Twelve 12 Drinks

PRIVACY POLICY

Privacy policy

Last updated: 04 August 2026

This policy explains what personal data we collect when you use twelve12drinks.co.uk, how and why we use it, who we share it with, how long we keep it and the rights available to you. We handle personal data in accordance with applicable UK data-protection law, including the UK GDPR and the Data Protection Act 2018.

Who we are

Twelve12 Drinks is a trading name of Haitchco Ltd. Haitchco Ltd is the data controller responsible for deciding how and why your personal data is used.

Twelve12 Drinks
Haitchco Ltd
Company No. 15550167
Unit 1C, Halliwell Mills
Bertha Street
Bolton
BL1 8AH
United Kingdom
Phone: 07783 806866
Email: support@twelve12drinks.co.uk

The personal data we collect

Depending on how you use our website and services, we may collect the following categories of personal data:

  • Identity and contact information — including your name, billing address, delivery address, email address and telephone number.
  • Order and transaction information — including the products you purchase, order number, order value, delivery method, payment status, returns, refunds and correspondence relating to your order.
  • Payment information — payments are processed securely by our payment providers, Stripe and PayPal. We may receive confirmation of the payment, payment status and limited transaction details, but we do not receive or store your complete payment-card number or security code. Where you pay using Apple Pay or Google Pay, the card details are supplied by your device wallet and processed by Stripe.
  • Account information — including your username, account preferences, saved addresses and order history where you create an account.
  • Communications — including emails, support enquiries, cancellation requests, returns enquiries, complaints and other messages you send to us.
  • Marketing preferences — including whether you have subscribed to marketing emails, withdrawn consent or unsubscribed.
  • Technical and security information — including your IP address, browser type, device type, operating system, security logs, login information and information required to operate and protect the website.
  • Website usage information — including pages viewed, links selected, products viewed, referring pages and interactions with our website. Analytics and advertising information is collected only where the required cookie consent has been provided.
  • Cookie preferences — including the choices you make through our cookie banner and records of those choices.

How we collect your data

We may collect personal data:

  • Directly from you when you place an order, create an account, contact us, request a return or subscribe to marketing.
  • Automatically when you use our website, through essential website technologies, server logs, cookies and similar technologies.
  • From payment providers when they confirm the status of a payment, refund or transaction.
  • From delivery providers when they provide tracking, delivery or attempted-delivery information.
  • From analytics and advertising providers where you have consented to the relevant cookies or similar technologies.

How we use your data and our lawful basis

What we use your data for Lawful basis
Processing payments and fulfilling your order Performance of our contract with you
Preparing, dispatching and delivering your order Performance of our contract with you
Providing customer support and handling cancellations, returns, refunds and complaints Performance of our contract, compliance with legal obligations and our legitimate interests in providing customer service
Creating and managing your customer account Performance of our contract and our legitimate interests in administering customer accounts
Operating essential website functions, including shopping basket, checkout, account access and cookie preferences Performance of our contract and our legitimate interests in operating our website
Protecting our website, preventing fraud and investigating suspicious or unauthorised activity Our legitimate interests in protecting our customers and business, and compliance with legal obligations where applicable
Sending marketing emails Your consent, where consent is required. You may withdraw your consent at any time
Website analytics and advertising Your consent through our cookie banner
Maintaining accounting, transaction and tax records Compliance with our legal obligations
Establishing, exercising or defending legal claims and resolving disputes Our legitimate interests and compliance with legal obligations

Our legitimate interests

Where we rely on legitimate interests, those interests may include:

  • Operating and improving our business and website.
  • Providing customer service and resolving enquiries.
  • Protecting customers, accounts and transactions from fraud.
  • Maintaining the security and reliability of our systems.
  • Keeping appropriate business and transaction records.
  • Establishing, exercising or defending legal claims.

When relying on legitimate interests, we consider the effect of the processing on your rights and interests and use personal data only where those interests are not overridden by your rights.

Who we share your data with

We share personal data only where reasonably necessary to operate our store, provide our services, comply with the law or protect our legal rights. Recipients may include:

  • Payment providers — including Stripe and PayPal, where the relevant payment method is selected or available. Where you choose Apple Pay or Google Pay, your device wallet provider also processes the information needed to authorise the payment.
  • Delivery providers — including Yodel and DPD, or another suitable carrier used to deliver an order. Delivery providers may receive your name, delivery address, telephone number, email address and delivery instructions.
  • Website and hosting providers — including Hosting.com (powered by Rocket.net) and providers supporting our WordPress and WooCommerce website, hosting, backups, security and technical operation.
  • Content-delivery and website-security providers — Cloudflare, which we use for content delivery, website performance, bot filtering and protection against malicious traffic. Cloudflare processes technical information such as your IP address and request details in order to deliver and protect the website.
  • Customer email and correspondence — Zoho Mail, which we use for customer support, enquiries and general business correspondence.
  • Email communications and marketing — Sender.net, which we use to manage email communications, subscriber preferences and marketing emails.
  • Analytics and advertising providers — including Google services such as Google Analytics and Google Ads, and Meta services such as Facebook advertising, where you have consented to the relevant cookies or similar technologies.
  • Professional advisers — including accountants, auditors, insurers, legal advisers and other professional consultants where reasonably necessary.
  • Government bodies and authorities — including HMRC, regulators, law-enforcement authorities, courts or other bodies where disclosure is required or permitted by law.
  • Business-transfer recipients — where our business, assets or part of our operations are sold, reorganised, transferred or merged, subject to appropriate confidentiality and data-protection safeguards.

