Privacy Policy of X-SOR AG for WINESOR

Version 2.0 · Last updated: 15 October 2026

This Privacy Policy explains how X-SOR AG processes personal data in connection with the WINESOR website, online shop, X-SOR app, connected WINESOR sensors, cloud services, support services and related functions.

1. Scope

This Privacy Policy applies in particular to:

• the websites and language versions operated under winesor.com;

• the WINESOR online shop and checkout;

• the X-SOR mobile application for iOS and Android when used with WINESOR;

• WINESOR sensors, the associated cloud platform and connected services;

• contact, support and warranty enquiries;

• service-related communications; and

• marketing communications where offered and requested.

Different sections may apply depending on whether you visit our website, place an order, use the app or sensor, contact Support or use another WINESOR service.

Additional notices, consent requests or product-specific information may apply to individual functions.

We process personal data in accordance with the Swiss Federal Act on Data Protection, the Swiss Data Protection Ordinance and, where applicable, the EU General Data Protection Regulation, the UK GDPR and other applicable data protection laws.

2. Controller and contact details

The controller responsible for the processing described in this Privacy Policy is:

X-SOR AG

Müligässli 1

8598 Bottighofen

Switzerland

Email: support@winesor.com

You may use this address for privacy enquiries and to exercise your data protection rights.

3. Processing principles and legal bases

We process personal data lawfully, fairly, transparently, proportionately and only for specified purposes.

Personal data are retained only for as long as necessary for the relevant purpose or as required by legal, contractual, security, accounting or evidence requirements.

Where justification is required under Swiss law, processing may be based on consent, a contractual relationship, a legal obligation, an overriding private or public interest or the establishment, exercise or defence of legal claims.

Where the GDPR or UK GDPR applies, processing may be based in particular on:

• consent;

• performance of a contract or steps taken before entering into a contract;

• compliance with a legal obligation; or

• our legitimate interests or the legitimate interests of a third party.

  
  

Our legitimate interests may include:

• secure and efficient operation of the website, shop, app and connected services;

• processing orders and payments;

• providing customer service and technical support;

• maintaining and improving our products and services;

• detecting and preventing fraud, misuse and security incidents;

• establishing, exercising or defending legal claims; and

• measuring and improving the effectiveness of our website and marketing activities.

Where processing is based on consent, you may withdraw your consent at any time with effect for the future. Processing carried out before withdrawal remains unaffected.

4. Categories and sources of personal data

Depending on how you interact with WINESOR, we may process:

• identity and contact data, including name, postal address, email address and telephone number;

• account and authentication data, including user ID, account settings, login information and authentication events;

• order and transaction data, including products ordered, delivery address, invoice details, payment status, currency and transaction references;

• support and communication data, including messages, screenshots, uploaded documents and correspondence;

• technical and usage data, including IP address, browser, device, operating system, app version, timestamps, pages and functions used, log data and diagnostic information;

• sensor and storage-environment data, including sensor ID, temperature, relative humidity, battery status, Wi-Fi signal, connection status, thresholds, alerts, calibration information and historical measurements;

• sharing data, including information about persons with whom sensor access or notifications are shared;

• location data where an app function or operating system requires location access and you grant the relevant permission;

• cookie, consent, analytics and advertising identifiers; and

• marketing preferences and newsletter registration information.

We may receive personal data:

• directly from you;

• automatically through your browser, device, app or sensor;

• from payment and logistics providers;

• from app store operators;

• from persons who share sensor information or notifications with you; and

• from service providers acting on our behalf.

Part A: Website and online shop

5. Website hosting and technical operation

The WINESOR website and online shop are operated using services provided by Wix.com Ltd. and affiliated companies.

Wix provides website hosting, content delivery, security, shop and checkout functions, forms, multilingual functions and related technical infrastructure.

When you access the website, technical information may be processed automatically. This may include:

• IP address;

• date and time of access;

• requested page or file;

• browser and device information;

• operating system;

• referrer URL;

• error messages; and

• security events.

These data are processed to deliver the website, display content correctly, maintain stability and security, prevent attacks and misuse, troubleshoot technical problems and improve performance.

Wix is based in Israel and uses data centres, affiliated companies and service providers in different countries, including Ireland, the United States and other locations. International transfers are addressed in section 25.

