Privacy Policy

Privacy Policy

Last updated 6 July 2026

Whisky Auction Ltd, trading as Whisky.Auction, respects your privacy and is committed to protecting your personal information.

This policy is intended to meet our transparency obligations under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as applicable.

This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have under UK data protection law.

This policy applies when you use the Whisky.Auction website, create an account, register to buy or sell, place a bid, submit goods for valuation or auction, purchase goods, sell goods, contact us, sign up for marketing, interact with our auction services or otherwise use our products and services.

Our website and services are intended for people aged 18 or over. We sell and facilitate the sale of age-restricted products and may carry out age, identity, payment, credit and fraud checks where necessary.

Table of Contents

1. WHO WE ARE
2. PERSONAL INFORMATION WE COLLECT
3. HOW WE COLLECT PERSONAL INFORMATION
4. HOW WE USE PERSONAL INFORMATION AND OUR LAWFUL BASIS
5. MARKETING
6. COOKIES AND SIMILAR TECHNOLOGIES
7. AGE, IDENTITY, CREDIT AND FRAUD CHECKS
8. WHO WE SHARE PERSONAL INFORMATION WITH
9. INTERNATIONAL TRANSFERS
10. HOW LONG WE KEEP PERSONAL INFORMATION
11. HOW WE PROTECT PERSONAL INFORMATION
12. CHILDREN
13. AUTOMATED DECISION-MAKING AND PROFILING
14. YOUR RIGHTS
15. COMPLAINTS
16. LINKS TO OTHER WEBSITES AND SERVICES
17. CHANGES TO THIS PRIVACY POLICY
18. HOW TO CONTACT US OR EXERCISE YOUR RIGHTS

1. WHO WE ARE

Whisky Auction Ltd is the controller responsible for the personal information described in this policy, unless we explain otherwise.

We are registered in England and Wales with company number 09365276. Our registered office is Elixir House, Whitby Avenue, Park Royal, London NW10 7SF, United Kingdom.

In this policy, “Whisky.Auction”, “we”, “us” and “our” refer to Whisky Auction Ltd trading as Whisky.Auction.

For privacy queries, requests or complaints, you can contact our Data Protection Team by email at [email protected], by telephone on +44 (0)20 8838 9381, or by writing to: Data Protection Team, Whisky Auction Ltd, Elixir House, Whitby Avenue, Park Royal, London NW10 7SF, United Kingdom.

2. PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you interact with us. It may include the following categories:

• Contact details, such as your name, billing address, delivery address, residential address, email address and telephone number.
• Account details, such as username, password, account preferences, contact preferences, authentication information and account status.
• Buyer information, such as bid history, watch list activity, lots purchased, hammer price, buyer’s premium, invoices, delivery details, collection details, payment status, returns, complaints and dispute information.
• Seller information, such as lots submitted, bottle or goods descriptions, valuation information, reserve prices, seller commission, seller payment details, bank account details, tax information, VAT status, tax identification information where required, and seller correspondence.
• Auction and transaction information, such as bids, winning bids, lot numbers, auction dates, invoices, service charges, premiums, delivery charges, customs or import information, refund information and account balances.
• Payment-related information, such as transaction references, payment method, partial card details, payment token information and payment status. Full card details and card security codes are handled by our payment service providers, including Worldpay, PayPal and Amazon Pay.
• Age, identity, credit and fraud-prevention information, such as date of birth, address verification information, identity check results, credit check results, fraud-screening results, payment verification results and other information needed to verify age, identity, payment use or eligibility to use our services.
• Goods, provenance and authenticity information, such as descriptions of bottles or other goods, images you provide, ownership information, provenance information, authenticity concerns, forgery assessments, condition reports and related correspondence.
• Customer-service information, such as enquiries, complaints, support tickets, responses to surveys, feedback, reviews, testimonials and records of our correspondence with you.
• Marketing and preference information, such as newsletter preferences, marketing consent, opt-out records, engagement with our emails and advertising preferences.
• Technical and usage information, such as IP address, browser type and version, device identifiers, operating system, approximate location inferred from IP address, pages viewed, website interactions, referral source, cookie identifiers, advertising identifiers, analytics data, security logs and error logs.
• Business contact information, such as business name, job title, business address, VAT registration details, business contact details and information relevant to business buyer or seller accounts.
• Information collected at our premises, events or pop-ups, such as attendance details, collection details, delivery records and CCTV images where CCTV is in operation and signage is displayed.

We do not intentionally collect special category personal information, such as information about health, religion, ethnicity, political opinions, trade union membership, biometric data or sexual orientation. Please do not provide this information to us unless we specifically ask for it and explain why it is needed.

