Privacy notice

This policy explains what personal data Drinks21 Ltd collects, why we collect it, who we share it with, how long we keep it and what rights you have. We supply beer, cider, wine, sparkling wine and spirits to trade customers only. We do not sell alcohol to consumers, and we do not run a consumer shop.

1. Who we are

Drinks21 Ltd (“Drinks21”, “we”, “us”, “our”) is the data controller for the personal data described in this policy. We are registered in England and Wales under company number 7447825, and our registered office is 9 Queen’s Square, Ascot Business Park, Ascot, SL5 9FE, United Kingdom.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

For anything to do with your personal data or this policy, contact us at sales@drinks21.com or +44 1344 294 170, or write to us at the address above marked for the attention of the Data Protection Lead.

2. Who this policy covers

This policy applies to personal data about:

• people who work at our trade customers, prospective customers, suppliers, brand owners, carriers and warehouse operators, including the individuals who place, approve or receive orders;
• directors, partners, members and proprietors who apply for a credit account or give a personal guarantee;
• visitors to www.drinks21.com;
• anyone who contacts us by email, telephone or through our website, or who interacts with us on social media.

“Personal data” means information that identifies a living individual, either on its own or together with other information we hold. Business contact details are still personal data when they identify a person.

3. The personal data we collect

Data you give us

• Name, job title, employer, business email address, business telephone number and business address.
• Order and delivery details, including delivery addresses and contact details for the receiving site.
• Trade account application information, including company details, VAT number, AWRS Unique Reference Number, trade references and the details of the director, partner, member or proprietor who signs the application.
• Due diligence information we are required to collect about our customers and suppliers, including identity and licensing evidence.
• Correspondence with us, and any information you choose to include in it.

Data we collect automatically from our website

• IP address, browser type and version, operating system, referring page, the pages you view and how long you spend on them, and approximate location derived from your IP address.
• Information collected through cookies and similar technologies — see section 15.

Data we receive from others

• Information from credit reference agencies and fraud prevention agencies — see section 6.
• Information from public sources such as Companies House, the HMRC Alcohol Wholesaler Registration Scheme register, and sanctions and enforcement lists.
• Information from our group companies, carriers, warehouse operators and brand owners where it relates to an order or an account.
• Information from social media platforms where you interact with our pages, which those platforms handle under their own privacy policies.

Payment information

We do not store full card numbers or card security codes. Card payments are processed by third-party payment providers under their own security standards, and we receive only confirmation of payment and limited reference information. Most trade accounts settle by bank transfer, and in that case we hold the bank details needed to receive or make payment.

4. Why we use your personal data, and our lawful basis

We must have a lawful basis under the UK GDPR for everything we do with your personal data. Our purposes and bases are:

Supplying products and running the account

Quoting, accepting and fulfilling orders, arranging delivery and collection, handling claims, invoicing, taking payment and providing customer service.

Lawful basis: performance of a contract where you contract with us personally; otherwise our legitimate interests in supplying and administering the contract we hold with your employer, and in dealing with the individuals who act for it.

Assessing and managing credit

Deciding whether to offer a credit account, setting and reviewing credit limits, and recovering debts.

Lawful basis: our legitimate interests in assessing creditworthiness and protecting our position, and in some cases steps taken at your request before entering a contract.

Meeting our excise duty, customs and licensing obligations

Recording and evidencing duty-suspended and duty-paid movements, keeping the customer due diligence records HMRC requires of an alcohol wholesaler, and responding to HMRC and other authorities.

Lawful basis: compliance with a legal obligation.

Preventing fraud, bribery, money laundering and sanctions breaches

Screening customers, suppliers and the people who act for them, and making the checks and reports the law requires.

Lawful basis: compliance with a legal obligation, and our legitimate interests in preventing crime and in protecting our business.

Keeping you informed about our products

Sending price lists, product availability, new listings and trade offers to business contacts.

Lawful basis: our legitimate interests in marketing to trade customers and prospective trade customers. You can object at any time — see section 8.

Running and improving our website

Keeping the site secure and available, understanding how it is used and improving it.

Lawful basis: our legitimate interests in operating and improving our website; and your consent where cookies or similar technologies require it.

Running our business and protecting our legal position

Keeping accounting and tax records, managing insurance, taking advice, and bringing or defending claims.

Lawful basis: compliance with a legal obligation for statutory records; otherwise our legitimate interests in establishing, exercising or defending legal claims.

5. Where we rely on legitimate interests

Where we rely on legitimate interests, we have considered whether our interest is outweighed by the effect on you. You can ask us for details of that assessment, and you can object to processing based on legitimate interests — see section 13.

6. Credit accounts and credit reference agencies

Where you apply for a credit account, we may use an FCA-authorised third party to assess the application. That third party will share the information in the application with one or more credit reference agencies to verify identity and assess creditworthiness, and will check the details of the director, partner, member or proprietor who signs on behalf of the customer.

The credit reference agency records the search. Because the search is a quotation search, the footprint on that individual’s credit file is visible to them, to the agency and to the third party, but not to other lenders. The third party may carry out further searches at its discretion for twelve months from the initial search. Where a credit account is opened, details of the account and how it is conducted are shared with credit reference agencies.

Credit reference agencies and fraud prevention agencies are separate data controllers and will handle personal data under their own privacy information, which the third party will provide. Our Terms & Conditions of Sale deal with this at clause 6.

