1. Who We Are (Data Controller)

Harley House Distillery Ltd is the Data Controller responsible for your personal data. We are committed to protecting your privacy in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

• Registered Distillery Address: Harley House Distillery Ltd, Seaford, East Sussex, UK

• Data Privacy Contact: info@harleyhousedistillery.co.uk

• Telephone: 01323 491998

​

2. The Data We Collect & Lawful Basis for Processing

Under UK GDPR Article 6, we only process personal information when we have a recognised lawful basis:

• Purpose / Activity Type of Data Collected Lawful Basis for Processing Fulfilling Online Orders & Delivery Name, delivery address, billing address, email, contact telephone number Contractual Necessity: Required to deliver purchases and provide transaction notices.

• Payment Processing Payment card details (processed securely via PCI-DSS compliant third-party gateways; we never store card numbers)Contractual Necessity: Required to take payment for goods ordered.

• Legal Compliance & Age Verification Age verification status (18+ confirmation)Legal Obligation: Mandatory compliance with UK alcohol licensing laws. Customer Enquiries & B2B Forms Name, business name, email, phone number, enquiry notes Legitimate Interests: To respond to your direct queries, bespoke distilling requests, or gifting orders.

• Email Newsletters & Promotions Name, email address Explicit Consent: Provided voluntarily via signup boxes; revocable at any time.Website Security & Analytics: IP address, browser type, device details, site interaction patterns.

• Legitimate Interests / Consent: Essential technical cookies (Legitimate Interests); Analytics/Ad cookies (Consent).

 

3. Cookies & Tracking Technologies

We use cookies to ensure site functionality, remember your shopping basket, and understand site traffic:

• Strictly Necessary Cookies: Essential for page navigation, session management, secure checkout, and recording your age-verification confirmation. These cannot be disabled.

• Performance & Analytics Cookies (e.g., Google Analytics) help us analyse aggregated visitor numbers, clickstream behavior, and referral traffic. These cookies are only activated with your explicit opt-in consent via our cookie banner.

• Managing Cookies: You can adjust your preferences at any time through the cookie settings icon on our site or by modifying your browser settings to block or delete cookies.

​

4. Data Sharing with Third Parties

We never sell, rent, or trade your personal data. We share necessary data only with vetted service providers operating under strict data processing agreements:

• Logistics & Couriers (e.g., Royal Mail, DPD, APC) deliver your physical orders.

• Payment Processors (e.g., Stripe, PayPal, Wix Payments) securely authenticate and settle transactions.

• Hosting & Software Services (e.g., Wix.com, Google Workspace) to host our website and maintain customer records.

• Legal Obligations: If legally mandated by law enforcement or regulatory authorities.

• International Transfers: Where service providers store data outside the UK, we ensure adequate safeguards are in place (such as UK Adequacy Regulations or the UK International Data Transfer Addendum).

​

5. Data Retention Periods

We retain personal data only as long as strictly necessary:

• Order & Transaction Records: Retained for 6 years following the end of the relevant financial year to comply with statutory UK tax and accounting obligations (HMRC).

• Marketing Subscribers: Retained until you unsubscribe or withdraw consent.

• General Enquiries: Retained for up to 24 months after the last communication before secure deletion.

 

6. Your Statutory Rights Under UK GDPR

You have the following rights regarding your personal information, exercisable free of charge:

• Right of Access (Subject Access Request): You may request a copy of the personal data we hold about you.

• Right to Rectification: You may ask us to correct inaccurate or incomplete personal records.

• Right to Erasure ("Right to be Forgotten"): You may request that we delete your data where no overriding legal basis for retention applies.

• Right to Restrict or Object to Processing: You can object to direct marketing or request restricted processing under specific legal grounds.

• Right to Data Portability: You may request that we provide your data in a structured, machine-readable format.

• To exercise any of these rights, email info@harleyhousedistillery.co.uk. We verify identity proportionately and respond within one calendar month.

 

7. Reporting a Suspected Data Breach or Privacy Issue

If you suspect an incident, unauthorized exposure, or vulnerability regarding personal data, notify our team immediately at:

• Direct Compliance Email: info@harleyhousedistillery.co.uk

• Subject Line: URGENT: Data Protection Notice

• We investigate all reports without delay. If an incident presents a risk to the rights and freedoms of individuals, we report the incident to the Information Commissioner's Office within 72 hours as required by law.

​

8. Lodging a Complaint (The ICO)

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint directly with the UK supervisory authority:

• Supervisory Authority: Information Commissioner’s Office (ICO)

• Website: ico.org.uk/make-a-complaint

• Helpline: 0303 123 1113

• Postal Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

​

Updated September 2026