HORNEYWINK LIMITED
PRIVACY POLICY

Last updated: 29 May 2026 – Version 1.0

IMPORTANT — Age Restriction: Our products contain alcohol and are only available for purchase by persons aged 18 or over. We take age verification seriously and process certain personal data for this purpose. This website and our products are not intended for persons under the age of 18.

1. Who We Are and How to Contact Us
Horneywink Limited (referred to in this policy as “we”, “us” or “our” or “the Company”) is the data controller responsible for your personal data.

Company details:

  • Horneywink Limited
  • Registered address: Horneywink Orchards Mylor Downs Falmouth Cornwall TR11 5UL
  • Company registration number: 14613510
  • ICO registration number: 02150018378

Contact details for data protection matters:

  • Email: info@horneywink.com
  • Post: Data Protection, Horneywink Limited, Mylor Downs, Falmouth TR11 5UL
  • Telephone: 07340 076747

If you have a complaint about how we handle your personal data, you also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority: www.ico.org.uk or telephone 0303 123 1113.

2. Personal Data We Collect
We collect and process the following categories of personal data:

  • Identity data: full name, date of birth (for age verification)
  • Contact data: email address, postal address, telephone number
  • Account data: username, password (stored in encrypted form), order history
  • Payment data: billing address, payment card details (note: full card details are processed by our secure third-party payment provider and not stored by us)
  • Transaction data: details of products purchased, order value, delivery details
  • Communications data: messages you send us via contact forms, email or post, including customer service enquiries and complaints
  • Marketing preferences: regarding receiving marketing communications from us

2.2 Data we collect automatically

  • Technical data: IP address, browser type and version, device type, operating system, time zone and location, browser plug-in types and versions
  • Usage data: information about how you navigate and use our website, pages visited, products viewed, time spent on pages, referring URLs
  • Cookie data: please see our Cookie Policy for full details of how we use cookies

2.3 Data we receive from third parties

  • Payment verification data from our payment processing provider
  • Age verification data from third-party age verification services where applicable
  • Analytics data from providers such as Google Analytics
  • Fraud prevention data from fraud screening services

3. How & Why We Use Your Data
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we must have a lawful basis for processing your personal data. The table below sets out the purposes for which we process your data and the legal basis we rely on:

3.1 Processing necessary to perform our contract with you
We process your data on this basis to:

  • Process and fulfil your orders for cider and related products
  • Manage your customer account
  • Process payments and handle refunds
  • Deliver your orders and communicate about deliveries
  • Provide customer support and respond to your enquiries

3.2 Processing necessary to comply with a legal obligation
We process your data on this basis to:

  • Verify that you are aged 18 or over before completing a sale of alcohol, as required under the Licensing Act 2003
  • Maintain accounting and financial records as required by HMRC and Companies Act obligations
  • Respond to lawful requests from law enforcement or regulatory authorities
  • Comply with the Alcohol (Minimum Pricing) (Scotland) Act 2012 and relevant regulations where applicable

3.3 Processing based on our legitimate interests
We rely on legitimate interests (having balanced these against your rights) to:

  • Prevent and detect fraud, including verifying payment authenticity
  • Improve and optimise our website and services through analytics
  • Manage the security of our IT systems and website
  • Manage and respond to complaints and disputes
  • Send you service-related communications (not marketing) about your orders or account

3.4 Processing based on your consent
Where we rely on your consent, we will:

  • Send you marketing communications about our products, offers, new cider releases, and news (you may withdraw consent at any time)
  • Use non-essential cookies and similar tracking technologies (see our Cookie Policy)
  • Share your details with carefully selected third-party partners for marketing, where you have specifically opted in

You may withdraw your consent at any time without affecting the lawfulness of processing before withdrawal. To withdraw consent, contact us using the details in section 1 or use the unsubscribe link in any marketing email.

4. Age Verification
As a seller of alcohol, we are legally obliged to take reasonable steps to verify that customers are aged 18 or over. We process date of birth information and may use third-party age verification services for this purpose. The legal basis for this processing is compliance with a legal obligation (Licensing Act 2003).

We do not sell to or market our products at persons under the age of 18. If we discover that a customer is under 18, we will cancel the order and delete or restrict the relevant personal data.

5. Marketing
We may send you marketing communications about our cider products, seasonal offers, new releases, events, and company news if you have:

  • Opted in to receive marketing emails at the point of registration or purchase; or
  • Previously purchased from us and have not opted out (in which case we rely on the “soft opt-in” rule under the Privacy and Electronic Communications Regulations 2003 (PECR), limited to similar products and services)

You can opt out of marketing at any time by:

  • Clicking “Unsubscribe” in any marketing email
  • Updating your preferences in your account settings
  • Contacting us directly using the details in section 1

Opting out of marketing will not affect the delivery of transactional communications related to orders you have placed.

