Privacy policy

PRIVACY POLICY

Last updated: September 2026

1. Who we are

This website is operated by Downton Distillery Limited, trading as Downton Distillery.

• Company name: Downton Distillery Limited
• Company number: 10946189
• Registered in: England and Wales
• Registered office: 48 Tregarvon Road, London, England, SW11 5QE
• Email: info@downtondistillery.com
• Downton Distillery Limited is the data controller responsible for the personal information described in this policy.

This policy explains what personal information we collect, why we use it, who we share it with, how long we retain it and the rights available to you under the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Personal information we collect

We may collect the following information:

• Your name, billing address and delivery address.
• Your email address and telephone number.
• Your customer account and subscription details.
• Information about orders, payments, pre-orders, refunds, returns and deliveries.
• Information provided when booking a tour, tasting, event or other experience.
• Communications you send to us, including emails, contact forms, reviews and customer-support enquiries.
• Messages and information submitted through Sir Walter, our AI chatbot.
• Your newsletter subscription and marketing preferences.
• Information about your interaction with our newsletters, including whether a message was delivered, opened or selected.
• Technical information, including your IP address, browser, device, operating system and session information.
• Information about the pages you view and how you interact with our website, chatbot and product recommendations.
• Cookie identifiers and similar information, subject to your cookie choices.
• Transaction, fraud-prevention and age-verification information supplied by payment and delivery providers.

We do not normally receive or store your complete payment-card details. Payments are handled by the payment provider selected at checkout.

1. How we collect information

We collect personal information:

• Directly from you when you place an order, create an account, subscribe, make a booking, join our mailing list, complete a form or contact us.
• Automatically when you use our website, subject to your cookie preferences.
• Through Shopify and applications connected to our Shopify store.
• From payment, delivery, fraud-prevention and age-verification providers.
• Through Klaviyo when you subscribe to or interact with our newsletters.
• Through Chatty when you use our chatbot or interact with proactive chat messages.
• From social media platforms when you communicate with us through those services.

1. How and why we use your information

Processing orders

We use your contact, order and delivery information to accept and process orders, collect payment, arrange delivery, issue order updates, process returns and refunds, and resolve problems.

• Lawful basis: performance of a contract and taking steps at your request before entering into a contract.

Subscriptions and pre-orders

We use your information to administer subscriptions, recurring payments, pre-orders, account changes, pauses and cancellations.

• Lawful basis: performance of a contract.

Delivery and age verification

We provide delivery companies with the information required to deliver your order, provide tracking and complete appropriate age checks.

• Lawful basis: performance of a contract, compliance with our legal obligations and our legitimate interest in preventing unlawful alcohol sales.

Bookings and events

We use booking details to manage tours, tastings, events and other experiences, including sending confirmations and important information about attendance.

• Lawful basis: performance of a contract.

Customer service

We use the information you provide to answer questions, manage complaints, resolve order or delivery problems and provide customer support.

• Lawful basis: performance of a contract or our legitimate interest in providing effective customer service.

Email marketing

We use Klaviyo to manage our newsletters and marketing communications.

• Klaviyo may process your name, email address, marketing preferences, purchase history and interactions with our emails.
• We use this information to send relevant news, product releases, event information and offers, and to understand the performance of our communications.
• We send marketing emails where you have consented or where the existing-customer exception under the Privacy and Electronic Communications Regulations applies.
• You can unsubscribe at any time by selecting the unsubscribe link in an email or contacting
• Lawful basis: consent or legitimate interests where electronic-marketing law permits.

Website operation and security

We use technical information to operate our website, maintain security, prevent fraud, diagnose faults and protect our customers and business.

• Lawful basis: our legitimate interests in providing a safe, secure and reliable ecommerce service.

Store performance and improvement

We do not use Google Analytics.

• Shopify provides information about store activity, transactions and website performance.
• We use this information to understand sales, maintain our website and improve the customer experience.
• Where this activity uses non-essential cookies or similar technologies, it will only take place after the required consent has been provided.
• Lawful basis: legitimate interests for essential business reporting and consent where non-essential technologies are used.

Accounting and legal compliance

• We retain and use information where necessary for accounting, taxation, regulatory, licensing, fraud-prevention and legal purposes.
• Lawful basis: compliance with our legal obligations and our legitimate interest in establishing, exercising or defending legal claims.

1. AI chatbot and customer support

Our website uses Chatty, an AI-powered chatbot and customer-support service. We call our chatbot Sir Walter.

When you use Sir Walter, Chatty may process:

• The messages you enter.
• Your name and contact details if you provide them.
• Relevant order information when you ask about an order.
• The pages you view on our website.
• Your IP address, browser, device and session information.
• Your interaction with chatbot messages and product recommendations.

We use this information to:

• Answer questions about Downton Distillery and our products.
• Recommend relevant products.
• Help with order tracking.
• Direct enquiries to a member of our team.
• Maintain customer-support history.
• Understand common customer questions and improve our service.

Chatty processes this information on our behalf. Chatty states that merchant and customer data is not sold or used for advertising.

Some answers are generated automatically using artificial intelligence and may contain errors. You can ask to speak to a person at any time.

Please do not enter payment-card details, passwords, health information or other sensitive personal information into the chatbot.

