Privacy Policy

Last updated: November 2, 2026

This is an English translation. The Spanish version governs.

1. Who is responsible for your data

The data controller is Surot S.A. (Argentine tax ID CUIT 30-71634630-3), which operates the Bodega Gamboa brand (Gamboa Viñas & Bodega, Casa Gamboa, Gamboa Costa Atlántica, Mi Finca and Fincas Residenciales Gamboa), with registered office at Jorge Newbery 1744, piso 5°, Ciudad Autónoma de Buenos Aires, Argentina and premises at Panamericana Ruta 9 Km 65,5, Campana (B2814), Provincia de Buenos Aires.

Contact for anything related to your data: [email protected].

2. What data we collect

  • When you message us on WhatsApp: your phone number, your WhatsApp profile name, the content of the messages we exchange, and the date and time of each message.
  • If you come from an ad (for example, on Facebook or Instagram): which ad and campaign brought you and which platform you came from.
  • When you fill in a form on the website (events, Fincas Residenciales, Mi Finca, newsletter or other inquiries): your name, e-mail, phone number and your inquiry.
  • When you browse the website: technical and usage data (pages visited, device type, traffic source) through measurement cookies (Google Tag Manager / Google Analytics and Cloudflare). You can block them in your browser settings.

Online wine purchases are processed by the VinTrail platform and payments by Mercado Pago, each under its own privacy policy. We do not see or store your card details.

3. How we use your data

  • To answer your inquiries and manage bookings.
  • To follow up on your inquiry (visits, restaurant, events, Mi Finca and Fincas Residenciales), including follow-up messages by WhatsApp or e-mail.
  • To send you news by e-mail, only if you subscribed. You can unsubscribe at any time.
  • To measure which ads and campaigns work.

WhatsApp messages reach our customer relationship management system (CRM) through the "CRM Gamboa" app registered with Meta.

4. Who we share your data with

We do not sell or transfer your data to third parties for their own purposes. It is only shared with the providers we need to operate, who process it on our behalf: Meta Platforms (WhatsApp), the hosting provider of the server running the CRM, our e-mail delivery service and the measurement tools mentioned above. We may also disclose it when required by law by a competent authority.

5. How long we keep it

For as long as our business relationship lasts, or until you ask us to delete it, unless a law requires us to keep it longer.

6. Your rights and how to delete your data

You can access, correct, update or request deletion of your data, and opt out of messages, by writing to [email protected] from your e-mail or stating the WhatsApp number you contacted us from. We answer access requests within 10 calendar days and correction or deletion requests within 5 business days, as set by Argentine Law 25,326.

If you contacted us on WhatsApp, deletion includes removing your number, profile name and messages from the CRM.

7. Security

We apply reasonable technical and organizational measures to protect your data against loss, unauthorized access or alteration. Only team members who need it to assist you can access it.

8. Changes to this policy

If we change this policy, we will publish the new version on this page with its update date.

9. Argentine Personal Data Protection Law 25,326

The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is proven, as set forth in article 14, paragraph 3 of Law No. 25,326. The AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA (Agency for Access to Public Information), as the Control Body of Law No. 25,326, has the power to handle complaints and claims filed by those whose rights are affected by non-compliance with the rules in force on personal data protection.