7. Excise duty, licensing and due diligence records

As an alcohol wholesaler we are required to carry out and record due diligence on our customers and suppliers, and to keep records of duty-suspended and duty-paid movements. This means we collect and retain information about the businesses we trade with and the individuals who act for them, and we may be required to disclose it to HMRC or other authorities. We cannot supply a customer who will not provide the information we are required to obtain.

8. Marketing and how to stop it

We send trade communications — price lists, availability, new listings and offers — to business contacts at companies we trade with or believe may wish to trade with us. We do not sell your details to anyone for their own marketing.

You can stop these at any time. Use the unsubscribe link in any email, reply asking us to stop, or email sales@drinks21.com. We will act on your request without delay and will keep a minimal record of it so that we do not contact you again by mistake. Stopping marketing does not stop the operational messages we need to send about an order or an account.

9. Who we share your personal data with

• Other companies in the Drinks21 group, for operational and administrative reasons.
• Bonded and general warehouse operators, freight forwarders, hauliers and couriers, so that goods can be stored, moved and delivered.
• Service providers acting on our instructions, including our IT and website providers, accounting and email providers, and payment providers.
• Credit reference agencies, fraud prevention agencies and, where necessary, debt recovery agents.
• Our professional advisers, including lawyers, accountants, auditors and insurers.
• HMRC and other regulators, government bodies and law enforcement agencies, where we are required or requested to provide information.
• A buyer or prospective buyer, if we sell or reorganise any part of our business, in which case we will require them to handle personal data in accordance with data protection law.

Where a provider acts on our instructions, we put a written contract in place requiring them to keep personal data secure and to use it only for the purposes we specify.

10. Sending personal data outside the UK

We hold stock in bonded warehouses in the United Kingdom and the Netherlands, and we supply customers in Ireland, the Netherlands, wider Europe, the Middle East, Africa and Asia. Some of our service providers are also based outside the United Kingdom. This means personal data may be transferred outside the UK.

Where that happens, we make the transfer only where the destination is covered by UK adequacy regulations, or under an approved transfer mechanism such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the transfer requires. You can ask us which mechanism applies to a particular transfer.

11. How long we keep personal data

• Order, invoice, accounting and VAT records: at least six years from the end of the financial year to which they relate.
• Excise, customs and due diligence records: for the duration of the trading relationship and at least six years afterwards, or longer where HMRC requires it.
• Trade account and credit application records: for the duration of the account and six years after it closes.
• Correspondence: generally up to six years, and longer where it relates to a matter that may give rise to a claim.
• Marketing contact details: until you ask us to stop or the contact is no longer current; records of objections are kept indefinitely so that we honour them.
• Website and cookie data: as set out in section 15, and in any event no longer than needed for the purpose.

Where we no longer need personal data, we delete it or anonymise it.

12. Keeping personal data secure

We use technical and organisational measures appropriate to the risk, including access controls, encryption in transit, and restricting access to those who need it for their work. We review those measures. No transmission over the internet is completely secure, so we cannot guarantee the security of data sent to us over the internet. Where you hold a password for any part of our systems, please keep it confidential and do not share it.

13. Your rights

Under data protection law you have the right to:

• Be informed about how we use your personal data — which is what this policy is for.
• Access the personal data we hold about you, and receive a copy.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — have your data deleted, where we no longer have grounds to keep it.
• Restrict processing — ask us to limit what we do with your data in certain circumstances.
• Object — to processing based on legitimate interests, and at any time to direct marketing.
• Data portability — receive data you gave us in a machine-readable form, where processing is based on consent or contract and carried out by automated means.
• Withdraw consent at any time, where we rely on consent. This does not affect anything done before you withdrew it.
• Not be subject to a solely automated decision with legal or similarly significant effects, except as the law allows.

To exercise any of these, email sales@drinks21.com. We will respond within one month. We may extend that by up to two further months where a request is complex or where there are several requests, and we will tell you if we do. We may ask you to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.

Some rights are limited. We may not be able to delete data we are required by law to retain — excise, customs and due diligence records in particular.

14. How to complain

If you are unhappy with how we have handled your personal data, tell us first at sales@drinks21.com, marking your message “Data protection complaint”. We will acknowledge your complaint within 30 days of receiving it, investigate it without undue delay, keep you informed and tell you the outcome.

You can also complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would be grateful for the chance to look into it first.

15. Cookies

Cookies are small files placed on your device when you visit a website. We use them to make the site work, to keep it secure, and to understand how it is used so that we can improve it.

• Strictly necessary cookies are needed for the site to function and to keep it secure. These do not require your consent.
• Analytics and performance cookies tell us how the site is used — which pages are viewed, for how long, and where visitors arrive from.
• Functional cookies remember choices you make, so the site behaves as you expect.

Cookies that are not strictly necessary are set only where the law allows, and we will ask for your consent where consent is required. You can change or withdraw your choice at any time, and you can block or delete cookies through your browser settings — though parts of the site may then not work properly.

16. Other websites and social media

Our website links to other sites and to our pages on social media platforms. We do not control how those organisations collect or use personal data, and this policy does not apply to them. Please read their own privacy policies.

17. Age

Our website and our business are directed at trade customers, not at the public and not at children. We do not knowingly collect personal data from anyone under 18. Alcohol is supplied only to businesses, and only for sale to people of legal drinking age in the destination market.

18. Changes to this policy

We may update this policy. The current version, its version number and its effective date are always shown at the top of this page. Where a change materially affects how we use your personal data, we will take reasonable steps to tell you.