Privacy Policy

Version: 12 October 2026

This Notice explains how Essential Code GmbH processes personal data in connection with the Glasswise website, accounts and service.

1. Controller and contact

Essential Code GmbH
Glücksallee 8/Top 1
3012 Wolfsgraben, Austria
Email: david@glasswise.eu

Essential Code is the controller for website operation, contract administration, billing, security, product information and its own service improvement and communication.

2. When a winery is the controller

For personal data a winery or other customer enters into Glasswise, manages through its account or has processed through its e-labels, that customer is normally the controller and Essential Code acts as processor. This may include contact persons, operators named on a label, support content and technical data generated when people access a customer’s label or link.

The customer decides the purposes and legal basis and is responsible for its own privacy information. Requests concerning this data should be directed to the relevant customer. We forward requests we receive where appropriate. The Data Processing Agreement governs this processing.

3. Data, purposes and legal bases

We process the following data where needed:

• business account and contact data, including name, email, company, role, address, VAT and register details
• contract, plan, transaction, invoice and support data
• product, wine, vintage, label, operator, image, file and document content
• account, organisation, role, permission and technical identifier data
• website, label and application request data, including IP address, time, page, destination, referrer, browser, device, country and security events
• application usage, error, feedback and support data

We process data to take steps before a contract and perform the contract under Article 6(1)(b) GDPR, comply with legal duties under Article 6(1)(c), and pursue legitimate interests under Article 6(1)(f). Those interests include secure and reliable operation, customer support, preventing abuse, understanding and improving the product, maintaining business records and asserting or defending legal claims. Where processing is based on legitimate interests, we balance those interests against the rights of the people concerned.

Providing account, business and billing information is necessary to enter into and administer a contract. Without it, we may be unable to provide the service. We do not use personal data for solely automated decisions with legal or similarly significant effects.

4. Website and communications

When the website is requested, technical request and log data is processed to deliver it, keep it secure and diagnose faults. We use this data on the basis of our legitimate interests in a secure and functional website.

When someone contacts us, we process the information supplied to answer and document the request. The basis is the requested pre-contractual or contractual action or our legitimate interest in handling business correspondence.

We send customers account, billing, security and product information connected with Glasswise. Verified account-owner contact data is managed with Kit for this customer product information. This processing is based on performance of the customer relationship and our legitimate interest in keeping customers informed about the service. A recipient may object to product information at any time by using the contact details above or the option in the message. Essential service and security messages may still be sent where needed for the contract.

5. The Glasswise service

We process account and service data to authenticate users, manage organisations and permissions, store and publish label content, operate QR destinations and GS1 Digital Links, generate documents, send service email, provide support, prevent abuse, analyse errors and understand use of the application.

PostHog is used for product analytics and error context in the logged-in application. Gleap is used for support, feedback and error diagnosis. These tools may receive user, account, usage and technical information. We use them for contractual support and our legitimate interests in operating, protecting and improving Glasswise.

Cloudflare Turnstile processes technical request, browser and device information to protect authentication against bots and abuse. It is used for security and reliable service operation.

6. Published e-label data and E-Label Atlas

When the customer activates the relevant service function, published e-label data can be shared with E-Label Atlas as part of Glasswise. E-Label Atlas is Essential Code’s own shared e-label database, not a third-party provider. Shared data can include public product, wine, vintage, label, operator and contact information selected for publication. Essential Code processes this data as part of the customer’s service instructions. The customer remains responsible for deciding what is published and for the legal basis of any personal data in it.

7. Service providers and recipients

We use providers only to the extent needed for the stated purpose. Depending on the function used, data may be disclosed to:

Service	Short purpose
Nhost	Authentication, database, file storage and backend functions
Vercel	Hosting and delivery of the administration application and e-labels
Dub	Short links, redirects and link statistics
Postmark	Transactional and service email
PostHog	In-application product analytics and error context
Gleap	Support, feedback and error diagnosis
Cloudflare Turnstile	Bot and abuse protection during authentication
PDFMonkey	Generation of PDF data sheets
Kit	Customer product information by email
Bunny	Delivery and security of the public website

Our processors act under contract and instructions. Authorities, advisers or other recipients may receive data where required by law or necessary to establish, exercise or defend legal claims.

8. Payment through Paddle

Paddle acts as merchant of record for purchases. It collects payment and billing details, processes payment, issues invoices and handles applicable transaction taxes. We receive information needed to activate and administer the account, such as customer and company details, plan, payment status, transaction identifiers and invoice records. Paddle acts as an independent controller for its payment processing. Its privacy information is available at paddle.com/legal/privacy.

9. Retention

We keep personal data only for as long as needed for the relevant purpose. Account and service data is normally kept for the contract and the period needed for return, export, deletion, security and claims. Business correspondence, contracts, invoices and accounting records are retained for applicable Austrian statutory periods, including tax and company-law duties. Support, analytics and security data is retained only as long as reasonably required for support, product operation, security or legal claims. Data processed for a customer is returned or deleted under the Data Processing Agreement, subject to legal retention duties.

10. Rights

Subject to the legal conditions, a person may request access, rectification, erasure, restriction and data portability, and may object to processing based on legitimate interests. Where processing is based on consent in a specific case, consent may be withdrawn for the future. To exercise rights concerning processing for which Essential Code is controller, contact us using the details above. For customer-controlled data, contact the relevant customer first.

A person may complain to a data-protection authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb.gv.at.

11. Changes

We update this Notice when our processing or legal duties change. The current version is published on the Glasswise website.

Last updated: 12 October 2026