Privacy Policy

INTRODUCTION

We are committed to protecting the privacy and security of your personal information. This Privacy Policy explains how Hambledon Vineyard Ltd, trading as Hambledon Wine Estate, collects, uses, stores, shares and otherwise processes your personal data when you visit our estate, vineyard, cellar door, restaurant, event spaces or other hospitality premises, use our website, place an order through our online shop, purchase a gift card or voucher, join our mailing list, participate in our wine club or membership offering, make a booking or reservation, attend a tasting, tour, dining experience, wedding, private event or other experience, contact us, interact with us via guest Wi-Fi or social media, or otherwise engage with us and our services.

This Privacy Policy applies to personal information obtained by us directly from you, through your use of our Services, or from third parties in connection with the Services. It does not apply to any information collected by third parties where those third parties act as separate controllers of your personal information and are not processing that information on our behalf.

It explains what personal information we collect, how and why we use it, the lawful bases on which we process it, how long we keep it, with whom we share it, where it may be transferred, the rights you have, and how you can contact us if you have any questions or concerns.

WHO WE ARE AND OUR ROLE

Hambledon Vineyard Ltd, trading as Hambledon Wine Estate, is the controller of your personal information unless otherwise stated in this Privacy Policy. This means that we are responsible for deciding why and how your personal information is processed.

We work with a number of trusted providers in connection with the activities described in this Privacy Policy, including ecommerce providers, booking and reservation providers, payment processors, membership platforms, guest Wi-Fi providers, social media platforms, analytics providers, marketing providers, IT support providers, cybersecurity providers, hosting and cloud providers, and delivery partners.

In certain cases, we and those organisations may jointly determine the purposes and means of processing personal information. Where that applies, we and those organisations may act as joint controllers for that processing. In other cases, the organisation receiving your information will process it for its own purposes and under its own privacy policy.

If you apply for employment or another role with us, a separate recruitment or staff privacy notice may apply.

PERSONAL INFORMATION WE COLLECT ABOUT YOU

Data categories

Depending on how you interact with us, the personal information we collect may include the following categories.

  • Identity Data - such as your name, title, date of birth or age, and account or login details where relevant.
  • Contact Data - such as your billing address, delivery address, postal address, email address and telephone number.
  • Transaction and Booking Data - such as details of orders, purchases, subscriptions, gift cards, payments and reservations.
  • Membership and Profile Data - such as details relating to your wine club, membership or subscription participation, benefits, interests, preferences, communication history and related communications.
  • Technical and Usage Data - such as your IP address, browser type and version, device type, cookie information, time zone, pages viewed, products browsed, search terms, interactions with our website, digital services or guest Wi-Fi, and similar online usage data.
  • Marketing and Communications Data - such as your marketing preferences, campaign responses, social media messages and comments, survey responses, reviews, and information contained in your correspondence and enquiries.
  • Special Category Data - where relevant, such as allergy information, accessibility requirements or other health-related information you provide in connection with a booking, visit or event.

Personal information you provide to us

You may provide personal information to us when you interact with us online or offline. This may include when you register with us, place an order, purchase products or gift cards, make a booking or reservation, join our newsletter or wine club, attend an event, enter a competition or promotion, complete a form, provide feedback, or contact us by email, telephone, social media or otherwise.

This may include details of tours, tastings, restaurant reservations, private events, weddings and other estate experiences, together with booking details such as party size, preferred date and time, special requests, dietary requirements and contact information provided through Tock or another booking platform.

We may also collect your social media username where you engage with us on social media and it is needed for us to respond to your comment, question, message or enquiry.

Where we need certain personal information in order to perform a contract with you, to comply with legal obligations, or to provide a service you have requested, and you do not provide it, we may not be able to provide the relevant product, booking, membership or service.

Information we collect automatically

When you visit our website or use our digital services, we may collect information about you and your use of our website via technical means such as cookies, webpage counters and other analytics tools. This may include your IP address, browser type and version, device type, operating system, time zone setting, cookie information, referring website addresses, pages viewed, products browsed, search terms, navigation behaviour, website session information and data collected through cookies, log files, web beacons, tags and pixels. We use this information to operate, secure, analyse and improve our website and digital services, to personalise your experience, to support marketing and advertising activity, and to help protect our systems against misuse and suspicious activity.

Where guest Wi-Fi is available, we or our third-party Wi-Fi provider may collect personal information relating to your use of that service, such as your name, email address, device information, login details, session details, connection time and technical usage data.

