Privacy policy

Privacy Policy

Wallow Wine Limited (trading as "Wineslut", referred to in this policy as "Wineslut", "we", "us", or "our") is committed to protecting and respecting your privacy.
Wineslut is the Data Controller of your personal data under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018"). Our store is hosted on Shopify, which provides us with the e-commerce platform that allows us to sell our products and services (the "Services") to you.
Please read this Privacy Policy carefully to understand how we collect, use, store, and disclose your personal data, and what your rights are in relation to your information.

1. Information We Collect About You
Under UK data protection law, "personal data" means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped as follows:

Identity Data: First name, last name, username or similar identifier, title, and date of birth (required for age verification).
Contact Data: Billing address, delivery address, email address, and telephone numbers.
Financial Data: Payment card details (processed securely via PCI-DSS compliant payment gateways; we do not store raw card numbers on our servers).
Transaction Data: Details about payments to and from you, and other details of products and services you have purchased from us.
Technical Data: Internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
Profile Data: Your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
Usage Data: Information about how you use our website, products, and services.
Marketing and Communications Data: Your preferences in receiving marketing from us and our third parties, and your communication preferences.

2. How We Collect Your Personal Data
We use different methods to collect data from and about you, including:

Direct Interactions: You provide us with your Identity, Contact, and Financial Data by filling in forms on our website, subscribing to our services, or by corresponding with us by post, phone, email, or otherwise.
Automated Technologies: As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies. Please see our Cookie Policy for further details.
Third Parties or Publicly Available Sources: We receive personal data about you from various third parties, including:
• Technical and transaction data from e-commerce platforms like Shopify.
• Identity, age, and verification status from our age-verification partner, OneID®.
• Technical Data from analytics providers (such as Google Analytics) and search information providers.
• Contact, Financial, and Transaction Data from payment processing and technical service providers.

3. Lawful Bases and How We Use Your Personal Data
We will only use your personal data when the law allows us to. Under the UK GDPR, we rely on the following lawful bases to process your personal data:
A. Performance of a Contract
We process your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.

Purpose: To register you as a new customer, process and deliver your order, manage payments, fees, and charges, and collect money owed to us.

B. Legal Obligation
We process your data where it is necessary for compliance with a legal or regulatory obligation to which we are subject.

Purpose: To verify your age (complying with the Licensing Act 2003 and the Online Safety Act), prevent financial fraud, and maintain corporate tax records.

C. Consent
We process your data where you have given us clear, positive consent.

Purpose: To send you direct marketing communications via email or SMS. You have the right to withdraw consent to marketing at any time by contacting us or clicking "unsubscribe".

D. Legitimate Interests
We process your data where it is necessary for our legitimate interests (or those of a third party), and your interests and fundamental rights do not override those interests.

Purpose: To study how customers use our products/services, develop our business, keep our website secure, prevent fraud, and run our administration.

4. Mandatory Age Verification (OneID®)
To comply with the Licensing Act 2003 and the UK Online Safety Act, we are legally required to verify that you are 18 years of age or older before completing any sale of alcohol.
To make this process secure and seamless, we have integrated OneID®, a government-certified digital identity provider.
How the OneID® Process Works
At checkout, you will be prompted to verify your age using one of three fast, digital paths. We do not require you to upload scans of physical documents (like passports) unless these digital methods fail:

Via Your Mobile Banking App (Recommended): You select your UK bank and log in securely. Your bank instantly confirms to OneID® that you are over 18. Wineslut never sees your banking details, balances, or credentials.
Via Your Mobile Number: You enter your UK mobile number and verify it with a one-time SMS passcode. OneID® checks your network provider's account data to confirm your age.
Via Credit Reference & Electoral Register Data: OneID® cross-references your name and address against UK Credit Reference Agencies and the Electoral Roll to confirm you are over 18 in the background.

Data Protection & Minimisation

Zero Retention: OneID® operates on a "zero data retention" policy. Neither OneID® nor Wineslut sees your personal credit scores, bank balances, or phone bills. OneID® simply passes an automated confirmation flag to us: "This user is over 18".
Regulatory Proof: We log successful verification events to prove compliance with statutory authorities (such as Trading Standards, local Licensing Authorities, or the Police) if legally requested.
No Marketing Abuse: Verification data is strictly used for legal compliance. It is never sold or shared with third-party marketing companies.

5. Sharing Your Personal Data
We may share your personal data with selected third parties for the purposes set out in Section 3:

Shopify: Our e-commerce platform host. Shopify processes personal data to power our storefront and checkout. For details, please see the Shopify Consumer Privacy Policy.
Service Providers: Third-party delivery couriers (to ship your order), payment processors (to securely process payments), and IT/system administration service providers.
Professional Advisers: Lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
Law Enforcement and Regulators: HM Revenue & Customs, licensing authorities, Trading Standards, or other authorities where we are legally required to report processing activities or verify our legal age compliance.
Corporate Transactions: Third parties to whom we may choose to sell, transfer, or merge parts of our business or assets.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

6. Third-Party Apps and Shopify Integrations
Our website integrates several third-party applications (available via the Shopify App Store) to enhance your shopping experience, manage your subscriptions, collect product reviews, and provide customer support.
When you interact with our website, these third-party apps may collect, store, or process your personal data (such as your Identity, Contact, Transaction, or Technical Data) directly on our behalf.
These include, but are not limited to:

Payment Gateways & Subscription Managers (to securely handle recurring orders).
Customer Support & Live Chat Widgets (to process your queries and customer service tickets).
Review & Feedback Platforms (to allow you to post and display public product reviews).
Analytics and Marketing Tools (to track website performance and show tailored advertisements).

All such third-party apps are contractually bound via Data Processing Agreements (DPAs) to protect your information, use it solely for the purpose of providing their service to us, and handle it in strict compliance with the UK GDPR.