6. Cookies and consent management

We use cookies and similar technologies, including local storage, session storage, pixels, tags, device identifiers and embedded scripts.

These technologies may be divided into necessary, functional, analytics and marketing categories.

6.1 Necessary technologies

Necessary technologies support functions such as:

• website and network security;

• fraud prevention;

• session management;

• shopping cart and checkout;

• login and account access;

• form processing; and

• storage of privacy and consent choices.

• 
  

These technologies cannot always be disabled without affecting essential website functions.

6.2 Functional technologies

Functional technologies enable optional functions such as:

• language preferences;

• embedded media;

• external website elements; and

• enhanced user settings.

6.3 Analytics technologies

Analytics technologies help us understand how visitors use the website, measure visits and interactions, identify technical problems and improve content, navigation and performance.

6.4 Marketing technologies

Marketing technologies may be used to:

• measure campaigns;

• attribute conversions;

• evaluate advertising;

• build audiences; and

• display more relevant marketing content.

Non-essential technologies are used only in accordance with the applicable consent requirements.

6.5 Usercentrics for Wix

We use Usercentrics for Wix to provide information about cookies and similar technologies and to manage visitors’ privacy choices.

The service is provided by:

Usercentrics GmbH

Sendlinger Str. 7

80331 Munich

Germany

Usercentrics may process:

• consent or refusal status;

• selected categories and services;

• consent ID;

• date and time of the decision;

• banner language;

• browser and device information;

• IP address;

• referrer information; and

• the version of the consent configuration.

These data are processed to obtain, implement and document privacy choices.

You may accept or reject non-essential technologies, select individual categories and change or withdraw your choices at any time through the cookie settings available on the website.

The current list of technologies, providers, purposes and storage periods is available in the consent manager.

7. Website analytics

7.1 Wix analytics and operational measurement

Wix may provide technical and aggregated information concerning website visits, performance and operation.

Where Wix analytics depend on non-essential cookies or similar technologies, they are activated only in accordance with the visitor’s consent choice.

7.2 Google Analytics 4

We use Google Analytics 4 to understand how visitors use the WINESOR website and to improve our content, navigation and services.

The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and other Google group companies.

Google Analytics may process:

• browser and device information;

• pages visited;

• date and duration of visits;

• interactions and events;

• source of access;

• approximate location;

• IP-derived information; and

• pseudonymous user or session identifiers.

Google Analytics is activated only where the visitor has made the corresponding analytics choice in the consent manager.

Google may process information in the United States and other countries. International transfers are addressed in section 25.

8. Contact, support and warranty enquiries

When you contact us by email, website form or another communication channel, we may process:

• your name;

• email address;

• telephone number;

• subject and content of your enquiry;

• attachments and screenshots; and

• any other information you choose to provide.

For technical support, we may additionally process:

• sensor model and sensor ID;

• smartphone model;

• operating system and app version;

• Wi-Fi and connectivity information;

• measurement or synchronisation information;

• error descriptions; and

• diagnostic data.

We use these data to:

• respond to enquiries;

• provide setup and troubleshooting assistance;

• process warranty and service requests;

• document the communication;

• improve support quality; and

• establish, exercise or defend legal claims.

Please do not send passwords, complete payment card details or unnecessary sensitive personal information through general contact or support forms.

9. Online shop, orders and customer administration

When you place an order, we process the information required to complete and administer the purchase.

This may include:

• name;

• billing and delivery address;

• email address;

• telephone number;

• products ordered;

• order value and currency;

• applicable tax information;

• selected delivery method;

• payment status;

• order history; and

• related correspondence.

We use these data to:

• operate the shopping cart and checkout;

• process and confirm orders;

• deliver products;

• issue invoices;

• provide customer service;

• manage returns and warranty claims;

• prevent fraud and misuse; and

• comply with accounting, tax and commercial record-keeping obligations.

The online shop is provided through Wix Stores and related Wix commerce services. Order and customer data may therefore be processed by Wix and its service providers.

10. Payments through Stripe

We use Stripe to process credit card, debit card and other supported payments.

Depending on your location and the payment process, data may be processed by Stripe Payments Europe, Limited, Stripe, Inc. and other Stripe group companies.

