Privacy Policy

We also obtain personal data from publicly accessible sources, including Companies House, the electoral register where applicable, public registers and publicly available business directories and websites.

Information obtained from third party and publicly accessible sources may include identity information, contact information, payment history, credit-related information, public record information and information used for identity verification.

4. How We Use Your Personal Data and Our Lawful Base

We process personal data only where we have a lawful basis to do so. The table below sets out the purposes for which we process personal data and the lawful basis on which we rely for each purpose.

Where we rely on consent, you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

5. Our Legitimate Interests

Where we rely on legitimate interests, we carry out a legitimate interests assessment to balance those interests against your rights and freedoms. Those interests are:

• establishing, maintaining and developing our relationships with customers, suppliers and business contacts;
• operating, administering and improving our business and our products and services;
• delivering goods safely, efficiently and to the correct location;
• providing training and support services to our customers and improving those services;
• assessing and managing credit risk and recovering sums owed to us;
• protecting the security of our people, premises, vehicles, stock, systems and assets;
• preventing and detecting fraud, theft, financial crime and misuse of our services;
• promoting our products and services to existing and prospective business customers;
• internal reporting, planning and management of our business; and
• establishing, exercising or defending legal claims.

6. Special Category and Criminal Offence Data

We do not routinely collect special category data or criminal offence data.

We may, however, come to hold a limited amount of such data, for example where an incident or accident record at our premises or during a delivery includes information about a person’s health, or where information relating to alleged or suspected offences arises in connection with the security of our premises, our vehicles or our stock.

We may also hold a limited amount of health data where you tell us about a dietary requirement, allergy or accessibility requirement in connection with a training session or event.

Where we process this data, we do so only where it is necessary for the purpose concerned, only where an applicable condition for processing under the UK GDPR and the Data Protection Act 2018 is met, and subject to additional safeguards, including restricted access and limited retention.

7. Providing Your Personal Data

Where you open or operate a trade account, place orders or receive deliveries, we need certain personal data to enter into and perform our contract with you or your organisation. We also require some personal data to comply with legal obligations, including those relating to age-restricted products, taxation, accounting and health and safety.

If you do not provide the personal data we request, we may be unable to open or maintain an account, process orders, make deliveries or provide our goods and services.

8. Age-Related Legal Requirements

We supply alcohol and other age-restricted products to trade customers. We are subject to legal obligations relating to the sale and delivery of those products, and we process personal data in order to meet them.

This may include recording that an age-related check has been carried out and by whom, recording refusals and related incidents, and recording confirmation that goods were delivered to an appropriate person at the delivery address. We may also need to confirm that attendees at tasting sessions are aged 18 or over. We do not retain copies of identity documents for this purpose.

Our website, products and services are directed at businesses in the trade and are not in any way directed at children.

9. Credit Reference and Identity Verification

Where an application is made for trade credit, we may obtain information from credit reference agencies and identity verification providers in order to assess the application, verify identity and manage the account.

Where the applicant is an incorporated company, the search relates to the company. Personal data is involved only to the extent that information is obtained about named directors, principals or guarantors connected with the application.

Where the applicant is a sole trader or an unincorporated partnership, the applicant is an individual, and the search may include consumer credit information relating to that individual.

Where applicable, we obtain this information through Creditsafe Business Solutions Limited, which uses its data partner TransUnion International UK Limited to supply consumer credit and identity data, together with other authorised data sources.

Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority under firm reference number 742313.

TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority under firm reference number 737740.

Authorisation can be checked on the Financial Services Register at www.fca.org.uk.

The information obtained may include:

• Identity and verification information
• Address verification information
• Payment history
• Credit commitments
• Financial reliability information
• Insolvency information
• Public record information
• Information relevant to assessing creditworthiness and affordability

We may use this information to:

• Assess applications for trade credit facilities
• Verify identities
• Manage customer accounts and credit limits
• Support debt recovery activities
• Comply with legal and regulatory obligations

Credit reference agencies and identity verification providers act as independent controllers in respect of the personal data they hold and the searches, they carry out. They are responsible for their own processing of that data and for providing information to individuals about it.

Credit reference information forms part of our assessment process but does not by itself determine whether credit facilities are approved. Applications are reviewed by authorised staff before a decision is made.

Further information can be found in the privacy notices of:

• Creditsafe Business Solutions Limited Product Privacy Notice: https://www.creditsafe.com/gb/en/legal/transparency-notice-product.html
• TransUnion International UK Limited: https://www.transunion.co.uk/legal/privacy-centre/pc-bureau
• Where a search relates to a sole trader or an unincorporated partnership, further information about how credit reference agencies use personal data is available in the Credit Reference Agency Information Notice (CRAIN) at https://www.transunion.co.uk/crain.

10. Marketing Communications

We may send you information about our products, services, promotions, events and industry updates.