7. International Data Transfers
As Shopify is a global platform, your personal data may be transferred to, stored, and processed outside of the United Kingdom (for example, in Canada or the United States).
Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government.
Where we use certain service providers, we may use specific contracts approved for use in the UK (the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses) which give personal data the same protection it has in the UK.

8. Data Security and Retention

8.1 Security: We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered, or disclosed. Access to your personal data is restricted to employees, agents, and contractors who have a business need to know.
8.2 Retention: We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.
By law, we must keep basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for six years after they cease being customers for UK tax purposes.

9. Your Legal Rights (UK GDPR)
Under UK data protection laws, you have rights in relation to your personal data. These include the right to:

Request Access: Receive a copy of the personal data we hold about you (commonly known as a "Subject Access Request").
Request Correction: Have any incomplete or inaccurate data we hold about you corrected.
Request Erasure: Ask us to delete or remove personal data where there is no good reason for us continuing to process it (subject to legal retention requirements).
Object to Processing: Object to the processing of your personal data where we are relying on a legitimate interest or using it for direct marketing.
Request Restriction: Ask us to suspend the processing of your personal data in certain scenarios.
Request Transfer: Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.
Withdraw Consent: Withdraw your consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of these rights, please contact us at hello@wineslut.co.uk. We aim to respond to all legitimate requests within one calendar month.

10. Third-Party Links
Our website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

11. Complaints
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

12. Contact Details
If you have any questions about this Privacy Policy or our privacy practices, please contact us:

Email: hello@wineslut.co.uk

Cookie Policy

Effective Date: 16 July 2026

This Cookie Policy explains how Wallow Wine Limited (trading as "Wineslut", referred to in this policy as "Wineslut", "we", "us", or "our") uses cookies and similar tracking technologies (such as pixels, beacons, and local storage) when you visit our website www.wineslut.co.uk.
We are committed to being transparent about how we process your data. In accordance with the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR (as amended by the UK Data (Use and Access) Act), we provide you with clear choices regarding the tracking technologies we use.

1. What Are Cookies and Similar Technologies?

Cookies: Small text files placed on your device (computer, smartphone, or tablet) when you visit a website. They help the website recognise your device and store information about your preferences or past actions.
Pixels and Web Beacons: Tiny graphics with a unique identifier, similar in function to cookies, used to track the online movements of web users or to find out when an email has been opened.
Local Storage: Technology that allows a website to store data directly on your device's browser, similar to cookies but with larger storage capacity.

2. How We Categorise Our Cookies
We group the cookies used on our website into four distinct categories:
A. Strictly Necessary Cookies (Always Active)
These cookies are essential for our website to function properly and cannot be switched off in our systems.

Purpose: They enable fundamental features such as secure user login, maintaining items in your shopping basket as you navigate the site, secure checkout processing, and fraud prevention.
Consent: Under UK law, these do not require your consent because they are strictly necessary to deliver the service you have requested.

B. Statistical & Performance Cookies (Active by Default / Simple Opt-Out)
These cookies collect aggregate, anonymous statistical data about how visitors interact with our website (for example, counting page visits and identifying traffic sources).

Purpose: To measure and improve the performance of our store.
Consent: In compliance with the UK Data (Use and Access) Act, these cookies are active by default because they do not track you across other websites or identify you personally. However, you have a right to object to this tracking at any time using our Cookie Consent Banner or preference center.

C. Functional & Appearance Cookies (Active by Default / Simple Opt-Out)
These cookies allow our website to remember choices you make (such as your preferred layout, accessibility settings, or region) to provide a more personalised experience.

Consent: Like statistical cookies, these are active by default under UK law to ensure the site displays correctly. You can disable them at any time using our preference center.

D. Marketing & Targeting Cookies (Strict Opt-In Required)
These tracking technologies (including the Meta/Facebook Pixel, Google Analytics advertising features, and Shopify marketing trackers) are set by our advertising partners.

Purpose: They build a profile of your interests to show you relevant advertisements for Wineslut products on other websites and social media platforms.
Consent: These cookies are blocked by default. They will not load or collect any data from your device unless you explicitly click "Accept" or toggle them "On" via our Cookie Consent Banner.

3. Third-Party Cookies set on our Store
Because our store is hosted by Shopify, and we use various third-party apps to handle reviews, subscriptions, and live chat, some of these partners set cookies directly on your device. These third parties include:

Shopify: To manage checkout sessions, security, and basic reporting.
Our Payment & Subscription Processors: To securely handle repeat orders and prevent transaction fraud.
Our Live Chat & Support Providers: To keep your chat history active as you browse.

For a full, up-to-date list of individual cookies, their lifespans, and their specific purposes, please open our Cookie Preference Center at any time.
4. How to Manage and Change Your Cookie Preferences
You have total control over the cookies we set on your device. You can manage them in the following ways:
Our Cookie Consent Banner
When you first visit our site, or if you clear your browser cookies, our Cookie Consent Banner will appear. You can:

Click "Accept All" to enable all tracking (including marketing).
Click "Reject Non-Essential" to instantly block all marketing and advertising cookies, keeping only strictly necessary, statistical, and appearance cookies active.
Click "Manage Preferences" to customize your choices on a category-by-category basis.

Your Browser Settings
You can also set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable or refuse strictly necessary cookies, please note that some parts of our store (such as the shopping basket and checkout) will not function correctly.
5. Updates to This Policy
We may update this Cookie Policy from time to time to reflect changes in the cookies we use, or to comply with updated regulatory guidance from the UK Information Commissioner’s Office (ICO).
Contact Us
If you have any questions about our use of cookies or how we protect your privacy, please email us at hello@wineslut.co.uk.

Effective Date: 16 July 2026