Stripe may process:

• name;

• billing details;

• email address;

• IP address;

• device information;

• payment method and card information;

• authentication information;

• transaction amount and currency;

• payment status; and

• fraud-prevention and risk data.

Payment details are generally entered directly into systems or fields controlled by Stripe.

X-SOR AG normally receives only the payment confirmation, transaction reference and limited payment information required to process and document the order. X-SOR AG does not require access to the complete payment card number for ordinary order processing.

Stripe may process certain information as our service provider and other information under its own legal obligations, including payment regulation, fraud prevention, sanctions screening and financial record keeping.

11. Shipping and logistics

To deliver an order, we provide the necessary information to the transport, postal, courier, fulfilment or logistics provider used for the relevant destination.

This may include:

• name;

• delivery address;

• telephone number or email address;

• order or shipment reference; and

• information required for customs and delivery handling.

The specific provider may vary depending on the destination, availability, product and selected delivery method.

Logistics providers may process data under their own legal obligations and privacy policies.

12. Embedded videos and YouTube

The WINESOR website may contain videos embedded from YouTube.

YouTube is provided by Google Ireland Limited and other Google group companies.

When a YouTube video is loaded or played, Google may process:

• IP address;

• browser and device information;

• the page viewed;

• video interactions;

• device or advertising identifiers; and

• information associated with a Google account if you are signed in.

YouTube content and associated non-essential technologies are loaded only in accordance with your consent choice or after you actively request the external content, depending on the technical implementation.

13. External website elements and embedded content

We may use external FAQ elements, forms, media, widgets or other embedded website components.

When an external component is loaded, the relevant provider may process technical information such as:

• IP address;

• browser and device information;

• page viewed;

• session identifiers; and

• interactions with the component.

External components are categorised according to their purpose and, where they are not technically necessary, loaded only in accordance with the visitor’s consent choice.

14. Social media links

The WINESOR website may contain links to social media platforms.

Where these are simple links, personal data are generally transmitted to the platform only after you click the relevant link.

The platform operator is responsible for the subsequent processing carried out through its website or app.

Part B: X-SOR app, WINESOR sensors and connected services

15. User accounts and app access

To use the X-SOR app and connected WINESOR services, you may need to create a user account.

We may process:

• name;

• email address;

• user ID;

• authentication information;

• language and preferences;

• account and service status;

• device information;

• login events; and

• security logs.

These data are used to:

• create and administer the account;

• authenticate users;

• provide app and cloud functions;

• assign sensors to the account;

• synchronise data;

• protect accounts against unauthorised access;

• send service-related information; and

• support account recovery.

16. Sensor, storage-environment and cloud data

When you connect a WINESOR sensor, we process data required to operate, monitor and support the device.

These data may include:

• sensor ID;

• device and account assignment;

• cellar, cabinet or storage-environment name;

• relative humidity measurements;

• temperature measurements;

• timestamps;

• battery status;

• Wi-Fi signal strength;

• connection status;

• threshold settings;

• alerts and notification settings;

• calibration information;

• synchronisation data; and

• historical measurements and statistics.

These data are used to:

• display current and historical measurements;

• generate alerts;

• provide single- and multi-sensor overviews;

• synchronise measurements;

• identify connection or sensor problems;

• provide technical support;

• administer the data service; and

• maintain and improve reliability.

The sensor backend and connected functions are operated by X-SOR AG with the support of specialised hosting, cloud, security and communications providers.

The cloud infrastructure is supported by Google Cloud Platform and may involve processing by Google group companies and their service providers.

17. Wi-Fi setup and connectivity data

The WINESOR sensor requires access to a compatible Wi-Fi network.

During setup, the X-SOR app and sensor may process network configuration information required to establish the connection, including:

• selected network name;

• Wi-Fi connection credentials;

• signal strength;

• connection status; and

• technical error information.

Network credentials are processed only to configure and maintain the requested sensor connection. They are not used for unrelated advertising or marketing purposes.

Technical connectivity and error data may be processed for diagnostics, reliability and support.

18. App permissions

Depending on the device, operating system and function used, the X-SOR app may request access to:

• notifications;

• local network information;

• Wi-Fi or connectivity information;

• device storage;

• camera;

• photo library; or

• approximate or precise location.

A permission is used only after you grant it through the device or operating-system settings.

