics), Cloudflare (Turnstile security check), Google (Google Analytics) and LINE (when you message us).
• Meta and TikTok, for advertising measurement, only if you accept marketing cookies.
• Our retail partners Wine-Now and LIQ9 (Thailand): they share customer and order history with us, as described in section 2. Our own WNLQ9 team answers your LINE messages and handles trade enquiries.
• Authorities, when the law requires it.

6. Data stored outside Thailand

Our service providers store or process data outside Thailand, including in Japan (Tokyo, our database), the United States (Vercel, Google, Meta) and other countries where they operate. We rely on their contractual data protection terms.

7. How long we keep it

• Your account and everything in it (lists, reviews, taste profile, trade details and uploaded documents): while the account is open. We do not delete accounts automatically. When you ask us to delete it, we delete it without undue delay, usually within 1 working day, except anything the law requires us to keep.
• Customer and order history shared by our retail partners: stored under a keyed hash of your email, never the email itself. If you do not have a WNLQ9 account, we delete it 24 months after your last order with our partners. If you have an account, we keep it while the account is open and delete it with the account. You can ask us to delete it at any time. After deletion we keep only a one-way scrambled (hashed) copy of your email, so it is not copied back.
• Guest tasting accounts: deleted when you link them to a full account, or when you ask.
• Google Analytics data: 14 months.
• Backups: we do not currently keep separate backups of the database, so deleted data cannot be restored.

8. Your rights

Under the PDPA you can ask to:

• see and get a copy of your data;
• correct it;
• delete it, or make it anonymous;
• object to, or restrict, how we use it;
• move it to another service;
• withdraw consent at any time (for cookies, use “Cookie settings” in the footer; for product updates, tell us on LINE). Withdrawing does not affect what we did before.

You can change your username, photo, lists and reviews yourself in your account. For anything else, contact us at winenowsommelier@gmail.com or on LINE. Before we delete an account or send a copy of data, we confirm the request through the email address on the account, so that nobody else can act in your name. We reply within 30 days, and usually delete accounts within 1 working day. You can also complain to the Office of the Personal Data Protection Committee (PDPC).

If something goes wrong. If a personal data breach is likely to put your rights at risk, we will report it to the PDPC within 72 hours of becoming aware of it, and tell you without delay if the risk to you is high.

9. Cookies and similar technologies

The sites also save some settings in your browser's local storage, such as your taste profile, your active list and a draft tasting note (wnlq9.shop), and the advertising campaign you came from (b2b.wnlq9.shop, until you close the tab).

10. Age

WNLQ9 accounts are only for people aged 20 or older. If we learn that an account belongs to someone younger, we delete it.

11. Changes

We will post any change here and update the date at the top. If a change is significant, we will tell account holders by email or on the site.