Where you are a corporate subscriber, which includes incorporated companies and limited liability partnerships, we may send marketing by electronic means on the basis of our legitimate interests.

Where you are a sole trader or a member of an unincorporated partnership, you are an individual subscriber. In that case we send marketing by electronic means, including email and text message, either with your consent or, where you are an existing customer and the marketing relates to our similar products and services, in reliance on the soft opt-in.

Every marketing message we send includes a means of opting out.

You have the right to object at any time to the processing of your personal data for direct marketing purposes, including any profiling related to that marketing. If you object, we will stop processing your personal data for those purposes.

You can opt out of marketing communications at any time by:

• Clicking the unsubscribe link in our emails; or
• Contacting us using the details provided in this Privacy Notice.

Opting out of marketing communications will not affect service-related communications that are necessary for managing your account or fulfilling our contractual obligations.

11. Cookies and Similar Technologies

Our website uses cookies and similar technologies to:

• Operate the website and online ordering services;
• Improve website performance;
• Understand how visitors use our website;
• Protect website security; and
• Support marketing activities where permitted.

We set non-essential cookies only with your consent, which you may withdraw at any time. Further information, including details of the cookies we use and how you can manage your preferences, can be found in our Cookie Policy.

12. Deliveries and Collections

This section covers situations when we deliver stock to your premises, and when you come to one of our depots to deliver or collect stock.

When We Deliver to You

We record proof of delivery, which includes the name and signature of the person accepting the delivery and photographs of the goods at the delivery location. Our vehicles are fitted with cameras, and this footage may incidentally capture people and premises at or near the delivery point.

We do this to confirm that goods were delivered, to protect our people, vehicles and stock, to investigate incidents and disputes, and to deal with legal and insurance claims. We rely on our legitimate interests in these purposes. Access is restricted to authorised staff, and camera footage is kept for a short period only unless it is needed for an incident or claim.

When You Visit Our Depots

If you come to a depot as a driver or representative of a supplier, carrier or collection partner, we record who attended, when, and what was delivered or collected. Your vehicle registration may be recorded automatically on entry, and loading and unloading areas are covered by CCTV, so you may be filmed while on site.

We do this to control access to the site, to manage safe loading and unloading, to keep an accurate record of stock movements, and to investigate incidents, losses and discrepancies. We rely on our legitimate interests in the security of our premises, people and stock and in managing our supply chain properly, and on our health and safety obligations.

13. Training and On-Site Support Services

We provide training and support services to our customers free of charge, including wine, cask ale and cocktail training and support on range selection, wine list construction and cask systems. These are delivered either in the training suites at our depots or at your premises.

The personal data we collect is set out in section 3. We use it to arrange and deliver the session, manage attendance, make any adjustments you have asked for, issue and evidence any certification, meet our health and safety obligations, obtain feedback and provide continuing support to your business. We do so on the basis of our legitimate interests in providing and improving these services and, where applicable, to meet our health and safety obligations. Photographs and recordings are used for promotional purposes only with your consent, which you may withdraw at any time.

Where a session is accredited or delivered with a third party, we may share your details with the relevant training or awarding body to register you, arrange assessment and issue any qualification. Those bodies act as independent controllers, and we will tell you before your details are shared in this way.

Some sessions involve tasting alcohol, and we may need to confirm that attendees are aged 18 or over before they take part (see section 8).

14. CCTV, ANPR and Site Security

We use CCTV at our sites, offices and depots to protect our people, visitors, premises, vehicles and stock, to prevent and detect crime, to manage health and safety, and to investigate incidents. Signs are displayed at all premises where CCTV is in use. Some premises also use automatic number plate recognition to manage and record vehicle access, which means a vehicle registration may be linked to the driver or operator concerned.

We rely on our legitimate interests in these purposes and, where relevant, on our health and safety obligations. Records are held securely, access is restricted to authorised staff, and footage is kept for a limited period unless it is needed for an incident, investigation, insurance claim, legal claim or a request from law enforcement.

15. Who We Share Personal Data With

We may share personal data with:

• IT service providers
• Website and hosting providers
• Ecommerce platform providers
• Payment processors
• Banking providers
• Delivery and logistics providers
• Marketing service providers
• Analytics providers
• Credit reference agencies
• Identity verification providers
• Training and awarding bodies
• Professional advisers
• Auditors
• Insurers
• Debt recovery providers
• Regulatory and licensing bodies
• Law enforcement agencies
• Courts and public authorities where required by law
• Other organisations involved in a merger, acquisition, restructuring or sale of assets

Where third parties process personal data on our behalf as processors, we put a written contract in place requiring them to protect the personal data appropriately and to process it only on our instructions and for authorised purposes. Certain recipients, including credit reference agencies, identity verification providers, banking providers, training and awarding bodies, professional advisers, insurers, regulators and law enforcement agencies, act as independent controllers in respect of the personal data they receive.

