Privacy Policy

WHO WE ARE

Speciality Drinks Limited is the controller responsible for the personal information described in this policy, unless we explain otherwise.

We are registered in England and Wales with company number 04449145. Our registered office is Elixir House, Whitby Avenue, Park Royal, London NW10 7SF, United Kingdom.

In this policy, 'The Whisky Exchange', 'we', 'us' and 'our' refer to Speciality Drinks Limited trading as The Whisky Exchange.

For privacy queries, requests or complaints, you can contact our Data Protection Team using our General Queries support form at www.thewhiskyexchange.com/customerservice/help-generalsupport, by telephone on +44 (0)20 8838 9388, or by writing to: Data Protection Team, Speciality Drinks Limited, Elixir House, Whitby Avenue, Park Royal, London NW10 7SF, United Kingdom.

PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you interact with us. It may include the following categories:

• Contact details, such as your name, billing address, delivery address, email address and telephone number.
• Account details, such as username, password, account preferences, contact preferences and authentication information.
• Order and transaction details, such as products ordered, order value, delivery method, order status, returns, refunds, gift messages, invoices and payment status.
• Payment-related information, such as transaction references, payment method, partial card details or payment token information. Full card details and card security codes are handled by our payment service providers where you pay by card or wallet.
• Age, identity and fraud-prevention information, such as date of birth, address verification information, fraud-screening results, credit reference agency check results, payment checks and other information needed to verify age, identity or payment use.
• Customer-service information, such as enquiries, complaints, support tickets, responses to surveys, feedback, reviews, testimonials and records of our correspondence with you.
• Marketing and preference information, such as newsletter preferences, competition entries, event registrations, marketing consent, opt-out records, engagement with our emails and advertising preferences.
• Technical and usage information, such as IP address, browser type and version, device identifiers, operating system, approximate location inferred from IP address, pages viewed, website interactions, referral source, cookie identifiers, advertising identifiers, analytics data, security logs and error logs.
• Valuation and product enquiry information, such as details of bottles or collections, images you provide, ownership or provenance information, and related correspondence.
• Trade or business contact information, such as business name, job title, business contact details, trade account information and information relevant to trade enquiries or accounts.
• Information collected in shops or at events, such as event bookings, attendance details, purchase records and CCTV images where CCTV is in operation and signage is displayed.

We do not intentionally collect special category personal information, such as information about health, religion, ethnicity, political opinions, trade union membership, biometric data or sexual orientation. Please do not provide this information to us unless we specifically ask for it and explain why it is needed.

HOW WE COLLECT PERSONAL INFORMATION

We collect personal information directly from you when you create an account, place an order, contact us, use our websites, visit our shops, attend events, enter competitions, request valuations, leave reviews, respond to surveys or sign up to marketing.

We also collect information automatically when you use our websites, including through cookies, pixels, tags, server logs and similar technologies.

We may receive information from third parties where necessary for our services, including payment providers, delivery providers, identity and age-verification providers, fraud-prevention providers, credit reference agencies, marketing platforms, analytics providers, review platforms, social media platforms, trade partners, public authorities and publicly available sources.

HOW WE USE PERSONAL INFORMATION AND OUR LAWFUL BASIS

We use personal information only where we have a lawful basis under data protection law. The table below explains the main purposes for which we use personal information and the lawful bases we rely on.

Where we rely on legitimate interests, we consider our interests and your rights and freedoms. You may object to processing based on legitimate interests in certain circumstances.

MARKETING

We may send you marketing about our products, offers, events and services where you have consented, or where the law allows us to rely on the soft opt-in for our own similar products and services.

The soft opt-in may apply where you have bought from us or negotiated to buy from us, we gave you a clear opportunity to opt out when we collected your details, and we give you a clear opportunity to opt out in every marketing message.

For business contacts and corporate subscribers, we may send marketing where permitted by law. You can object or opt out at any time.

You can unsubscribe from marketing at any time by using the unsubscribe link in our emails, updating your account preferences or contacting us. We may still send you non-marketing service messages, such as order confirmations, delivery updates, account-security messages, product safety notices and responses to your enquiries.

COOKIES AND SIMILAR TECHNOLOGIES

We use cookies, pixels, tags, scripts and similar technologies to operate our websites, remember preferences, keep our services secure, understand website use, improve our services, personalise content and deliver or measure advertising.

Strictly necessary cookies and similar technologies are used to provide the website and do not require consent. Non-essential cookies and similar technologies, including certain analytics, advertising, retargeting and social media technologies, are used only where legally permitted and where any required consent has been obtained.

You can manage cookie choices through our cookie banner or cookie settings tool. You can also control cookies through your browser settings, although blocking some cookies may affect website functionality.

Our Cookie Policy gives more detailed information about the cookies and similar technologies we use, including their provider, purpose, duration and category.

AGE, IDENTITY AND FRAUD CHECKS

Because we sell age-restricted products, we may need to verify that you are aged 18 or over and that payment details are being used lawfully.

We may validate your name, address, date of birth, payment information and other relevant details against appropriate third-party databases, identity-verification providers, fraud-prevention providers, credit reference agencies or public sources.

These checks are carried out to comply with legal requirements relating to age-restricted products, prevent fraud, verify payment use, protect customers and our business, and perform our contract with you.

Identity and age checks do not involve a credit application and should not affect your credit rating unless we tell you otherwise. Third-party providers may keep a record of the check in accordance with their own privacy notices and applicable law.

