Privacy and cookies
Last updated: 6 September 2026.
Who is responsible?
Matthys Wijnimport nv, BE0459.197.406, Gistelsesteenweg 228, 8200 Brugge, Belgium, is responsible for the processing described here. Contact us at [email protected] or +32 (0)50 38 63 80. This statement concerns the public webshop at matthys-wines.com; the cookie controls described below apply to that webshop.
Which information do we process, and why?
When you contact us, subscribe to a newsletter or place an order, you provide information such as your name, contact details, delivery and billing details, order information and the content of your message. Information needed to handle an order is necessary to fulfil our contract or take steps at your request before an order. Without the required contact, delivery and order details, we cannot process your order. Accounting records are also subject to legal obligations. Newsletter subscriptions are optional; you can withdraw your subscription by contacting us.
We log page visits and process technical information, such as browser/device characteristics, activity times and technical codes, to compile traffic statistics, detect and filter automated traffic (including bots and AI crawlers), and investigate website problems. The purpose is to understand the use and reliability of the website, rather than to monitor individual people. Technical codes help count and group page requests.
Newsletter processing is based on your subscription consent. Requests relating to an order are handled on the contractual basis described above. For other enquiries and technical fault investigation, the relevant legitimate interests are answering your request and maintaining a reliable, secure webshop, subject to your rights and a necessity and proportionality assessment. Those interests do not replace any consent required for cookies or similar tracking. Optional GTM loading is based on your choice in the cookie bar. Merely visiting the site is not consent.
Separately, with your consent, we use Contentsquare to create heatmaps and session recordings that help us understand how people navigate the webshop, identify usability problems and improve pages. This can involve clicks, scrolling, pointer movements, pages viewed, page content and browser/device information. Recordings reproduce interactions with our website; they are not camera or microphone recordings. This optional processing is based on consent, not on the security and operational purposes described above.
Cookies and similar storage
We use cookies and browser storage to remember your choices, support shopping and measure visits.
| Purpose | Cookie or browser-storage name | Duration |
|---|---|---|
| Remember your privacy choice | Cookie mw_gtm_consent_v2; browser storage mw.gtm-consent.v2 | 180 days |
| Remember your shopping cart | Browser storage cart_v3, cart_metadata_v1 | No fixed expiry; until removed by the website or in your browser |
| Remember dismissal of the language suggestion | Browser storage hide_language_suggestion | No fixed expiry; until removed by the website or in your browser |
| Bot detection and filtering for website security; traffic statistics | Cookie mwcid; browser storage mw.cid | Cookie: 400 days; browser storage: no fixed expiry |
| Group page requests for traffic statistics | Cookie mwsid; browser storage mw.sid, mw.la | Cookie: 30 minutes; a new session follows 30 minutes of inactivity. Browser storage has no fixed expiry |
The cookies are set on the storefront hostname you visit (www.matthys-wines.com or matthys-wines.com), with path /. Browser storage belongs to that website address and has no cookie path. Storage with no fixed expiry can be removed through your browser's site-data settings.
When enabled, Contentsquare loads through Google Tag Manager only after your acceptance. Rejecting optional tracking prevents Contentsquare from loading. Its first-party cookies can include the following, depending on the configuration:
| Purpose | Cookie or browser-storage name | Duration |
|---|---|---|
| Contentsquare browser recognition for usage analysis | _cs_id | 13 months |
| Contentsquare session activity | _cs_s | 30 minutes, renewed with activity |
| Contentsquare replay privacy state | _cs_c | 13 months, renewed when that state changes |
| Contentsquare session variables, if used | _cs_cvars | Session |
| Contentsquare opt-out, if set | _cs_optout | 13 months |
| Contentsquare cookie compatibility/domain checks | _cs_t, _cs_same_site, _cs_root-domain | Immediately removed |
These are the provider's documented cookie lifetimes, not recording-retention periods. See Contentsquare's cookie information. Earlier privacy-choice keys ending in v1 may remain until expiry or removal, but no longer authorise this optional tracking.
Google Tag Manager loads only after acceptance in the cookie bar. Rejecting optional tags prevents it from loading and does not prevent shopping. The choice currently applies to those optional tags; separate visit measurement and error reporting remain active. These activities are therefore not all disabled by that choice.
You can change your choice through the cookie settings link in the footer. Withdrawal stops subsequent GTM loading, but does not undo earlier processing or automatically erase information already sent. Removing site data can also remove your preferences and saved cart.
Acceptance is not blanket consent for future purposes. Additional analytics, advertising or session-recording services need appropriate information and consent before activation. The separate payment provider's website has its own privacy and cookie information.
Who receives information, and where?
Depending on your interaction, recipients include our staff handling enquiries and orders, IT/hosting providers, payment and delivery providers, email providers and providers of technical diagnostics. The webshop's integrations include:
- PAY. (pay.nl): online payment processing, including the transaction and customer/order details needed to process the payment. The payment provider also supplies its own privacy information.
- Mailgun: email delivery, which involves recipient addresses and message content.
- Sentry: diagnosing website errors using error details, browsing context and device information, which may include personal data such as IP addresses.
- Google: Google Tag Manager for optional tags after acceptance, and Google Analytics, where enabled, for traffic statistics using technical codes, page activity and device information.
- Contentsquare: optional heatmaps and session recordings using the interaction and technical information described above, only with your consent. See Contentsquare's services privacy policy.
- ip-api.com: estimating a visitor's country from their public IP address.
Some providers operate internationally, and processing may involve countries outside the European Economic Area. Such transfers require an applicable legal transfer mechanism, such as an adequacy decision or appropriate safeguards, including standard contractual clauses where applicable. This statement does not establish which mechanism covers a particular provider or guarantee exclusively European processing. Contact us for information about the countries, recipients and safeguards relevant to your data, and how to obtain a copy of the applicable safeguards.
How long is information kept?
The browser-storage lifetimes above are separate from retention on our servers and by service providers.
Retention must be limited to what the purpose and applicable obligations require. The relevant criteria are:
- Orders, payments and invoices: completion of the transaction, delivery and after-sales matters, applicable accounting/tax retention obligations and the handling of legal claims.
- Contact requests: handling the request and related follow-up; where a request concerns an order or dispute, the relevant transaction or claim requirements also apply.
- Newsletter details: the duration of the subscription. After withdrawal, limited evidence of the choice or an exclusion record may be necessary to respect the withdrawal and handle complaints; withdrawal does not authorise further marketing.
- Technical logs, error reports and analytics: the period needed to investigate the relevant fault or security incident and fulfil the stated diagnostic or measurement purpose. A persistent identifier is not a reason for unlimited retention.
- Contentsquare heatmaps and session recordings: the period needed to analyse use and investigate usability problems, subject to the retention limits of the configured service plan. Cookie expiry is not the retention period for these records.
These are retention criteria, not a claim that all systems use a fixed automatic deletion schedule. Browser expiry or deletion does not automatically delete server records, provider records or backups. Contact us to request the retention information applicable to your records or to exercise your deletion rights.
Your rights
Under the GDPR, depending on the circumstances, you may request access, correction, deletion, restriction of processing or data portability, and object to processing based on legitimate interests. You may always object to direct marketing. Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal. Contact us using the details above; we may request proportionate information to verify your identity. You do not routinely need to send an identity-document copy or a signed letter.
You may also complain to the Belgian Data Protection Authority or your competent supervisory authority. This statement may be updated when our practices change. Any new processing requiring consent needs the appropriate consent; publication of a revised statement is not consent.