PRIVACY POLICY

This privacy policy applies between you, the User of this Website and ISLE OF WIGHT DISTILLERY LTD, the owner and provider of this Website. ISLE OF WIGHT DISTILLERY LTD takes the privacy of your information very seriously. This privacy policy applies to our use of any and all Data collected by us or provided by you in relation to your use of the Website.

Please read this privacy policy carefully.

• We collect the information you give us when you buy from us, sign up for marketing, or contact us, plus some technical information collected automatically.
• We use Shopify to run our online store, Klaviyo for email and SMS marketing, and Google and Meta for analytics and advertising.
• We only send you marketing when we're allowed to, and you can opt out at any time.
• Our website is for adults aged 18 or over only.
• You have strong rights over your data, including the right to access, correct, delete and object — see Section 11.

• the singular includes the plural and vice versa;
• references to sub-clauses, clauses, schedules or appendices are to sub-clauses, clauses, schedules or appendices of this privacy policy;
• a reference to a person includes firms, companies, government entities, trusts and partnerships;
• "including" is understood to mean "including without limitation";
• reference to any statutory provision includes any modification or amendment of it;
• the headings and sub-headings do not form part of this privacy policy.

• name;
• date of birth (where required for age verification);
• contact information such as email addresses, telephone numbers and delivery/billing addresses;
• demographic information such as postcode, preferences and interests;
• purchase history and transaction data;
• IP address (automatically collected);
• web browser type and version (automatically collected);
• operating system (automatically collected);

• data is given to us by you;
• data is received from other sources; and
• data is collected automatically.

• when you contact us through the Website, by telephone, post, e-mail or through any other means;
• when you register with us and set up an account to receive our products/services;
• when you place an order through our Website;
• when you complete surveys that we use for research purposes (although you are not obliged to respond to them);
• when you enter a competition or promotion through a social media channel;
• when you make payments to us, through this Website or otherwise;

• Shopify Inc. – our e-commerce platform provider, which facilitates the operation of our online store and processes orders on our behalf;
• Google – for analytics and advertising services;
• Klaviyo Inc. – for email and SMS marketing services;
• Swydo – for data analytics and marketing reporting;
• Meta Platforms Inc. – for advertising services via Meta Ads (Facebook and Instagram).

• we automatically collect some information about your visit to the Website. This information helps us to make improvements to Website content and navigation, and includes your IP address, the date, times and frequency with which you access the Website and the way you use and interact with its content.
• we will collect your Data automatically via cookies, in line with the cookie settings on your browser. For more information about cookies, and how we use them on the Website, see the section below, headed "Cookies".

• Soft opt-in applies where you have purchased (or negotiated the purchase of) goods from us. In those circumstances, and in accordance with regulation 22(3) of the Privacy and Electronic Communications Regulations 2003, we may send you marketing about our own similar products without your prior explicit consent. You will always be given a clear and simple opportunity to opt out, both at the point your details are collected and in every subsequent marketing message.
• Explicit consent is required for all other direct marketing by email — for example, where you sign up to our newsletter without making a purchase. You must take a positive and affirmative action, such as ticking an unticked box, before we will send you such communications.

• any of our group companies or affiliates – to ensure the proper administration of your website and business;
• our employees, agents and/or professional advisors – to carry out our business and obtain professional advice;
• marketing, creative and digital agencies – who we engage to manage and deliver our marketing campaigns, social media, advertising and related services on our behalf. Any such agency acting as a data processor is bound by contractual obligations to process your Data only on our instructions and in accordance with applicable Data Protection Laws;
• Shopify Inc. – to operate our online store, process orders and manage payments. Shopify acts as a data processor on our behalf and is bound by contractual obligations to keep your Data secure and use it only on our instructions;
• Klaviyo Inc. – to manage and send email and SMS marketing communications, where you have consented to receive them;
• Google – for website analytics and advertising;
• Swydo – to aggregate and analyse marketing data and produce reporting;
• Meta Platforms Inc. – to deliver targeted advertising via Facebook and Instagram on our behalf;
• third party payment providers – to enable processing of payments and refunds made via our Website;
• relevant authorities – where we are required to do so by law, or to facilitate the detection of crime or the collection of taxes or duties;

• the nature and purpose of the processing;
• the type of Data being processed;
• the obligations and rights of Isle of Wight Distillery Ltd as the data controller; and
• the obligations of the third party as a data processor, including requirements to process Data only on our documented instructions, to maintain appropriate security measures, and not to engage further sub-processors without our prior consent.

• Shopify Inc. is headquartered in Canada (which benefits from a UK adequacy decision) but may process data in the United States. Shopify participates in the UK-US Data Bridge (in effect from 17 October 2023), which provides appropriate safeguards for such transfers.
• Klaviyo Inc., Google, Swydo and Meta Platforms Inc. may also process data in the United States and rely on the UK-US Data Bridge or UK International Data Transfer Agreements (UK IDTAs) as appropriate safeguards.

• access to your account is controlled by a password and a username that is unique to you;
• we store your Data on secure servers;
• our e-commerce platform, Shopify, is certified to PCI DSS standards in relation to the processing of payment card data.

• Customer account and transaction data – retained for 7 years after your last transaction, in line with HMRC requirements under the Companies Act 2006 and VAT record-keeping rules.
• Marketing consent records and contact details – retained for as long as you remain subscribed, and for 24 months after your last engagement (open, click or purchase), after which your record will be deleted or anonymised.
• Records of consent withdrawal or unsubscribe requests – retained indefinitely as evidence of compliance with your request.
• Website analytics data (Google Analytics) – retained for 14 months, after which user-level and event-level data is automatically deleted.
• Customer service correspondence – retained for 3 years from the date of last contact.
• CCTV or visitor records at our distillery (where applicable) – retained for 30 days unless required for an active investigation.

• Email: info@isleofwightdistillery.com
• Post: Data Protection Contact, Isle of Wight Distillery Ltd, The Wishing Well, Pondwell Hill, Ryde, Isle of Wight, PO33 1PX

• Right to access – you may request copies of the personal Data we hold about you. We will not charge you for this unless your request is manifestly unfounded or excessive.
• Right to rectification – you have the right to have inaccurate or incomplete Data corrected.
• Right to erasure – you have the right to request that we delete your Data from our systems where it is no longer necessary for us to hold it (the "right to be forgotten").
• Right to restrict processing – you have the right to ask us to limit the way in which we use your Data.
• Right to data portability – you have the right to request that we provide your Data to you (or to a third party) in a structured, commonly used and machine-readable format.
• Right to object – you have the right to object to our processing of your Data where we rely on legitimate interests as our lawful basis, including for direct marketing purposes.
• Rights related to automated decision-making – you have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects concerning you.

• By email: info@isleofwightdistillery.com
• By post: Isle of Wight Distillery Ltd, The Wishing Well, Pondwell Hill, Ryde, Isle of Wight, PO33 1PX

• Website: https://ico.org.uk/
• Telephone: 0303 123 1113

• Strictly necessary cookies – required for the operation of the Website (e.g. shopping cart, checkout, log-in). These cannot be disabled.
• Analytical/performance cookies – help us understand how visitors use the Website (e.g. Google Analytics). Set only with your consent.
• Functionality cookies – remember your preferences and personalise content. Set only with your consent.
• Targeting/advertising cookies – used by us and our advertising partners (including Meta and Google) to show you relevant adverts on this and other websites. Set only with your consent.