Privacy
About this notice
Shepherd Neame Limited ("Shepherd Neame", "we", "us" or "our") is committed to protecting privacy and handling personal information responsibly. This notice explains how we collect, use, store, share and protect personal information when people:
- visit www.shepherdneame.co.uk (the Website);
- buy our products or services;
- book a pub, hotel stay, brewery tour, event or experience;
- purchase gift cards or merchandise;
- contact us with an enquiry; or
- sign up for news, offers or marketing communications.
Shepherd Neame Limited is registered in England and Wales under company number 00138256.
Our registered office is: 17 Court Street, Faversham, Kent, ME13 7AX.
For UK data protection law, Shepherd Neame Limited is the data controller and is registered with the Information Commissioner’s Office under registration number Z8649859.
Information we collect
Information provided directly
- name and contact details, including postal address, email address and telephone number;
- booking and order details;
- purchase history;
- marketing preferences; and
- information provided when contacting us.
Information collected automatically
When someone visits our Websites, we may collect:
- IP address;
- browser and device information;
- Website usage information; and
- cookie and tracking data.
Further detail is provided in our Cookies Policy and through the Website cookie settings.
How we use information
- process orders, bookings and payments;
- provide products, services and customer support;
- manage brewery tours, hotel stays, pub bookings and events;
- respond to enquiries and requests;
- improve our products, services and Website;
- maintain the safety and security of customers, visitors and our business;
- meet legal and regulatory obligations; and
- send marketing communications where the individual has chosen to receive them or where otherwise permitted by law.
Lawful bases for processing
UK GDPR requires a lawful basis for each use of personal information. Depending on the purpose and circumstances, we rely on one or more of the following:
Purpose: Processing orders and bookings
Lawful basis: Contract
Purpose: Providing customer support
Lawful basis: Legitimate interests
Purpose: Improving our websites and services
Lawful basis: Legitimate interests
Purpose: Sending marketing communications
Lawful basis: Consent or as otherwise permitted by law
Purpose: Preventing fraud and protecting security
Lawful basis: Legitimate interests
Purpose: Meeting legal and financial obligations
Lawful basis: Legal obligation
Marketing communications
We may contact people about products, services, events, offers and experiences that may be of interest where consent has been provided or where contact is otherwise permitted by law. Marketing preferences can be changed at any time by using the unsubscribe link in an email or contacting us using the details in section 15.
Withdrawing consent does not affect processing carried out before it was withdrawn.
Sharing information
We may share personal information with trusted third parties that help us operate our business and provide services, including:
- payment providers;
- booking and reservation providers;
- technology and hosting providers;
- marketing and communications partners;
- professional advisers and auditors; and
- regulatory, legal or law-enforcement authorities where required.
Where independent operators, tenants or third-party partners provide services directly, they may act as separate data controllers and publish their own privacy notices.
We do not sell personal information.
International transfers
Some service providers may process personal information outside the United Kingdom. Where this happens, we put appropriate safeguards in place to protect the information and meet UK GDPR requirements.
How long we keep information
We keep personal information only for as long as necessary. Retention depends on the type of information, why it was collected and applicable legal or regulatory requirements. Examples include:
- customer enquiries: typically up to 24 months;
- marketing preferences: until consent is withdrawn and for a limited period afterwards to maintain suppression records;
- booking, transaction and financial records: typically up to seven years where required by law; and
- Website analytics data: typically up to 26 months.
When information is no longer required, it is securely deleted or anonymised.
Cookies and Website tracking
Our Website uses cookies and similar technologies to make the Website function, understand how visitors use it, improve the user experience and support marketing or advertising where consent has been provided. Cookie preferences can be managed at any time through the Website cookie settings.
Automated decision-making and profiling
We may analyse customer preferences and interactions to improve products, services and communications.
We do not make decisions that have a significant legal or similar effect on individuals solely through automated processing.
Children’s privacy
Our Website and services are primarily intended for adults. We do not intentionally collect personal information directly from children unless this is necessary for a specific booking, event, competition or another clearly explained purpose. Where children’s personal information is used, we apply appropriate safeguards that take account of the child’s age and best interests and comply with applicable data protection law.
Individual rights
Under UK GDPR, individuals may have rights to:
- access their personal information;
- correct inaccurate or incomplete information;
- request deletion in certain circumstances;
- restrict or object to processing in certain circumstances;
- withdraw consent for marketing communications;
- receive certain information they provided in a portable format where applicable; and
- seek safeguards and human involvement in relation to qualifying solely automated decisions.
Rights depend on the circumstances and applicable law. Not every right applies in every situation. Requests can be made using the contact details in section 15.
Security
We use appropriate technical and organisational measures to protect personal information from unauthorised access, loss, misuse or disclosure. No online service can be completely secure, so we continually review and improve our practices to protect the information entrusted to us.
Complaints
Please contact us first if you are unhappy with how personal information has been used so that we can investigate and seek to resolve the concern. Individuals also have the right to complain to the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Contact us
For questions about this notice or to exercise data protection rights, contact:
Data Protection Team
Shepherd Neame Limited
17 Court Street
Faversham
Kent
ME13 7AX
Telephone: +44 (0)1795 532206
Email: [email protected]
IT Servicedesk: [email protected]
Changes to this notice
We may update this notice to reflect changes in our services, technology, legal requirements or business operations. The latest approved version will be published on our Website.
ICO guidance and reference sources
This notice should be reviewed with current ICO guidance. Guidance may change, so the controlled online source should be checked during each material review.