Camera or photo access may be used where you actively choose to capture or upload an image through an available app or support function.

Location or local-network access may be required by the operating system to identify or configure compatible nearby networks and devices.

You may change or withdraw app permissions through your device settings. Disabling a permission may prevent the corresponding function from working.

19. Push notifications

If you enable push notifications, we process a device or push token and your notification preferences.

Push notifications may be used to provide alerts concerning:

• temperature;

• relative humidity;

• battery status;

• connectivity;

• selected thresholds;

• service information; and

• other enabled sensor events.

Depending on your device, push notifications and app distribution may involve Apple Inc., Apple Distribution International Ltd., Google LLC, Google Ireland Limited or related service providers.

The operating-system provider may process device tokens and technical delivery information.

20. Sensor sharing and alert forwarding

The app may allow you to share access to sensor or storage-environment information with another person or forward alerts to another email address.

If you use such a function, we process the recipient information and the selected sensor, measurement or alert data required to provide the requested access or notification.

You are responsible for ensuring that you are authorised to provide the recipient’s contact information and share the selected data.

Sharing permissions may be changed or withdrawn through the available app settings.

21. App stores

When you download or update the X-SOR app, the relevant app store operator processes information independently.

This may include:

• app store account information;

• device information;

• download and update events;

• diagnostic data; and

• payment information where applicable.

For iOS devices, the relevant provider is an Apple group company.

For Android devices, the relevant provider is a Google group company.

The app store operator’s own privacy policy applies to processing for which it is independently responsible.

Part C: General provisions

22. Service messages and marketing communications

We may send service-related messages that are necessary for:

• account administration;

• sensor operation;

• security;

• order fulfilment;

• data service administration;

• support enquiries;

• warranty handling; or

• important changes to our products or services.

These communications are not marketing messages.

If you subscribe to a newsletter or otherwise consent to marketing communications, we may process your name, email address, language, product interests, consent status and registration information to send WINESOR news, offers, product information, guides or similar content.

You may unsubscribe at any time using the unsubscribe link contained in the message or by contacting us.

We may retain a minimal suppression record to ensure that your opt-out continues to be respected.

23. Recipients and service providers

We disclose personal data only where necessary for the relevant purpose, legally required or otherwise permitted.

Recipients may include:

• employees and authorised representatives of X-SOR AG;

• website, hosting, cloud, app, IT and security providers;

• Wix and its affiliated companies and subprocessors;

• Usercentrics;

• Google, including Google Analytics, YouTube and Google Cloud Platform;

• Stripe and its payment, fraud-prevention and financial service providers;

• email, newsletter, push-notification and communications providers;

• app store operators;

• postal, courier, transport, fulfilment and logistics providers;

• accounting, invoicing, audit, legal and other professional advisers;

• authorities, courts and public bodies where required by law; and

• parties involved in a merger, acquisition, restructuring or sale of assets, subject to appropriate safeguards.

Service providers acting on our behalf are contractually required to process personal data only for the agreed purposes and in accordance with applicable data protection requirements.

24. Sale, merger or restructuring

If X-SOR AG or relevant parts of its business are sold, merged, reorganised or transferred, personal data may be disclosed or transferred as part of that transaction.

Where applicable, we take reasonable measures to ensure confidentiality and compliance with data protection law during the transaction.

The recipient may use the transferred personal data only in accordance with this Privacy Policy or another lawful privacy notice communicated to the affected persons.

25. International data transfers

Personal data may be processed in Switzerland, the European Economic Area, Israel, the United Kingdom, the United States and other countries in which our service providers or their subprocessors operate.

Where personal data are transferred to a country that is not recognised as providing an adequate level of data protection, we use appropriate safeguards where required.

These safeguards may include:

• recognised standard contractual clauses;

• Swiss adaptations to contractual clauses;

• recognised data privacy frameworks;

• contractual and organisational measures;

• encryption;

• access restrictions; or

• another transfer mechanism permitted by applicable law.

Where permitted by law, an international transfer may also rely on a specific statutory exception.

26. Retention and deletion

We retain personal data only for as long as necessary for the relevant purpose or as required by legal, contractual, accounting, security or evidence requirements.

