Privacy Policy

1. About us and this policy

CHW Cellars Ltd and its subsidiaries ("CHW Cellars", "we", "us") respect the privacy of our clients and of everyone who visits chwcellars.com ("our Site"). This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the choices you have, including how we use cookies.

We are the data controller for your personal data. We are bound by the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR"), each as amended by the Data (Use and Access) Act 2025.

CHW Cellars Ltd is registered in England and Wales under company number 14759139, VAT number GB438008895. Our registered office is 6 Walpole Crescent, Teddington, TW11 8PH. Our data protection contact is Luke, who can be reached:

By email at info@chwcellars.com

By telephone on +44 (0) 207 183 0443.

By post: 6 Walpole Crescent, Teddington, TW11 8PH

This policy covers our Site, our newsletter and our dealings with clients and enquirers. Our Site may link to other websites; we are not responsible for how they handle your data, so please read their privacy policies.

Our services and Site are intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18.

2. What personal data we collect

Personal data is any information that identifies you, directly or indirectly. We collect it in four ways.

  • When you contact us by email, phone or a form on our Site: your name, email address, phone number and anything you choose to tell us.

  • When you become a client: your name, contact details, delivery and billing addresses, company details where relevant, your wine interests and preferences, and a record of our correspondence and transactions with you. We hold this in our client relationship management system, HubSpot.

  • When you subscribe to our newsletter: your name, email address, the date and source of your sign-up, and whether you open our emails or click their links.

  • When you browse our Site: technical information such as your browser type, device, operating system, screen resolution, approximate location (derived from your IP address), the pages you visit and how you arrived. Some of this is collected through cookies, and only with your consent where the law requires it (see section 9).

We do not collect special category data (such as health, religion or ethnicity), and we ask you not to send it to us.

3. How we use your data and our lawful bases

We only use your personal data where the law allows. The table sets out each purpose and the lawful basis under the UK GDPR that we rely on.

  • Replying to your enquiry. We use your contact details and message on the basis of our legitimate interests in responding to people who contact us.

  • Sourcing, selling, storing and delivering wine for you. We use your client record and transaction history because this is necessary to perform our contract with you, or to take steps you ask of us before entering one.

  • Keeping accounting and tax records. We use billing details and transaction history to meet our legal obligations.

  • Managing our client relationships and understanding your preferences. We use your client record, correspondence and wine interests on the basis of our legitimate interests in providing a personal brokerage service.

  • Sending our quarterly newsletter. We use your name, email address and engagement data with your consent.

  • Measuring how our Site is used so we can improve it. We use analytics cookie data with your consent; analytics cookies are only set if you accept them.

  • Running our Site securely. We use technical data and strictly necessary cookies on the basis of our legitimate interests in operating a secure, working website.

  • Complying with legal requests and protecting our rights. We use any relevant data where we have a legal obligation or a legitimate interest in doing so.

Where we rely on legitimate interests, we have weighed our interests against yours, and you can object at any time (see section 8). We do not use your data for automated decision-making that has legal or similarly significant effects on you, and we do not sell your data.

4. Our newsletter

We send a newsletter. If you subscribe we may reach out on a personal basis to see if you’re interested in our services.

You can subscribe through the sign-up form on our Site, which is provided by HubSpot. We use HubSpot, with data hosted in the EU, to manage our subscriber list and send the newsletter. HubSpot records whether you open an email and which links you click, so we can see which content our readers value. We use this information in aggregate to shape future issues, not to build profiles for advertising.

You can unsubscribe at any time by clicking the "unsubscribe" link in any newsletter, or by emailing info@chwcellars.com. Unsubscribing does not affect our service to you as a client, and we will keep a record of your email address on a suppression list so we do not contact you again by mistake.

5. Who we share your data with

We share personal data only with trusted service providers who process it on our behalf, under written contracts that require them to keep it secure and use it only on our instructions.

  • HubSpot, Inc. provides our client relationship management system and sends our newsletter. Our HubSpot data is hosted in the EU.

  • Squarespace, Inc. hosts our Site and provides its forms and site analytics. Data may be processed in the US and the EU.

  • Google LLC and Google Ireland Ltd provide Google Analytics, Google Tag Manager and Google Search Console. Data may be processed in the US, the EU and elsewhere.

  • Microsoft Outlook provides our business email.

  • Couriers, storage facilities and merchants help us deliver and store wine you buy through us, in the UK and the wine's country of origin.

  • Professional advisers, such as our accountants, lawyers and auditors in the UK.

We may also share data if we sell, transfer or merge part of our business (the new owner may use it as described in this policy), or where the law, a court order or a regulator requires it.

