Privacy Policy

Last updated: 11 May 2026

1.1 Introduction

The Wimbledon Brewery Company Limited ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and your rights under UK data protection law.

This policy is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and takes into account guidance from the Information Commissioner's Office (ICO).

1.2 Who the data controller is

The data controller is The Wimbledon Brewery Company Limited. Our full company details and how to contact us about this policy are set out in Section 5 (Contact Information).

1.3 Personal data we collect

We collect the following categories of personal data:

• Identity and contact data: name, delivery address, billing address, email address, telephone number, date of birth (for age verification).
• Transaction data: items purchased, order history, payment method (we do not store full card numbers — these are handled by our payment processor).
• Account data: username and password where you create an account, preferences, and marketing consent.
• Technical data: IP address, browser type and version, device information, time zone, and pages visited.
• Marketing data: your preferences in receiving marketing from us and any third parties, and your communication preferences.
• Communications data: records of correspondence when you contact us by email, phone, or through social media.

1.4 How we use your data and our lawful basis

We only use your personal data when the law allows us to. Most commonly we will use your personal data in the following circumstances:

• To process and fulfil your order, including taking payment and arranging delivery — lawful basis: performance of a contract (UK GDPR Article 6(1)(b)).
• To verify that you are aged 18 or over — lawful basis: compliance with a legal obligation (Article 6(1)(c), Licensing Act 2003).
• To keep records required by HMRC and company law — lawful basis: compliance with a legal obligation (Article 6(1)(c)).
• To send you marketing emails about new releases, events at the taproom, and promotions — lawful basis: your consent (Article 6(1)(a)).
• To improve our website, products, and customer service — lawful basis: our legitimate interests (Article 6(1)(f)) in running our business efficiently.
• To detect and prevent fraud — lawful basis: our legitimate interests (Article 6(1)(f)) in protecting our business and customers.

1.5 Marketing communications

We will only send you marketing emails if you have opted in. You can withdraw your consent at any time by clicking the "unsubscribe" link in any marketing email, by updating your preferences in your account, or by contacting us.

Transactional messages (order confirmations, dispatch notifications, and similar) are sent on the lawful basis of performance of a contract and are not marketing communications — you will continue to receive these even if you unsubscribe from marketing.

1.6 Who we share your data with

We share your personal data with the following categories of third parties, each acting as a data processor on our behalf under a written contract that includes UK GDPR data protection terms:

• Shopify Inc. — our e-commerce platform, which hosts this website and processes orders.
• Shopify Payments and other payment providers enabled at checkout — for processing card payments.
• Delivery carriers — for fulfilling and delivering your orders. The carrier receives your name, delivery address, email and phone number for delivery notifications.
• Mailchimp + Shopify Email — for sending marketing and transactional emails where you have opted in.
• Google Analytics 4 + Shopify Analytics — for understanding how customers use our website.
• Meta and their tracking pixels — for running and measuring online advertising campaigns.

We may also disclose your personal data where required by law, to prevent fraud, or to enforce or defend our legal rights.

We never sell your personal data.

2.7 International data transfers

Some of the processors listed above, including Shopify, are based outside the UK. Where personal data is transferred outside the UK, we rely on one of the following safeguards in accordance with Article 46 UK GDPR:

• A UK adequacy decision, where one exists for the destination country;
• The International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses; or
• Other appropriate safeguards approved by the ICO.

2.8 How long we keep your data

We only keep your personal data for as long as we need it:

• Transactional and accounting records — six years from the end of the financial year to which they relate, as required by HMRC.
• Account data — while your account is active, and for a further two years of inactivity before deletion or anonymisation.
• Marketing data — until you unsubscribe or withdraw consent, after which your email is suppressed to prevent further contact but not deleted for a short period to honour your opt-out.
• Website analytics — typically 14 months, in line with default settings in our analytics tools.
• Customer service correspondence — up to three years after the matter is resolved.

2.9 Cookies and similar technologies

Our website uses cookies and similar technologies. These fall into four categories:

• Strictly necessary — required for the website to function (e.g. shopping cart, login). These do not require consent.
• Functional — remember your preferences (e.g. language, region).
• Analytics — help us understand how the website is used.
• Marketing — used to measure advertising and show you relevant ads on other websites.

Where required by the Privacy and Electronic Communications Regulations (PECR), we ask for your consent to non-essential cookies through a banner when you first visit the website. You can change your preferences at any time through the cookie preferences link in the website footer.

2.10 Children's data

Our products include alcohol and our website is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we hold personal data belonging to someone under 18, please contact us and we will delete it.

2.11 Automated decision-making and profiling

We may use profiling in our marketing — for example, sending different promotions to customers based on past purchases, or using "lookalike" audiences on social media advertising platforms. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

2.12 Your rights

Under UK data protection law you have the following rights, which you can exercise free of charge:

• The right to be informed about how we use your data.
• The right of access — to request a copy of the personal data we hold about you.
• The right to rectification — to have inaccurate personal data corrected.
• The right to erasure — to ask us to delete your personal data, subject to legal retention obligations.
• The right to restrict processing — to ask us to limit how we use your data.
• The right to data portability — to receive your data in a portable format, or have it transferred to another provider.
• The right to object to processing based on our legitimate interests or to direct marketing.
• The right to withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, please contact us using the details in Section 5.

2.13 Complaints to the ICO

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the issue. You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. Details are at ico.org.uk, or by calling 0303 123 1113.

2.14 Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available on our website. Where changes are material, we will notify you by email or a prominent notice on the website before the changes take effect.