Privacy Policy
Effective from: [[TO BE COMPLETED: date of publication]]
1. Who we are
This Privacy Policy explains how we collect and use personal data when you visit www.spice4drink.co.uk, buy from our shop or contact us.
The data controller is Spice4Drink Ltd, Woodlands, Bindon Ln, Wareham, Dorset, BH20 6AS, United Kingdom.
- Company number: 09245604 (registered in England and Wales)
- Registered office: c/o SAS Accounting Service, 20 Beechwood Drive, Eaton, Congleton, Cheshire, CW12 2NQ, United Kingdom
- VAT number: GB 765 346 017
Contact for any privacy question: [email protected], phone +44 7881 33 90 90, or by post to the address above.
2. What data we collect
- Order data: name, delivery and billing address, e-mail address, phone number, products ordered, order value, payment status (we do not see or store your full card details — payments are handled by PayPal).
- Account data (if you create an account): login, password (stored encrypted), order history.
- Messages: data you give us in the contact form, by e-mail or by phone.
- Technical and usage data: IP address, browser and device information, pages visited, collected through cookies and similar technologies — see our Cookie Policy.
3. Why we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Processing and delivering your order, handling payments, returns and complaints | Performance of a contract (Article 6(1)(b)) |
| Running your customer account | Performance of a contract (Article 6(1)(b)) |
| Answering your messages and enquiries | Our legitimate interest in replying to you (Article 6(1)(f)); if your message concerns an order — contract (Article 6(1)(b)) |
| Keeping accounting and tax records | Legal obligation (Article 6(1)(c)) |
| Keeping the website secure, preventing fraud, defending legal claims | Legitimate interests (Article 6(1)(f)) |
| Website statistics (e.g. Google Analytics) | Your consent given in the cookie banner (Article 6(1)(a)) |
| Advertising and measuring advertising (e.g. Meta Pixel, Google advertising) | Your consent given in the cookie banner (Article 6(1)(a)) |
We only use statistics and advertising cookies after you agree to them. You can withdraw your consent at any time — see section 9.
Providing data for an order is necessary to conclude and perform the contract. Everything else is voluntary. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. How long we keep your data
- Order and invoice data: for 6 years after the end of the financial year in which the order was placed (accounting and tax rules).
- Customer account: until you close it; order records are then kept as above.
- Messages: up to 2 years after the matter is closed, unless they relate to an order or a claim.
- Data needed to defend legal claims: until the limitation period ends (usually 6 years in England and Wales).
- Cookie data: for the periods shown in the cookie table on our Cookie Policy page.
5. Who we share your data with
We share data only where needed for the purposes above, with service providers acting on our instructions (processors) or as independent controllers:
- Website hosting and maintenance: PostawSklep (IT Wsparcie Maciej Rymarz, Poland) and its server provider Ultradata (Poland).
- E-mail: OVH (France / EU).
- Website security and performance: Cloudflare, Inc. (USA / global network).
- Payments: PayPal — PayPal, card payments and PayPal Pay Later are processed by the PayPal company that provides the service to you, as an independent controller under PayPal’s own privacy notice.
- Delivery: UPS and any other carrier we use for your parcel.
- Cookie consent management: Usercentrics A/S (Cookiebot), Denmark.
- Analytics and advertising (only with your consent): Google (Google Analytics 4, Google Merchant Center / Google for WooCommerce, Google Ads), Meta Platforms Ireland Ltd (Meta Pixel, Facebook and Instagram product catalogue), Hotjar Ltd.
- Professional advisers: our accountant and, if necessary, lawyers.
- Public authorities (e.g. HMRC) where the law requires it.
We do not sell your personal data.
6. Transfers outside the UK
Some of our providers are based in Poland and other EEA countries. The UK recognises the EEA as providing adequate protection for personal data, so these transfers rely on the UK adequacy regulations.
Some providers (for example Google, Meta, Cloudflare) may process data in the USA. Where this happens, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework (for certified companies) or by the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about these safeguards.
7. Your rights
Under UK data protection law you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict how we use your data in certain circumstances;
- object to processing based on our legitimate interests, and object at any time to direct marketing;
- data portability (receive the data you gave us in a common electronic format);
- withdraw consent at any time — this does not affect processing carried out before the withdrawal.
To use any of these rights, contact us at [email protected]. We will reply within one month.
8. Complaints
If you are unhappy with how we use your data, please contact us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.
9. Cookies
We use cookies and similar technologies. Strictly necessary cookies are always active; other cookies are used only with your consent, which you give or refuse in our cookie banner. Details, the full list of cookies and the option to change your choice are on our Cookie Policy page. You can also change your cookie settings at any time.
10. Changes to this policy
We may update this Privacy Policy, for example when we add new services. The current version is always on this page, with the date it took effect.