International transfers. Some providers process data outside the UK. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies) or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard that applies.

6. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it, then delete or anonymise it.

  • Enquiries that do not lead to a client relationship are kept for 2 years from our last contact.

  • Client records and correspondence are kept for as long as you are a client, then for 6 years after our last transaction.

  • Accounting and tax records are kept for 6 years from the end of the relevant financial year, as required by law.

  • Newsletter subscriptions are kept until you unsubscribe; your email address is then kept on a suppression list only.

  • Google Analytics data is kept for 14 months.

  • Cookies last for the periods set out in section 9.

7. How we keep your data secure

We protect your data with appropriate technical and organisational measures. These include encrypted connections to our Site, access to client records limited to staff who need it, strong passwords with two-factor authentication on our systems, and choosing providers that meet recognised security standards.

No system is completely secure. If a breach affects your data and is likely to put your rights at high risk, we will tell you and the Information Commissioner's Office (ICO) as the law requires.

8. Your rights

Under data protection law you have the right to:

  • Be informed about how we use your data, which is the purpose of this policy.

  • Access the personal data we hold about you (a "subject access request").

  • Rectification: have inaccurate or incomplete data corrected.

  • Erasure: ask us to delete your data, where we have no overriding reason to keep it.

  • Restrict how we use your data in certain circumstances.

  • Object to our use of your data where we rely on legitimate interests, and to direct marketing at any time.

  • Withdraw consent at any time where we rely on it, for example by unsubscribing from the newsletter or changing your cookie settings. This does not affect anything we did before you withdrew it.

  • Data portability: receive data you gave us in a reusable format, where we process it by automated means on the basis of consent or contract.

To exercise any right, email info@chwcellars.com for the attention of The Secretary. There is normally no charge. We may ask you to confirm your identity first.

Subject access requests. We will respond within one month of receiving your request, or of receiving any identity check or clarification we need. For complex or numerous requests we may extend this by up to two further months and will tell you why. We will carry out reasonable and proportionate searches for your data. We may refuse, or charge a reasonable fee for, requests that are manifestly unfounded or excessive.

Complaints. If you are unhappy with how we have handled your data, please contact us first at info@chwcellars.com. We will acknowledge your complaint within 30 days, look into it promptly and let you know the outcome. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Cookie policy

We use a small number of cookies. Strictly necessary cookies are always on; analytics cookies are set only if you accept them in our cookie banner. We do not use advertising or cross-site tracking cookies.

What cookies are. Cookies are small text files a website stores on your device. Similar technologies, such as tags and scripts, work in the same way; we refer to them all as "cookies" here.

Strictly necessary cookies make the Site work: keeping it secure, remembering your cookie choices and handling forms. The law allows these without consent, and they cannot be switched off.

Analytics cookies tell us how visitors use the Site, such as which pages are popular and how people arrive, so we can improve it. They are only set if you choose "Accept" or switch analytics on in your cookie settings.

Cookies we use

Squarespace (strictly necessary):

  • crumb protects the Site against cross-site request forgery. It is deleted when you close your browser.

  • Cookie consent record remembers your cookie choices for up to 1 year.

Squarespace (analytics, set only with your consent):

  • ss_cvr identifies unique visitors and tracks sessions for site analytics. It lasts 2 years.

  • ss_cvt tracks the current visit for site analytics. It lasts 30 minutes.

Google Analytics (analytics, set only with your consent):

  • _ga distinguishes visitors so we can produce aggregate statistics. It lasts 2 years.

  • ga[ID] keeps track of the current session. It lasts 2 years.

HubSpot (analytics, set only with your consent):

  • __hstc, hubspotutk, __hssc and __hssrc are set by the HubSpot form on our Site. They track visits and link form submissions to your contact record, and last from the end of your session up to 6 months.

Google Tag Manager is a tool we use to manage the scripts on our Site. It does not set cookies itself and only loads Google Analytics after you consent.

Google Search Console helps us see how our Site appears in Google search results. It does not place cookies on your device.

Managing your choices. You can change your mind at any time using the "Cookie settings" link in the footer of our Site. You can also block or delete cookies in your browser settings; see allaboutcookies.org for how. Blocking strictly necessary cookies may stop parts of the Site working. To stop Google Analytics on every site you visit, you can install the Google Analytics opt-out browser add-on.

10. Changes to this policy

We may update this policy when the law changes or when we change how we use personal data. The current version will always be on this page, and we will tell clients and subscribers directly about any significant change.

This policy was last updated on 12 Oct 2026.