We require service providers handling personal data on our behalf to use it only for the agreed purpose and to apply appropriate security and confidentiality measures.

We do not sell or rent your personal data to third parties.

International data transfers

Some of our service providers may store or process personal data outside the United Kingdom.

Where a restricted international transfer takes place, we use an appropriate transfer mechanism where required. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses or another legally permitted safeguard.

Where required, we also assess whether the transfer mechanism provides an appropriate level of protection for the personal data involved.

Cookies and similar technologies

We use cookies and similar technologies to operate our website, remember preferences, maintain shopping baskets, provide account and checkout functions, understand how the website is used and support advertising.

Cookies and similar technologies that are strictly necessary for the website to function may be used without consent where permitted by law. This may include technologies required for shopping baskets, checkout, account security, fraud prevention and remembering your cookie choices.

Non-essential technologies, including analytics and advertising cookies, are used only after you have provided the required consent through our cookie banner. You may change or withdraw your choices at any time using the cookie settings available on our website.

For more information about the technologies we use and their duration, please read our Cookie Policy .

Marketing

Where you have subscribed or otherwise provided the required permission, we may use Sender.net to send you marketing emails about our products, promotions, availability and news.

Marketing emails include an unsubscribe link. You may unsubscribe or withdraw your consent at any time. Unsubscribing from marketing does not prevent us from sending essential service emails relating to your orders, payments, deliveries, returns, refunds, account security or customer enquiries.

After you unsubscribe, we may retain limited information on a suppression list so that we can respect your preference and avoid sending further marketing emails.

How long we keep your data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected. We may retain information for longer where required for legal, accounting, tax, fraud-prevention, dispute-resolution or regulatory purposes.

  • Order, payment and transaction records — generally for up to six years from the end of the relevant financial or accounting period, or longer where required by law or in connection with a claim, dispute or investigation.
  • Customer account information — while your account remains active and for a reasonable period afterwards, unless the information must be retained for another lawful purpose.
  • Customer-service, cancellation and returns correspondence — for as long as reasonably necessary to resolve the matter and maintain appropriate business records.
  • Marketing information — until you unsubscribe, withdraw consent or object. Limited suppression information may then be retained so that we can continue to respect your preference.
  • Cookie and analytics information — for the periods explained in our Cookie Policy and cookie settings.
  • Website and security logs — for a limited period appropriate to maintaining security, preventing fraud and investigating technical problems.

We periodically review the personal data we hold. When information is no longer required, we securely delete or anonymise it where reasonably possible.

How we protect your data

We use appropriate technical and organisational measures designed to protect personal data from unauthorised access, accidental loss, alteration, disclosure or misuse.

These measures may include encrypted website connections, access controls, secure credentials, reputable payment providers, website security monitoring, backups and limiting access to people and service providers who require the information for an authorised purpose.

No internet transmission or electronic storage system can be guaranteed to be completely secure. However, we regularly review the measures used to protect the personal data under our control.

Automated checks and decision-making

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Payment providers, fraud-prevention providers and financial institutions may carry out automated security, identity or transaction checks under their own processes and privacy policies. These checks may affect whether a payment is approved or declined.

Children’s data

Our website and online store are intended for customers aged 18 or over. We do not knowingly collect personal data from children for the purpose of allowing them to place orders.

If you believe that a child has provided personal data to us without appropriate authorisation, please contact us so that we can investigate and take appropriate action.

Your data-protection rights

Depending on the circumstances and the lawful basis on which we use your personal data, you may have the right to:

  • Request access to the personal data we hold about you.
  • Ask us to correct personal data that is inaccurate or incomplete.
  • Ask us to delete your personal data in certain circumstances.
  • Ask us to restrict how we use your personal data in certain circumstances.
  • Object to processing based on our legitimate interests.
  • Object at any time to the use of your personal data for direct marketing.
  • Withdraw your consent at any time where we rely on consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
  • Request personal data you provided to us in a structured, commonly used and machine-readable format where the right to data portability applies.
  • Complain to the Information Commissioner’s Office about how your personal data has been handled.

Your right to object to direct marketing

You may object at any time to our use of your personal data for direct marketing. You can do this by selecting the unsubscribe link in a marketing email or contacting us directly.

These rights are not absolute and may apply differently depending on the circumstances and why we use your personal data. We may ask for information needed to confirm your identity before responding to a request.

To exercise your rights, email support@twelve12drinks.co.uk or call 07783 806866 .

For requests involving access, deletion, correction or portability of personal data, we may ask you to confirm the request in writing and provide information needed to verify your identity.

We will respond without undue delay and normally within one calendar month. Where permitted by law, additional time may be required for a complex request or where several requests have been made. We will tell you if an extension applies.

Complaints

If you have concerns about how we collect or use your personal data, please contact us first so that we can investigate and try to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data-protection regulator:

Information Commissioner’s Office

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our services, providers, website practices or legal obligations.

Any updated version will be published on this page with a revised “Last updated” date. We encourage you to review this page periodically.

This policy was last reviewed on 04 August 2026. If you have any questions about this policy or how we use your personal data, email support@twelve12drinks.co.uk or call 07783 806866 .