WHO WE SHARE PERSONAL INFORMATION WITH

We share personal information where necessary with the following categories of recipients:

• Payment processors, payment networks and payment method providers, including providers such as Worldpay, PayPal, Amazon Pay, Apple Pay and Google Pay where you choose those payment methods.
• Delivery, fulfilment, warehouse and logistics providers.
• Identity, age-verification, fraud-prevention and credit reference providers.
• Website hosting, IT, cloud, security, analytics and support service providers.
• Customer-service, CRM, email, SMS, marketing automation and review platforms.
• Advertising, retargeting, social media and marketing measurement partners, subject to cookie and marketing consent rules where applicable.
• Professional advisers, including lawyers, auditors, insurers, bankers and accountants.
• HMRC, Trading Standards, regulators, courts, law-enforcement agencies, public authorities and other bodies where required or permitted by law.
• Prospective buyers, sellers, funders, group companies or advisers if our business or assets are sold, transferred, merged, reorganised or financed.

Where a third party acts as our processor, we require them to process personal information only on our instructions, keep it secure, assist us with compliance and use it only for the services they provide to us.

We do not sell your personal information.

INTERNATIONAL TRANSFERS

Some of our service providers may process personal information outside the United Kingdom. Where personal information is transferred internationally, we will use appropriate safeguards where required by law.

These safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism. Where required, we will assess the risks of the transfer and apply supplementary measures.

HOW LONG WE KEEP PERSONAL INFORMATION

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including to meet legal, regulatory, tax, accounting, fraud-prevention, security and dispute-resolution requirements.

Typical retention periods include:

• Account information: for as long as your account remains active and for a reasonable period afterwards to deal with account administration, fraud prevention, legal claims and compliance requirements.
• Order, invoice, payment and tax records: usually six years after the end of the relevant accounting period, unless a longer period is required or permitted by law.
• Customer-service communications and complaints: usually up to six years after the issue is resolved, depending on the nature of the enquiry, complaint or claim.
• Marketing consent and suppression records: for as long as needed to evidence your preferences and ensure we respect opt-outs.
• Cookie and analytics information: for the period stated in our Cookie Policy or cookie settings tool.
• Fraud-prevention, identity, age-verification and security records: for as long as necessary to protect our websites, customers and business, investigate suspicious activity, comply with legal requirements and deal with disputes.
• Competition, promotion and event records: for the duration of the competition, promotion or event and a reasonable period afterwards for administration, audit, prize fulfilment and dispute handling.
• Valuation and product enquiry records: for as long as necessary to deal with the enquiry, related transactions, audit requirements, legal claims and fraud prevention.

Where we no longer need personal information, we will delete it, anonymise it or securely archive it until deletion is possible.

HOW WE PROTECT PERSONAL INFORMATION

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access controls, authentication, encryption or pseudonymisation where appropriate, secure payment processing, staff training, supplier due diligence, contractual controls, monitoring, backup and incident-response procedures.

No website, system or transmission is completely secure. If we identify a personal data breach, we will assess it and notify affected individuals and the Information Commissioner's Office where required by law.

CHILDREN

Our websites and services are intended for people aged 18 or over. We do not knowingly sell age-restricted products to anyone under 18 and we do not knowingly collect personal information from children for marketing purposes.

If we become aware that we have collected personal information from someone under 18 in circumstances where this is not permitted, we will take reasonable steps to delete it or restrict its use.

AUTOMATED DECISION-MAKING AND PROFILING

We may use automated tools to help detect fraud, verify age or identity, prevent misuse of payment methods, protect website security, personalise marketing or measure advertising effectiveness.

We will not make solely automated decisions that have a legal or similarly significant effect on you unless this is permitted by law and appropriate safeguards are in place. If such decision-making is used, we will provide information required by law.

YOUR RIGHTS

Under UK data protection law, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete personal information.
• Request erasure of your personal information.
• Request restriction of processing.
• Object to processing based on legitimate interests or to direct marketing.
• Request data portability where applicable.
• Withdraw consent where we rely on consent. Withdrawal of consent does not affect processing that took place before consent was withdrawn.
• Complain to us and to the Information Commissioner's Office.

These rights are not absolute and may depend on the circumstances. We may need to verify your identity before responding to a request.

We will respond to valid rights requests within one month, unless the law allows us to extend that period because the request is complex or we have received a number of requests.

COMPLAINTS

If you are unhappy with how we handle your personal information, please contact us first using the details in section 1.

We will provide a clear way for you to make a data protection complaint, acknowledge your complaint within 30 days, investigate appropriately, keep you informed where appropriate and tell you the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner's Office. The ICO's contact details are: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. Website: ico.org.uk. Telephone: 0303 123 1113.

If you are based outside the UK, you may also have the right to complain to your local data protection authority, depending on applicable law.

LINKS TO OTHER WEBSITES AND SERVICES

Our websites may link to third-party websites, payment providers, social media platforms, review platforms or other services. Those third parties are responsible for their own privacy practices. Please read their privacy notices before providing them with personal information.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The updated version will be shown by the 'Last updated' date at the top of this page.

If we make material changes, we may notify you by prominently posting a notice on our website or by contacting you directly where appropriate.

HOW TO CONTACT US OR EXERCISE YOUR RIGHTS

You can exercise your rights or contact us about this Privacy Policy by using our General Queries support form at www.thewhiskyexchange.com/customerservice/help-generalsupport, by telephone on +44 (0)20 8838 9388, or by writing to: Data Protection Team, Speciality Drinks Limited, Elixir House, Whitby Avenue, Park Royal, London NW10 7SF, United Kingdom.

You can update some account information by logging into your account. You can opt out of marketing using the unsubscribe link in our emails, through your account preferences or by contacting us.