Privacy policy

Privacy Policy

Last updated: 2 March 2026

This Privacy Policy explains how threeridingswhisky.com (the “Site”) collects, uses and protects your personal data when you visit our website, make a purchase, or otherwise interact with us.

The Site is owned and operated by:

Ellers Farm Distillery Limited
Company number: 12937552
Buttercrambe Road
Stamford Bridge
York
YO41 1AR
United Kingdom

For the purposes of UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Ellers Farm Distillery Limited is the data controller of your personal data.

1. The Personal Data We Collect

We collect personal data in the following ways:

A. Information You Provide to Us

When you place an order, create an account, subscribe to marketing communications or contact us, we may collect:

  • Full name
  • Billing and delivery address
  • Email address
  • Telephone number
  • Payment details (processed securely via our payment providers)
  • Order history

  • Customer service correspondence

We require this information to fulfil our contract with you and provide our services.

B. Information Collected Automatically

When you visit the Site, we automatically collect certain technical information, including:

  • IP address
  • Browser type and version
  • Device type
  • Time zone
  • Pages viewed
  • Products viewed
  • Search terms
  • Referring website
  • Interaction data (clicks, browsing behaviour)

This information is collected using cookies and similar technologies and is used to:

  • Ensure the Site functions correctly
  • Improve performance and usability
  • Analyse customer behaviour
  • Prevent fraud

C. Age Verification

As a retailer of alcohol, this Site is intended only for individuals aged 18 or over. We may process information relating to age verification in order to comply with legal obligations relating to the sale of alcohol in the United Kingdom.

We do not knowingly collect personal data from individuals under 18.

2. How We Use Your Personal Data

We use your personal data to:

  • Process and fulfil orders
  • Take payment and arrange delivery
  • Communicate with you regarding your order
  • Provide customer support
  • Prevent fraudulent transactions
  • Improve our website and services
  • Send marketing communications (where you have consented or where permitted by law)

3. Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

  • Contractual necessity – to fulfil orders and provide services
  • Legal obligation – including compliance with alcohol sales laws and financial regulations
  • Legitimate interests – to improve our services, prevent fraud and operate our business effectively (provided these do not override your rights)
  • Consent – for email marketing and certain cookies

You may withdraw consent at any time where processing is based on consent.

4. Marketing Communications

If you subscribe to our marketing communications, we may send you information about new products, releases, offers and events.

You can unsubscribe at any time by:

We comply with the Privacy and Electronic Communications Regulations (PECR).

5. Sharing Your Personal Data

We share personal data only where necessary to operate our business.

Shopify

Our online store is hosted by Shopify. Shopify provides the e-commerce platform that enables us to sell our products to you. Your data is stored securely via Shopify’s data storage and databases.

You can read Shopify’s privacy policy at: https://www.shopify.com/legal/privacy

Service Providers

We may share personal data with trusted third parties, including:

  • Payment processors
  • Delivery and logistics providers
  • IT and website service providers
  • Marketing platforms
  • Fraud prevention services

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

Legal Requirements

We may disclose your personal data if required to do so by law, regulation, court order or governmental authority, or to protect our legal rights.

6. International Transfers

Some of our service providers (including Shopify) may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

  • UK International Data Transfer Agreements (IDTAs)
  • Adequacy regulations
  • Standard contractual clauses

7. Behavioural Advertising and Analytics

We use analytics and advertising tools to understand how visitors use our Site and to provide relevant marketing.

Google Analytics

We use Google Analytics to help us understand website usage. Google may process data in accordance with its own privacy policy:
https://policies.google.com/privacy

You can opt out of Google Analytics here:
https://tools.google.com/dlpage/gaoptout

Targeted Advertising

We may share limited information about your browsing activity with advertising partners through cookies or similar technologies in order to provide relevant advertising.

You can control advertising preferences via:

  • Facebook Ads Settings
  • Google Ads Settings
  • Your browser cookie controls

8. Automated Decision-Making

We do not engage in fully automated decision-making that produces legal or similarly significant effects.

Our e-commerce platform may use limited automated systems to detect and prevent fraudulent transactions (for example, temporary IP or card denylisting). These systems do not produce significant legal effects.

9. Data Retention

We retain personal data only for as long as necessary to:

  • Fulfil orders
  • Comply with legal, accounting and regulatory obligations
  • Resolve disputes
  • Enforce our agreements

Order data is typically retained for at least six years to comply with UK tax and accounting requirements.

10. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request erasure of your personal data
  • Restrict processing
  • Object to processing based on legitimate interests
  • Request transfer of your data to another provider
  • Withdraw consent at any time (where applicable)

To exercise your rights, please contact:
info@threeridingswhisky.com

11. Cookies

A cookie is a small file stored on your device when you visit our Site. We use cookies to:

  • Enable essential website functionality
  • Remember preferences
  • Analyse website traffic
  • Support marketing activity

Cookies may be “session” cookies (which expire when you close your browser) or “persistent” cookies (which remain for a defined period).

You can manage cookie preferences via your browser settings or through our cookie banner. Please note that disabling certain cookies may affect website functionality.

12. Do Not Track

There is currently no consistent industry standard for responding to “Do Not Track” signals. As such, we do not alter our practices in response to such signals.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect operational, legal or regulatory changes. The latest version will always be available on this page.

14. Complaints

If you have concerns about how we handle your personal data, please contact us in the first instance.

You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office
https://ico.org.uk/make-a-complaint/