• Lawful basis: our legitimate interests in responding to enquiries and providing customer support. Where Chatty uses non-essential cookies or similar technologies to analyse behaviour or deliver proactive messages, we will obtain consent where required.

1. Payments

• Payments are processed through Shopify, Stripe or PayPal, depending on the payment method selected at checkout.
• We do not normally receive or store your complete payment-card details.
• The relevant payment provider processes payment information according to its own security standards and privacy policy.
• Payment providers may use personal information for payment processing, identity verification, fraud prevention, regulatory compliance and dispute handling. They may act as independent data controllers for some of these activities.

1. Who we share information with

We may share personal information with:

• Shopify, which provides our e-commerce platform, customer accounts and store reporting.
• Stripe and PayPal, which process payments.
• Royal Mail, FedEx and other delivery providers used to fulfil orders, provide tracking and conduct appropriate age checks.
• Klaviyo, which manages newsletters and marketing communications.
• Chatty, which provides our AI chatbot, live chat and customer-support tools.
• Technology providers that host, secure, maintain or support our website and business systems.
• Professional advisers, including accountants, insurers and legal advisers.
• Regulators, licensing authorities, law-enforcement bodies, government departments and courts where disclosure is required or permitted by law.
• A purchaser, successor or adviser involved in a sale, transfer or reorganisation of the business or its assets.

Some providers act as processors on our instructions. Others may act as independent controllers for parts of their services.

• We do not sell personal information.

1. International transfers

Some of our service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we take steps to ensure that an appropriate legal safeguard is in place. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful transfer mechanism.

You may contact us for further information about the safeguards relevant to your personal information.

1. How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

Our normal retention periods are:

• Order, invoice, transaction and accounting records: six years after the end of the relevant financial year, or longer where legally required.
• Customer-service correspondence: normally up to three years after the enquiry has been resolved.
• Customer account information: while the account remains active and for a reasonable period after it is closed.
• Subscription information: for the duration of the subscription and afterwards where required for financial, contractual or legal records.
• Tour, tasting and event bookings: for as long as needed to administer the booking and meet accounting or legal requirements.
• Marketing information: until you unsubscribe, withdraw consent or remain inactive for a period that makes continued contact unreasonable.
• Unsubscribe and suppression records: for as long as necessary to ensure that we continue to respect your request.
• Chat and customer-support history: for as long as reasonably required to provide support, maintain service records and resolve disputes.
• Cookie and similar technology information: for the periods shown in our cookie settings or Cookie Policy.

We may retain information for longer where necessary to resolve a dispute, respond to a legal claim, prevent fraud or comply with a legal obligation.

1. Cookies and similar technologies

We use cookies and similar technologies to operate the website, maintain customer sessions, remember choices, process orders, understand website use and support customer communications.

Strictly necessary technologies may operate without consent where legally permitted.

We will ask for consent before using analytics, behavioural, advertising or other non-essential technologies where consent is required.

You can accept, reject or manage non-essential technologies through our cookie settings. You can change your choices at any time.

Withdrawing consent does not affect processing that took place before consent was withdrawn.

Further information about the technologies used, their providers, purposes and duration should be provided through our cookie settings or separate Cookie Policy.

1. Marketing choices

You can stop receiving marketing emails at any time by:

• Selecting the unsubscribe link in a marketing email.
• Changing your communication preferences where that facility is available.
• Emailing info@downtondistillery.com.
• Unsubscribing from marketing will not prevent us from sending essential communications about an order, delivery, subscription, booking or customer-service enquiry.

1. Security

We use appropriate organisational and technical measures to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure.

Access to personal information is restricted to people and service providers who require it for legitimate business purposes.

If we identify a personal-data breach, we will investigate it and notify affected individuals and the Information Commissioner’s Office where legally required.

1. Your rights

Depending on the circumstances, you may have the right to:

• Request access to your personal information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete personal information.
• Ask us to restrict how personal information is used.
• Object to processing based on legitimate interests.
• Object to direct marketing at any time.
• Receive certain information in a portable format.
• Withdraw consent at any time where processing relies on consent.
• Complain to the Information Commissioner’s Office.

These rights are not absolute. For example, we may need to retain order and transaction records to meet taxation, accounting or legal obligations.

To exercise any of these rights, email info@downtondistillery.com.

We may need to request information to confirm your identity before completing your request.

1. Automated processing

Sir Walter uses artificial intelligence to generate responses and product suggestions.

We do not use solely automated decision-making that produces legal effects or similarly significant effects for customers.

A member of our team can review a chatbot conversation or decision where required.

1. Children and alcohol sales

Our website and products are intended for people aged 18 or over.

We do not knowingly sell alcohol to anyone under 18. We may use age-verification measures during checkout or delivery and may refuse or cancel an order where the age requirements are not satisfied.

We do not knowingly collect personal information from children through our online store or marketing services.

1. External links

Our website may contain links to websites operated by other organisations.

Their privacy policies govern how they collect and use personal information. We are not responsible for the privacy or security practices of third-party websites.

1. Complaints

Please contact us first if you have concerns about how we use your personal information:

Email: info@downtondistillery.com

You also have the right to complain to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/

1. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change.

We will publish the revised policy on this page and change the “last updated” date. Where a change materially affects how we use personal information, we will provide an additional notice where appropriate.