16. International Transfers

Most of our processing activities take place within the United Kingdom.

Where personal data is transferred outside the United Kingdom, we ensure that the transfer is made in accordance with applicable data protection law and that appropriate safeguards are in place. Depending on the recipient and the destination, we rely on one or more of the following:

• adequacy regulations made by the Secretary of State in respect of the receiving country, territory, sector or organisation;
• the International Data Transfer Agreement (IDTA) issued by the Information Commissioner;
• the International Data Transfer Addendum to the EU Standard Contractual Clauses;
• any other transfer mechanism recognised under applicable data protection law; or
• a derogation for a specific situation, where no other mechanism is available and the conditions for that derogation are met.

Where we rely on a transfer mechanism other than adequacy regulations, we carry out a transfer risk assessment and put in place any additional measures identified as necessary to protect the personal data.

17. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected.

Retention periods vary depending on the type of information involved. In determining the appropriate retention period, we consider:

• how long the personal data is needed for the purpose for which it was collected, including the duration of the account, contract or business relationship;
• any minimum or maximum retention period specified by law or regulation, including tax, accounting, licensing and health and safety requirements;
• the limitation periods within which legal claims may be brought, and whether the personal data may be needed to establish, exercise or defend such a claim;
• the nature and sensitivity of the personal data and the risk of harm from unauthorised use or disclosure;
• whether the purpose can be achieved by other means, including by holding the data in anonymised form; and
• any applicable guidance issued by regulators or industry bodies.

We maintain a retention schedule setting out the retention periods that apply to each category of record, when personal data is no longer required, it is securely deleted, destroyed or anonymised.

18. Information Security

We implement appropriate technical and organisational security measures to protect personal data.

These measures include:

• Role-based access controls
• Password protection
• Encryption where appropriate
• Secure systems and networks
• Staff training
• Physical security controls
• Secure disposal procedures
• Incident management processes

We keep these measures under review and update them as necessary to reflect the risks presented by our processing.

19. Profiling and Decision-Making

We may use information obtained from credit reference agencies, identity verification providers and our own records to support decisions relating to trade credit applications, account management and the prevention of fraud.

This may include the use of credit scores, risk indicators, affordability information and other assessment tools to assist our review processes.

LWC does not make decisions producing legal effects, or similarly significant effects, on individuals based solely on automated processing.

Any decision to approve, refuse, restrict or amend a credit facility is reviewed before it is made by a member of staff who has the authority and the competence to consider the wider circumstances, to take account of any additional information provided and to depart from or override the outcome indicated by any score, indicator or assessment tool.

The information generated by these tools assists our decision-making but does not determine the outcome. Individuals are therefore not subject to automatic refusals, restrictions or other significant decisions made solely by automated means.

20. Your Rights

You may have the following rights in relation to your personal data:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object, including the right to object at any time to direct marketing
• The right to withdraw consent where consent is relied upon

These rights are not all absolute. Whether a particular right applies, and the extent to which it applies, depends on the lawful basis on which we are processing your personal data and the circumstances of the request.

To exercise any of these rights, please contact us using the contact details provided in this Privacy Notice. We may ask you to verify your identity before responding to a request, and we may ask you to clarify a request where it is not clear what information you are seeking.

We will respond without undue delay and in any event within one month of receiving a valid request. Where a request is complex or where we have received a number of requests from you, we may extend that period by up to two further months. We will tell you within one month if an extension applies and why.

There is normally no charge for exercising your rights. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse to act on the request. We will explain our reasons if we do so.

21. Complaints

A data subject who is dissatisfied with how we have handled their personal data or their request has the right to make a complaint to LWC under sections 164A and 164B of the Data Protection Act 2018. We will facilitate the making of complaints, acknowledge a complaint within 30 days of receiving it, take appropriate steps to respond, and inform the complainant of the outcome without undue delay.

This is in addition to the data subject’s right to lodge a complaint with the Information Commissioner’s Office and to seek a judicial remedy.

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

22. Third-Party Websites

Our website may contain links to third-party websites.

We are not responsible for the privacy practices, content or security of those websites. We recommend reviewing the privacy notices of any third-party websites you visit.

23. Employees, Workers and Job Applicants

This Privacy Notice does not apply to personal data we process about our employees, workers, contractors or job applicants.

Applicants and candidates should refer to our recruitment privacy notice, which is provided separately as part of the recruitment process. Employees, workers and contractors are provided with a separate internal privacy notice.

24. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our processing activities, legal obligations or business operations.

Any updates will be published on this page and, where appropriate, communicated to affected individuals.

25. Contact Us

Data Protection Team
LWC Drinks Limited
Greenside Way
Chadderton
Manchester
M24 1SW
Email: [email protected]

If you have any questions about this Privacy Notice or how we process personal data, please contact us using the details above.

For more on how Google uses data, see Google’s Business Data Responsibility Site.