Privacy Policy (UK GDPR)

1. Data Controller Information

Southwest Spirits is the data controller responsible for your personal information. If you have any inquiries regarding data protection, you may contact us at:

Southwest Spirits
8 Woodway Terrace, Kingston Way, Mabe Burnthouse, TR10 9FA, United Kingdom
Email: contact@southwestspirits.co.uk

2. Personal Data We Collect

• Consignors & Sellers: Name, email address, telephone number, residential address (for generating automated Evri drop-off and collection labels), photographic bottle submissions, and bank details for consignment payout disbursements.
• Purchasers & Buyers: Name, email address, UK shipping address, and age verification confirmation. Payment card numbers are collected and processed directly by Stripe and are never stored on our servers.
• Website Visitors & Affiliates: Device identifiers, IP addresses, and referral identifiers (stored via a 30-day first-party cookie sws_ref to attribute community Facebook group partner commissions).

3. Legal Bases for Processing

We process personal data only when lawful under UK GDPR Article 6:

• Performance of Contract: To catalogue, publish, insure, transport, and complete the sale and payout of consigned spirits.
• Legal Obligation (Licensing Act 2003 & HMRC): Under UK licensing law, alcohol cannot be sold to anyone under 18. We maintain age verification records and retain transaction logs for statutory accounting and excise obligations.
• Legitimate Interests: To detect and prevent fraudulent transactions, prevent counterfeit spirits from entering the secondary market, and operate community referral partnerships.

4. Third-Party Service Providers

We share data strictly with trusted service providers under written data processing terms:

• Stripe Payments UK: PCI-DSS Level 1 certified payment gateway.
• Zoho Mail: Encrypted European transactional email infrastructure for order receipts, tracking codes, and status notifications.
• Couriers (Evri, Royal Mail, Parcelforce): Necessary name and address details are transmitted to generate tracked shipping labels and execute age-verified, signed-for deliveries.

5. Data Retention

We retain sales, consignment, and licensing compliance records for six (6) years following the financial year of the transaction to satisfy UK HMRC and licensing authority statutory requirements.

6. Your Statutory Rights

Under UK data protection laws, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate personal data.
• Request erasure of your data where no overriding statutory or legal retention obligation exists.
• Object to or restrict certain processing activities.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO) at ico.org.uk.