6. Cookies

Our website uses cookies and similar technologies. Cookies are small text files placed on your device. We use:

  • Strictly necessary cookies: essential for the website to function (no consent required)
  • Performance/analytics cookies: to understand how visitors use our site (consent required)
  • Functionality cookies: to remember your preferences (consent required)
  • Targeting/marketing cookies: to show you relevant advertising (consent required)

Full details of the cookies we use, including their purpose, duration, and provider, are set out in our Cookie Policy, which is available on our website. You can manage your cookie preferences at any time via our cookie consent tool.

7. Who We Share Your Personal Data With
We do not sell your personal data. However, we may share your personal data with the following categories of recipients:

  • Payment processors: to securely process card payments (e.g., Stripe, PayPal)
  • Delivery and logistics providers: to fulfil and deliver your orders
  • IT/website service providers: cloud hosting, website platform, email delivery services
  • Age verification services: where used to comply with our legal obligations
  • Analytics providers: eg: Google Analytics (with data processing agreements)
  • Marketing platforms: where you have consented to marketing
  • Fraud prevention services: to protect against fraudulent transactions
  • Legal and professional advisers: solicitors, accountants, insurers where necessary
  • Law enforcement and regulators: where required by law or to protect our legal rights

All third parties are required to keep your personal data secure and to use it only in accordance with our instructions and applicable data protection law.

8. International Transfers
Some of our third-party service providers are based outside the UK. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

  • The UK Government has issued an adequacy decision for the destination country; or
  • We use UK International Data Transfer Agreements (IDTAs) or equivalent standard contractual clauses approved by the ICO; or
  • Another permitted transfer mechanism applies

You may request a copy of relevant safeguards by contacting us using details in section 1.

9. How Long We Keep Your Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected, and to comply with our legal obligations. Our standard retention periods are:

  • Order and transaction records: 7 years from the date of transaction (to comply with HMRC and Companies Act requirements)
  • Age verification records: retained for the duration of your account plus 1 year
  • Customer account data: for the duration of your account plus 2 years following account closure
  • Marketing preferences and opt-outs: indefinitely (to ensure we respect your preferences)
  • Correspondence and complaints: up to 6 years from resolution
  • Technical/log data and analytics: typically 26 months

Once data is no longer required, it is securely deleted or anonymised.

10. Data Security
We have implemented appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These include:

  • Encryption of data in transit (SSL/TLS)
  • Secure, encrypted storage of passwords
  • Restricted access to personal data on a need-to-know basis
  • Regular security assessments and staff training
  • Secure third-party payment processing (we do not store full card details)

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.

11. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:

11.1 Right of access
You have the right to request a copy of the personal data we hold about you (a “subject access request”). We will respond within one month.

11.2 Right to rectification
You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.

11.3 Right to erasure (“right to be forgotten”)
You may ask us to delete your personal data in certain circumstances, for example if we no longer need it, you withdraw consent, or you object to our processing. This right is not absolute and may not apply where we have legal obligations to retain data.

11.4 Right to restriction of processing
You may ask us to suspend processing of your data in certain circumstances, such as while we investigate a complaint about accuracy.

11.5 Right to data portability
Where processing is based on consent or contract and carried out by automated means, you may ask us to provide your data in a structured, commonly used, machine-readable format for transfer to another controller.

11.6 Right to object
You have the right to object to processing based on legitimate interests, including profiling, and to object to direct marketing at any time.

11.7 Rights related to automated decision-making
You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce significant legal or similar effects. We do not currently carry out such processing, but if this changes we will update this policy.

To exercise any of these rights, please contact us using the details in section 1. We may need to verify your identity before acting on your request.
We will not charge a fee unless your request is manifestly unfounded or excessive. If we decline to act, we will explain why and tell you about your right to complain to the ICO.

12. Children’s Privacy
Our website, products & services are not directed at persons under the age of 18. We do not knowingly collect or process personal data relating to children.
If we become aware that we have inadvertently collected personal data from a person under 18, we will take steps to delete it promptly. If you believe we may have collected data about a child, please contact us immediately.

13. Third-Party Links
Our website may contain links to third-party websites, plug-ins, or applications. Clicking on such links may allow third parties to collect or share data about you.
We do not control these third-party websites and are not responsible for their privacy policies. We encourage you to read the privacy notice of every website you visit.

14. Changes to This Privacy Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated policy on our website with a new “Last updated” date, and where appropriate by emailing you directly. We encourage you to review this policy periodically.

15. How to Complain
If you are unhappy with how we have handled your data, please contact us in the first instance using the details set out in section 1 and we will do our best to resolve the matter.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

  • Website: www.ico.org.uk
  • Telephone: 0303 123 1113
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

This privacy policy was prepared with reference to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the Licensing Act 2003. It should be reviewed by a qualified solicitor before use.

© HORNEYWINK LIMITED 2026. All rights reserved.

Request Notification We will let you know when the product is back in stock. Please enter your email address below.