3. HOW WE COLLECT PERSONAL INFORMATION

We collect personal information directly from you when you create an account, register to buy or sell, place bids, submit goods for valuation or auction, purchase goods, arrange delivery or collection, contact us, make a complaint, respond to surveys, leave reviews or sign up to marketing.

We also collect information automatically when you use our website, including through cookies, pixels, tags, server logs and similar technologies.

We may receive information from third parties where necessary for our services, including payment providers, delivery providers, identity and age-verification providers, fraud-prevention providers, credit reference agencies, tax authorities, marketing platforms, analytics providers, review platforms, social media platforms, group companies, public authorities and publicly available sources.

4. HOW WE USE PERSONAL INFORMATION AND OUR LAWFUL BASIS

We use personal information only where we have a lawful basis under data protection law. The table below explains the main purposes for which we use personal information and the lawful bases we rely on.

Where we rely on legitimate interests, we consider our interests and your rights and freedoms. You may object to processing based on legitimate interests in certain circumstances.

5. MARKETING

We may send you marketing about our auctions, services, events, offers and related products where you have consented, or where the law allows us to rely on the soft opt-in for our own similar products and services.

The soft opt-in may apply where you have bought from us, sold through us, registered for our services or negotiated to buy or sell through us, we gave you a clear opportunity to opt out when we collected your details, and we give you a clear opportunity to opt out in every marketing message.

For business contacts and corporate subscribers, we may send marketing where permitted by law. You can object or opt out at any time.

You can unsubscribe from marketing at any time by using the unsubscribe link in our emails, updating your account preferences or contacting us. We may still send you non-marketing service messages, such as account messages, bid notifications, auction updates, invoice notices, delivery updates, collection updates, payment messages, safety notices and responses to your enquiries.

6. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies, pixels, tags, scripts and similar technologies to operate our website, remember preferences, keep our services secure, understand website use, improve our services, personalise content and deliver or measure advertising.

Strictly necessary cookies and similar technologies are used to provide the website and do not require consent. Non-essential cookies and similar technologies, including certain analytics, advertising, retargeting and social media technologies, are used only where legally permitted and where any required consent has been obtained.

You can manage cookie choices through our cookie banner or cookie settings tool. You can also control cookies through your browser settings, although blocking some cookies may affect website functionality.

Our Cookie Policy gives more detailed information about the cookies and similar technologies we use, including their provider, purpose, duration and category.

7. AGE, IDENTITY, CREDIT AND FRAUD CHECKS

Because we sell and facilitate the sale of age-restricted goods, we may need to verify that you are aged 18 or over and that payment details are being used lawfully.

We may validate your name, address, date of birth, payment information and other relevant details against appropriate third-party databases, identity-verification providers, fraud-prevention providers, credit reference agencies, payment providers, public sources or other verification services.

We may carry out credit or payment checks where necessary for auction participation, payment processing, fraud prevention, account security, debt recovery or protection of our auction platform.

These checks are carried out to comply with legal requirements relating to age-restricted goods, prevent fraud, verify payment use, protect buyers and sellers, maintain auction integrity, perform our contract with you and protect our business.

Identity, age, credit and fraud-prevention providers may keep a record of the check in accordance with their own privacy notices and applicable law.

8. WHO WE SHARE PERSONAL INFORMATION WITH

We share personal information where necessary with the following categories of recipients:

• Payment processors, payment networks and payment method providers, including Worldpay, PayPal and Amazon Pay.
• Delivery, fulfilment, warehouse, storage, insurance and logistics providers.
• Identity, age-verification, credit reference and fraud-prevention providers.
• Website hosting, IT, cloud, security, analytics and support service providers.
• Customer-service, CRM, email, marketing automation and review platforms.
• Advertising, retargeting, social media and marketing measurement partners, subject to cookie and marketing consent rules where applicable.
• Tax, VAT, accounting and finance service providers.
• Professional advisers, including lawyers, auditors, insurers, bankers and accountants.
• HMRC, Trading Standards, regulators, courts, law-enforcement agencies, public authorities and other bodies where required or permitted by law.
• Buyers and sellers, where necessary for the operation of an auction, transaction, dispute, delivery, collection, return, authenticity issue or legal claim.
• Prospective buyers, sellers, funders, group companies or advisers if our business or assets are sold, transferred, merged, reorganised or financed.

Where a third party acts as our processor, we require them to process personal information only on our instructions, keep it secure, assist us with compliance and use it only for the services they provide to us.

Some third parties, including payment providers, fraud-prevention providers and delivery providers, may process personal information as independent controllers in accordance with their own privacy notices.

We do not sell your personal information.

9. INTERNATIONAL TRANSFERS

Some of our service providers may process personal information outside the United Kingdom. Where personal information is transferred internationally, we will use appropriate safeguards where required by law.

These safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism. Where required, we will assess the risks of the transfer and apply supplementary measures.

10. HOW LONG WE KEEP PERSONAL INFORMATION

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including to meet legal, regulatory, tax, accounting, fraud-prevention, security, auction integrity and dispute-resolution requirements.

Typical retention periods include:

• Account information: for as long as your account remains active and for a reasonable period afterwards to deal with account administration, fraud prevention, legal claims and compliance requirements.
• Auction, bid, purchase, sale, invoice, payment and tax records: usually six years after the end of the relevant accounting period, unless a longer period is required or permitted by law.
• Seller records, valuation records and goods submission records: for as long as necessary to administer the auction or valuation, deal with authenticity, provenance, tax, audit, dispute, fraud-prevention and legal claim requirements.
• Customer-service communications and complaints: usually up to six years after the issue is resolved, depending on the nature of the enquiry, complaint or claim.
• Marketing consent and suppression records: for as long as needed to evidence your preferences and ensure we respect opt-outs.
• Cookie and analytics information: for the period stated in our Cookie Policy or cookie settings tool.
• Fraud-prevention, identity, credit, age-verification and security records: for as long as necessary to protect our website, customers, auctions and business, investigate suspicious activity, comply with legal requirements and deal with disputes.
• Delivery, collection, customs and import records: for as long as necessary to fulfil the transaction, manage disputes, comply with legal requirements and keep appropriate tax and accounting records.

Where we no longer need personal information, we will delete it, anonymise it or securely archive it until deletion is possible.

11. HOW WE PROTECT PERSONAL INFORMATION

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access controls, authentication, encryption or pseudonymisation where appropriate, secure payment processing, staff training, supplier due diligence, contractual controls, monitoring, backup and incident-response procedures.

No website, system or transmission is completely secure. If we identify a personal data breach, we will assess it and notify affected individuals and the Information Commissioner’s Office where required by law.

12. CHILDREN

Our website and services are intended for people aged 18 or over. We do not knowingly sell or facilitate the sale of age-restricted goods to anyone under 18 and we do not knowingly collect personal information from children for marketing purposes.

If we become aware that we have collected personal information from someone under 18 in circumstances where this is not permitted, we will take reasonable steps to delete it or restrict its use.

13. AUTOMATED DECISION-MAKING AND PROFILING

We may use automated tools to help detect fraud, verify age or identity, assess payment or credit risk, prevent misuse of payment methods, protect website security, personalise marketing or measure advertising effectiveness.

We will not make solely automated decisions that have a legal or similarly significant effect on you unless this is permitted by law and appropriate safeguards are in place. If such decision-making is used, we will provide information required by law.

14. YOUR RIGHTS

Under UK data protection law, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete personal information.
• Request erasure of your personal information.
• Request restriction of processing.
• Object to processing based on legitimate interests or to direct marketing.
• Request data portability where applicable.
• Withdraw consent where we rely on consent. Withdrawal of consent does not affect processing that took place before consent was withdrawn.
• Complain to us and to the Information Commissioner’s Office.

These rights are not absolute and may depend on the circumstances. For example, we may need to retain certain auction, transaction, seller, tax, fraud-prevention or legal records even where you ask us to delete your information.

We may need to verify your identity before responding to a request.

We will respond to valid rights requests within one month, unless the law allows us to extend that period because the request is complex or we have received a number of requests.

15. COMPLAINTS

If you are unhappy with how we handle your personal information, please contact us first using the details in section 1.

We will provide a clear way for you to make a data protection complaint, acknowledge your complaint within 30 days, investigate appropriately, keep you informed where appropriate and tell you the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office. The ICO’s contact details are: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. Website: ICO website. Telephone: 0303 123 1113.

If you are based outside the UK, you may also have the right to complain to your local data protection authority, depending on applicable law.

16. LINKS TO OTHER WEBSITES AND SERVICES

Our website may link to third-party websites, payment providers, social media platforms, review platforms, delivery providers or other services. Those third parties are responsible for their own privacy practices. Please read their privacy notices before providing personal information to them.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The updated version will be shown by the “Last updated” date at the top of this page.

If we make material changes, we may notify you by prominently posting a notice on our website or by contacting you directly where appropriate.

18. HOW TO CONTACT US OR EXERCISE YOUR RIGHTS

You can exercise your rights or contact us about this Privacy Policy by email at [email protected], by telephone on +44 (0)20 8838 9381, or by writing to: Data Protection Team, Whisky Auction Ltd, Elixir House, Whitby Avenue, Park Royal, London NW10 7SF, United Kingdom.

You can update some account information by logging into your account. You can opt out of marketing using the unsubscribe link in our emails, through your account preferences or by contacting us.