We may also record customer service or enquiry calls for training, quality assurance, complaint handling, evidential or legal purposes.

CCTV and venue security

When you visit our estate or premises, we may collect CCTV footage, still images, date and time information in areas where CCTV operates, together with information relating to incidents, accidents, complaints, safety matters or security issues.

We use CCTV and related security measures to help protect our visitors, staff, premises, products and property, and to investigate incidents, complaints, safety matters and unlawful conduct where appropriate.

Recordings may be reviewed internally and may be shared with third parties where necessary, including with law enforcement bodies, insurers, professional advisers or other parties involved in the handling of an incident, complaint or claim.

Information we collect from other sources

For clarity, the main third-party providers we currently use include Shopify, Tock, Toast, WineHub, Klaviyo and Google Analytics.

We may also receive or process personal information through third-party systems and service providers that support different parts of our business, including payment processors and gateways, booking and event platforms, guest Wi-Fi providers, fulfilment and courier providers, social media platforms, advertising partners, IT, software, cloud storage, website hosting, cybersecurity and managed service providers, and other publicly available or business sources where relevant.

The categories of information we receive may include contact details, booking and reservation information, membership information, order details, transaction data, payment-related information, technical data, marketing data, review data, customer support data and event attendance information.

Minors

Our website and Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so that we can investigate and, where appropriate, delete that information.

HOW AND WHY WE USE YOUR PERSONAL INFORMATION

We will only process your personal information where we have a lawful basis to do so under applicable data protection law.

Where you have provided consent

We may use and process your personal information where you have given us consent, including:

  • to send you direct marketing communications by email, SMS or similar electronic means;
  • to use non-essential cookies and similar technologies on our website;
  • to use your name, image, review, testimonial or other submitted content for promotional purposes where consent is required;
  • to contact you with news, invitations, promotions, product launches, event announcements and membership-related marketing where you have opted in; and
  • to use cookies or tracking technologies associated with Klaviyo and certain advertising tools after you have given consent through our cookie banner.

You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before that withdrawal.

Where necessary for the performance of a contract or pre-contract steps

We may process your personal information where this is necessary for the performance of a contract with you, or to take steps at your request before entering into such a contract. This includes:

  • processing and fulfilling orders placed through our website or otherwise;
  • processing payments, including payments handled through Toast or other payment providers;
  • arranging fulfilment, shipping or collection;
  • issuing receipts, invoices, confirmations and service communications;
  • managing and administering bookings and reservations for tastings, tours, dining, private events, weddings and other experiences, including bookings made through Tock or other third-party booking platforms;
  • managing and administering wine club, membership or subscription participation, including through WineHub or other membership platforms;
  • responding to product, booking or membership enquiries;
  • providing access to guest Wi-Fi where applicable; and
  • providing customer support and service communications.

Where necessary to comply with our legal obligations

  • We may process your personal information where necessary to comply with our legal obligations, including:
  • verifying age where required in connection with the sale or service of alcohol;
  • complying with tax, accounting, licensing, health and safety, food safety and consumer protection obligations;
  • responding to lawful requests from regulators, courts, law enforcement bodies and public authorities;
  • maintaining records of privacy rights requests and preferences;
  • retaining information where required by law; and
  • handling complaints, disputes and legal claims where legal obligations apply.

Where necessary to protect vital interests

We may use personal information where necessary to protect your vital interests or those of another person, for example in connection with an emergency or medical incident at our estate.

Where we have a legitimate interest

We may process your personal information where this is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests include promoting and marketing our business; providing, developing and improving our website, online shop, booking journey, hospitality experiences, events and visitor experience; managing guest Wi-Fi and our wider operations; maintaining accurate records and effective business systems; protecting our staff, visitors, premises, products and property; detecting and preventing fraud, suspicious activity, misuse and other unlawful conduct; and administering complaints, incidents, claims and legal proceedings.

This may include processing personal information through our internal IT systems and through trusted third-party technology providers for hosting, storage, support, maintenance, cybersecurity, backup and business continuity purposes.

Where we process special category data, such as allergy or accessibility information, we will only do so where we have a lawful condition for that processing, such as where it is necessary for health and safety, legal claims, or with your explicit consent.

MARKETING

We may collect and record your preferences relating to marketing communications. We may invite you to opt in to receive marketing communications when you create an account, place an order, make a booking or reservation, join our newsletter or wine club, enter a competition, sign up through a form or pop-up, or otherwise provide your details to us.