26.1 Website, consent and analytics data

Technical logs, cookie data, consent records and analytics information are retained in accordance with operational requirements, security needs, the applicable consent configuration and the periods shown in the cookie settings or relevant service configuration.

26.2 Orders and business records

Order, invoice, payment confirmation, accounting and business correspondence data are generally retained for the periods required by Swiss tax, accounting and commercial law.

Where applicable, the retention period may be up to ten years.

26.3 Support and warranty data

Support and warranty information is retained for as long as necessary to:

• resolve the enquiry;

• administer the service or warranty case;

• document the communication;

• improve support quality;

• meet legal obligations; or

• establish, exercise or defend possible claims.

26.4 Account, app and sensor data

Account, sensor, measurement, settings and app data are retained while the account or connected service remains active.

Following account deletion or termination, relevant data may be retained for a limited period where required for:

• backup cycles;

• account and system security;

• contractual obligations;

• unpaid fees;

• fraud prevention;

• legal claims; or

• statutory retention requirements.

Data are deleted or anonymised when they are no longer required.

Backup copies are deleted or overwritten within the regular backup cycle unless a legal or security reason requires longer retention.

27. Data security

We implement appropriate technical and organisational measures to protect personal data against:

• unauthorised access;

• unlawful processing;

• accidental loss;

• alteration;

• unauthorised disclosure; and

• destruction.

Measures may include:

• access controls;

• authentication;

• encryption during transmission;

• security logging;

• backups;

• system monitoring;

• vulnerability management;

• confidentiality obligations; and

• contractual security requirements for service providers.

No technical system can guarantee absolute security.

Users are responsible for keeping their login credentials confidential and for using reasonably secure devices, passwords and networks.

28. Personal data breaches

Where a personal data breach occurs, we assess the nature, scope and possible consequences of the incident.

We notify the competent data protection authority and affected persons where and within the period required by applicable law.

We may also take measures to contain the incident, restore availability, reduce possible harm and prevent similar incidents.

29. Your rights

Subject to applicable law and the relevant legal requirements, you may have the right to:

• request information about personal data processed about you;

• obtain a copy of certain personal data;

• request correction of inaccurate or incomplete data;

• request deletion or destruction of data;

• object to certain processing;

• request restriction of processing;

• withdraw consent with effect for the future;

• request the release or portability of certain data in a commonly used electronic format;

• object to direct marketing; and

• lodge a complaint with a competent data protection authority.

To exercise your rights, contact support@x-sor.com.

We may request suitable proof of identity where necessary to protect personal data against unauthorised access or disclosure.

Rights may be restricted where permitted by law, for example where retention is required by law or where the data are necessary for the establishment, exercise or defence of legal claims.

In Switzerland, the competent supervisory authority is:

Federal Data Protection and Information Commissioner

Feldeggweg 1

3003 Bern

Switzerland

Where the GDPR or UK GDPR applies, you may also have the right to lodge a complaint with the competent European or UK supervisory authority.

30. Automated decisions

WINESOR does not normally make decisions based solely on automated processing that produce legal effects or similarly significant effects for you.

Sensor alerts, threshold notifications, technical classifications and automated diagnostic results provide information or assistance. They do not replace the user’s own assessment or a human decision where one is required.

If we introduce automated decision-making with legal or similarly significant effects, we will provide the additional information and rights required by applicable law.

31. Data relating to children

WINESOR products and services are not directed at children.

We do not knowingly request personal data from children through the website, online shop, app or connected sensor services.

If you believe that a child has provided personal data without the required authorisation, please contact support@x-sor.com.

32. External links

The website and app may contain links to third-party websites, shops or services.

Once you access an external service, the respective third party is responsible for its own processing.

We recommend reviewing the third party’s privacy information before providing personal data.

33. Changes to this Privacy Policy

We may update this Privacy Policy where our processing activities, products, technology, service providers or legal requirements change.

The current version is published on the WINESOR website and may also be made available through the app.

Material changes may additionally be communicated by email, in the app or through another appropriate channel.

Where a change requires consent, consent will be requested separately. Continued use does not by itself constitute consent where applicable law requires an active choice.

34. Contact

For questions about this Privacy Policy or the processing of personal data, please contact:

X-SOR AG

WINESOR Privacy

Müligässli 1

8598 Bottighofen

Switzerland

Email: support@x-sor.com