The Company may collect personal data about you from third parties or public sources. The personal data about you collected from such third parties and public sources includes the following information:

The purposes for which we may process all of the above personal data - and the legal basis on which we perform such processing - are:

You can object to the use of your personal data at any time but this may restrict the services we can continue to offer you.

We may disclose your personal information to service providers who process data on our behalf in the course of providing services to the Company, including:

• Warehousing and delivery services;
• Direct marketing companies and mailing houses who help us manage our electronic and mailed communications;
• IT companies who support our website and other business systems;
• Banks and payment processors;
• Identification verification services to prevent or detect crime in compliance with current regulations;
• Data cleansing service providers to ensure your data is accurate;
• Third party debt collection agencies.

These service providers are required to use your personal data in accordance with our instructions, to take appropriate security measures and to protect your personal data in line with our policies. It is our policy to not allow service providers to use your personal data for their own purposes.

In some contexts, we may disclose the personal data to the following controllers who will be directly responsible under data protection law for protecting the personal data:

• the Company’s legal adviser for the purposes of providing legal advice to the Company;
• the Company's auditor for the purpose of providing audit services to the Company;
• HM Revenue & Customs and other regulatory bodies if we are under a duty to disclose or share your personal data in order to comply with any legal obligation.

We may also pass on your details to our wine producers & suppliers so they may invite you to events from time to time if you consent to this.

The personal data that the Company processes about you may be transferred to one or more countries outside the European Economic Area ("EEA") that have not been deemed by the European Commission to offer adequate data protection. For example, we may pass your information to our overseas branch in Singapore and our subsidiary in Hong Kong because the South East Asia Sales Team needs access to the entire Company customer database in order to transact business with their own EEA-based customers.

The Company is committed to ensuring that adequate safeguards are in place to protect any of your personal data that is transferred to the Company’s branch in Singapore and its subsidiary Corney and Barrow Hong Kong Ltd. In order to establish a legal framework under which such safeguards can be set up, the Company has entered into contracts with both the Singapore branch and the Hong Kong subsidiary using Model Contract Clauses as approved by The European Commission. The Company’s Head Office in London directs all policies and processes that are carried out by all office locations so your data receives the same protection as if it were being processed inside the EEA. The Company’s Head Office in London also manages and controls the technical and organisational security throughout the business (further details of these controls can be seen in the next section below). If you wish to obtain a copy of these safeguards, please contact the Company at the address below.

We also use the services of direct marketing companies who help us manage our electronic communication. The direct marketing company that we use is self-certified and registered under the EU-US Privacy Shield Framework which provides both sides of the Atlantic with a mechanism to comply with data protection requirements when personal data is transferred from the EU to the US. If you wish to see details of the Privacy Shield Principals please contact the Company at the address below.

We know how much data security matters to all our customers. With this in mind we will treat your data with the utmost care and take all appropriate steps to protect it. We use security technology for establishing encrypted links between Hong Kong and Singapore. We secure access to all transactional areas of our websites using ‘https’ technology. Access to your personal data is password protected, and sensitive data (such as card payment information) is secured and tokenised to ensure it is protected. We regularly monitor our system for possible vulnerabilities and attacks, and we carry out penetration testing to identify ways to further strengthen security. If you wish to obtain a copy of our IT General Controls, please contact the Company at the address below.

We do not envisage that any decisions will be taken about you using automated means. In the event that this position changes, we will notify you in writing.

Personal data is stored for varying lengths of time depending on the nature and purpose for which it was collected. In any case personal data will be retained for only as long as is necessary for the purpose for which it was collected subject to any statutory minimum periods. We review the personal data held by us periodically to ensure it is held in line with our data protection policies

To determine the appropriate retention period for your data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data and whether we can achieve the purpose of the processing through other means. Our retention of your personal data - and the criteria we apply to determine how long it is necessary for us to retain your personal data - is kept under review.

Some examples of data retention periods:

Orders and Wine in Reserve

When you open an account with the Company, we will hold your personal data for the duration of the relationship with you and for as long as we hold your wine in our reserve plus an additional period; the additional period would be the date of the last order or period of storage plus seven years so we can comply with our legal and contractual obligations.

Dormant Accounts

If you do not place an order, you do not use our wine storage service and you cease to interact with us for a 24 month period, we will consider your account to have become dormant at that point.

Where we have obtained your consent to process your data i.e. for direct marketing purposes but you cease to interact with us and your consent goes cold over the passage of time i.e. you do not place an order with us for a 24 month period we will consider your account to have become dormant at that point.

At the end of a retention period, if your account becomes dormant or if you ask us to stop processing your data and close your account, your data will either be deleted completely or anonymised.

In certain circumstances, under the GDPR, you will have the right to:

• request access to your personal data;
• request rectification of your personal data if it is inaccurate or incomplete;
• restrict the processing of your personal data (for example, if you want the Company to establish its accuracy or the reason for processing it);
• object to your personal data being processed;
• lodge a complaint with a supervisory authority;
• withdraw your consent to the processing, in the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose. Once the Company have received notification that you have withdrawn your consent, they will no longer process your information for the purpose or purposes you originally agreed to, unless they have another legitimate basis for doing so in law. Please note that the withdrawal of your consent will not affect the lawfulness of any processing of personal data based on your consent before it is withdrawal

If you would like to access, rectify or request deletion of your personal data, object to the processing of your personal data, or withdraw your consent to processing (if applicable), please contact the Company in writing by emailing us at [email protected] or to the following address:

Customer Maintenance Department
Corney & Barrow Ltd
1 Thomas More Street
London E1W 1YZ

We will respond to your request within 28 days from the day after receiving your request and if for any reason we cannot get the information to you in that time frame, we will contact you.

We want to make sure that your personal information is accurate and up to date and we may contact you from time to time to ask you if anything has changed.

Checking your identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Fair Processing Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

You can unsubscribe or amend your preferences on how we communicate with you at any time using the following methods:

Visit our website at www.corneyandbarrow.com enter your username and password in the ‘My Account Login’ and access the Account / Communication Details’ area to unsubscribe and / or change your preferences.

Email us directly at [email protected]

Phone us on + 44 (0)20 7265 2400

You can unsubscribe from email communications by clicking the unsubscribe link at the foot of the email or alternatively you can change your preferences by clicking the update marketing preference link. Please note that by unsubscribing from email communication, you will not receive any further marketing emails from Corney & Barrow. By that, we mean all marketing emails including the ones from your designated sales representative if you have one.

The Company reserves the right to update this Notice and any other relevant policies or procedures at any time. Any substantial changes that we may make to this Notice in the future will be provided to you by post or email depending on your prefer method of contact and posted on this page. The Company may also notify you in other ways from time to time about the processing of your personal data.

If you wish to contact our Data Protection Officer regarding personal data that has not been processed correctly or you would like to make a complaint, please do so by emailing us as [email protected] or by writing to:

Data Protection Officer
Corney & Barrow Ltd
1 Thomas More Street
London E1W 1YZ

Alternatively you have the right to lodge a complaint with the Information Commissioner’s Office either on their website at https://ico.org.uk/concerns/ or by post to

Customer Contact
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow SK9 5AF