Where you have opted in, we may send you communications about products, launches, events, estate news, dining experiences, tastings, seasonal offers, promotions, memberships and related updates. We use Klaviyo to help manage our email marketing lists, send communications and analyse engagement with those communications, including opens, clicks and other interaction data.

We may use your identity, contact, profile and marketing preferences to form a view on what we think may be relevant or interesting to you so that our communications are more useful and less repetitive.

You can unsubscribe from marketing communications at any time by using the unsubscribe link in an email, following any opt-out instructions in an SMS where applicable, or contacting us directly. We may retain limited contact details on a suppression list so that we can respect your preference not to receive further marketing.

SHARING YOUR PERSONAL INFORMATION

We share your personal information with trusted service providers and other third parties where necessary to provide our Services and fulfil our contracts with you.

  • Shopify, which powers our online store;
  • Tock, which supports bookings, reservations and hospitality experiences;
  • Toast, which supports card payment processing and transaction handling;
  • WineHub, which supports wine club, membership and subscription administration;
  • Klaviyo, which supports email marketing and subscriber management;
  • Google Analytics, which supports website analytics and reporting;
  • payment processors, payment gateways and financial service providers;
  • booking, event and reservation providers, fulfilment and courier providers, guest Wi-Fi providers, IT, software, hosting, cloud storage, cybersecurity and managed service providers, CCTV and security providers, digital advertising and analytics partners, professional advisers, and courts, regulators, law enforcement bodies or other third parties where required.

We may also disclose personal information where we are under a duty to do so in order to comply with legal or regulatory obligations, in connection with legal proceedings or to establish, exercise or defend legal rights, to investigate fraud or security incidents, to protect the safety, rights or property of our business, staff, customers or others, or in connection with a merger, acquisition, restructuring, sale of assets or other business transfer.

INTERNATIONAL TRANSFERS AND WHERE WE STORE YOUR PERSONAL INFORMATION

Your personal information may be stored and processed in the UK, the EEA and countries outside the UK and EEA depending on the systems and service providers we use. For example, personal information processed through Shopify and certain other providers may be transferred outside Europe, including to Canada and the United States.

Where personal information is transferred internationally, we will take appropriate steps to ensure that it remains protected in accordance with applicable data protection law. These steps may include relying on adequacy regulations, using standard contractual clauses or equivalent approved transfer mechanisms, or relying on other lawful safeguards or derogations where applicable.

THE PERIOD FOR WHICH WE KEEP YOUR PERSONAL INFORMATION

We do not keep personal information in identifiable form for longer than is necessary for the purposes for which it was collected, including legal, accounting, tax, regulatory, insurance, operational and evidential purposes.

Because different types of personal information are collected and used for different purposes, the retention period will vary depending on the type of information, the reason for collection, and any legal or regulatory requirements that apply.

For example, we may retain account information while an account remains active and for a reasonable period afterwards; order, payment and transaction records for as long as necessary to complete the transaction and comply with legal, tax and accounting obligations; booking and reservation records for as long as necessary to manage the booking and any follow-up matters; membership, subscription and wine club records for the period of participation and a reasonable period afterwards; marketing preference and suppression records for as long as necessary to ensure we respect your communication choices; CCTV recordings for a limited period unless required for investigation, legal claims or security purposes; and complaint, allergy, incident or safety-related information where necessary for insurance, health and safety or legal purposes.

We may keep information for longer where there is a complaint, an incident, a legal claim, an insurance issue, or where we reasonably believe litigation or another dispute may arise. When information is no longer required, we will securely delete it, anonymise it or otherwise dispose of it in a secure manner.

SECURITY AND LINKS TO OTHER SITES

We use appropriate technical and organisational measures to protect your personal information against unauthorised or unlawful processing and against accidental loss, destruction or damage. Access to personal information is restricted to those who need it for legitimate business purposes, and we expect our service providers to maintain appropriate security measures as well.

We may process personal information through our internal IT systems and through trusted third-party technology providers for hosting, storage, support, maintenance, cybersecurity, backup and business continuity purposes.

We have procedures in place to deal with suspected personal data breaches and will notify you and any relevant regulator where we are legally required to do so.

Our website and communications may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party sites or services, and we encourage you to review their privacy notices before providing them with your personal information.

