Privacy policy

This policy explains what personal data Brewnook collects, why, who receives it, how long we keep it and what your rights are. It applies to brewnook.shop and to the e-mails we send.

Who is responsible

The data controller is the business that runs Brewnook, named at the foot of every page of this website. For anything about your data, use the contact form or write to business@brewnook.shop.

What we collect and why

When you order. Your e-mail address, your name, your delivery address (street, city, postcode, country) and a phone number with its country code; what you ordered, the prices, any promo code and the currency you paid in. We use this to take payment, have your order packed and delivered, send you order e-mails (confirmation, payment problems, shipping with tracking, delivery and refunds) and handle returns. Legal basis: performing our contract with you, and our legal obligation to keep sales records.

When you pay. Payment happens on the hosted page of our payment provider. Your card details are entered there and never reach us. We receive the payment's status and reference. To start the payment we send the provider your e-mail address, an order reference, your language and, where available, your IP address, which helps the provider prevent fraud. Legal basis: contract, and our legitimate interest in preventing fraud.

If you create an account. Your name, e-mail address and password. We store your password only as a one-way hash, so nobody at Brewnook can read it. We record failed sign-in attempts to protect your account from guessing. Legal basis: contract.

Your cart. The products in your cart, kept on our server and linked to your browser by a cookie, so the cart is still there when you come back. If you enter your e-mail address and tick the box to hear from us about your cart, we may send you one reminder e-mail if you leave items in your cart for two hours without ordering. We send that reminder only with your consent, and only once per cart. Legal basis: contract for the cart; consent for the reminder.

When you contact us. Your name, e-mail address, the topic, the order number if you give one, and your message, so we can answer you. Legal basis: our legitimate interest in answering questions, and contract where it concerns an order.

Analytics, only with your consent. If you choose "Accept analytics" in the cookie banner, Google Analytics measures which pages are visited and which products are viewed, added to the cart and bought, with the IP address shortened. If you choose "Essential only", no analytics run. See our cookie policy. Legal basis: consent.

Security. Our servers use your IP address in memory to limit repeated attempts (for example on sign-in, checkout and the contact form). Legal basis: our legitimate interest in keeping the shop secure.

We do not sell your data, we do not use it for advertising profiles, and we do not make automated decisions about you that have legal or similar effects.

Who receives your data

We share only what each recipient needs:

• Our payment provider, Trezuz, to take and refund payments.
• Our warehouse and fulfilment partner in the European Union, which packs and ships your order: your name, delivery address, phone number and the items ordered.
• The carrier that delivers your parcel: your name, delivery address and phone number, so it can deliver and contact you about the delivery.
• Our hosting and e-mail provider, Hostinger, which runs our servers and sends our e-mails.
• Google, for analytics, only if you accepted analytics.
• Authorities, where the law requires it, for example tax authorities.

Some of these providers may process data outside the United Kingdom or the European Economic Area. Where they do, they protect it with the safeguards the law requires, such as the European Commission's standard contractual clauses.

How long we keep it

• Orders and payment records: for as long as tax and accounting law requires, normally up to 10 years after the order.
• Accounts: until you ask us to close your account. Orders inside it are kept for the period above.
• Sign-in sessions: a session ends when you sign out or after at most 30 days.
• Carts: a cart is linked to your browser for 30 days after you last changed it. We delete the e-mail address of a cart that never became an order within 90 days.
• Contact messages: for up to 2 years after we answered, so we can follow up on the same question.
• Analytics: according to the retention set in Google Analytics, at most 14 months.
• Backups: copies of our database in backups are overwritten in the normal backup cycle.

Your rights

You have the right to:

• access the personal data we hold about you and receive a copy;
• correct data that is wrong or incomplete;
• delete your data, where we do not have to keep it by law;
• restrict or object to our use of your data, including use based on our legitimate interests;
• data portability: receive the data you gave us in a common machine-readable format;
• withdraw consent at any time, for example to analytics in the cookie settings or to cart reminders by writing to us. Withdrawing does not affect what happened before.

To use any of these rights, contact us or write to business@brewnook.shop from the e-mail address you used with us. We may ask you to confirm it is you. We answer within one month.

You also have the right to complain to a data protection authority, in particular in the country where you live: in the United Kingdom the Information Commissioner's Office (ICO), in France the CNIL, and in Germany the data protection authority of your federal state. We would appreciate the chance to sort out your concern first.

Security

All pages of this shop are served over an encrypted connection. Passwords are stored as one-way hashes; sign-in sessions, carts and guest order links use random tokens that we store only in hashed form. Staff who look after orders sign in with a password and a second factor, and access to customer details is limited and logged.

Children

Brewnook is not intended for children. We do not knowingly collect data from anyone under 16.

Changes

If we change this policy we publish the new version on this page. If a change is significant, we tell customers with an account by e-mail.