COOKIES

A cookie is a small file placed on your device when you visit a website. We use cookies and similar technologies, including pixels, tags, web beacons and other tracking technologies, to operate our website, improve its performance, remember your preferences, analyse usage and support marketing and advertising activity.

These technologies may include cookies associated with customer account and login functionality, shopping cart and checkout processes, storefront navigation, preferences and consent settings, landing page and referrer tracking, Shopify analytics, website performance and user behaviour analysis, marketing and referral tracking, and Klaviyo email campaign and subscriber engagement tracking.

Some cookies are essential for the site to function and do not require consent. Others are non-essential and will only be used where consent is required and has been given. You can control cookies through your browser settings and, where applicable, through our cookie banner or consent management tool.

We use the following cookies to optimize your experience on our Site and to provide our services.

 

Name

Function

_ab

Used in connection with access to admin.

_secure_session_id

Used in connection with navigation through a storefront.

cart

Used in connection with shopping cart.

cart_sig

Used in connection with checkout.

cart_ts

Used in connection with checkout.

checkout_token

Used in connection with checkout.

secret

Used in connection with checkout.

secure_customer_sig

Used in connection with customer login.

storefront_digest

Used in connection with customer login.

_shopify_u

Used to facilitate updating customer account information.

 

Name

Function

_tracking_consent

Tracking preferences.

_landing_page

Track landing pages

_orig_referrer

Track landing pages

_s

Shopify analytics.

_shopify_fs

Shopify analytics.

_shopify_s

Shopify analytics.

_shopify_sa_p

Shopify analytics relating to marketing & referrals.

_shopify_sa_t

Shopify analytics relating to marketing & referrals.

_shopify_y

Shopify analytics.

_y

Shopify analytics.

 

BEHAVIOURAL ADVERTISING

We may use your personal information and technical data to deliver targeted advertising, marketing communications and relevant content that we believe may be of interest to you.

For example, we use Google Analytics to help understand how customers use the website; we may use advertising tools and analytics provided by social media and digital advertising partners, including Meta/Facebook; we may share information about your use of the website, interactions with content, purchases and related activity with advertising or analytics partners, subject to applicable legal requirements; and Klaviyo may use cookies, pixels and related tracking tools to understand engagement with our emails and website.

These activities help us measure campaign performance, create relevant audiences, improve marketing effectiveness and better understand user interests. You can opt out of certain targeted advertising activities through browser settings, cookie controls, platform settings and relevant third-party opt-out tools where available.

AUTOMATED DECISION-MAKING

We do not generally make decisions about you based solely on automated processing that have legal effects or similarly significant effects.

However, some service providers, including Shopify and related fraud prevention systems, may use limited automated processing to help identify and prevent suspicious or fraudulent activity. This may include temporary restrictions associated with repeated failed transactions, suspicious payment behaviour or unusual usage patterns. These measures are intended to protect our business and customers against fraud and are not generally intended to amount to solely automated decision-making with legal or similarly significant effects under applicable data protection law.

YOUR RIGHTS

Depending on the circumstances and the law that applies to you, you may have the right to request access to the personal information we hold about you, request correction of inaccurate or incomplete information, request erasure, request restriction of processing, object to processing based on legitimate interests, withdraw consent where processing is based on consent, request portability of certain information, and object to direct marketing at any time.

If you would like to exercise any of these rights, please contact us using the details below. We may ask for information to verify your identity before responding to a request. We will respond within the time period required by applicable law, subject to any lawful extensions or exceptions.

If you are dissatisfied with the way we handle your personal information or respond to a request, you may have the right to complain to the Information Commissioner’s Office or another relevant supervisory authority.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our Services, systems, legal obligations or privacy practices. Any changes will be posted on our website and will take effect from the date of publication unless otherwise stated. We encourage you to review this Privacy Policy periodically so that you remain informed about how we use your personal information.

CONTACT US

If you have any questions about this Privacy Policy, our use of your personal information, or your rights, please contact us at Hambledon Vineyard Ltd, East Street, Hambledon, Hampshire, Waterlooville, PO7 4RY, United Kingdom, or by email at info@hambledonvineyard.co.uk.

LEGAL INFORMATION

Hambledon Vineyard Ltd trading as Hambledon Wine Estate.

Address: East Street, Hambledon, Hampshire, Waterlooville, PO7 4RY, United Kingdom.

Website: hambledonvineyard.co.uk

Company number: 07047235

 

Last updated 10.06.2026