Contact details
Compass Box Whisky Company
9 Power Road
London
W4 5PY UK
Tel: +44 (0)20 8995 0899
Fax: (0)20 8742 1948
Privacy Policy
Last updated: December 2025
Compass Box Delicious Whisky Ltd (company number SC205193) (“Compass Box”, “we”, “us”, “our”) takes your privacy very seriously and is committed to protecting your personal data. Compass Box is the data controller responsible for your personal data.
Our registered address is 4th Floor, 115 George Street, Edinburgh, EH2 4JN.
If you wish to contact us about this Privacy Policy or our data practices, please see the “CONTACT” tab in our main menu.
This Privacy Policy (together with our Cookie Declaration) explains how we collect, use and safeguard your personal data, including through our website (www.compassboxwhisky.com) (the “Website”) and through our AI-powered Whisky Guide (the “Chatbot”).
This Privacy Policy does not apply to third-party websites that may be accessible via links on our Website or Chatbot. Please ensure you check the privacy information on any third-party sites you visit.
TOPICS COVERED
- Data we collect from you or about you and our sources of that data
- Additional processing specific to our AI Chatbot
- Purpose and legal basis for processing
- Marketing
- Disclosure of your personal data
- International transfers
- Security
- Data retention
- Your legal rights
- Changes to this Privacy Policy
- How to contact us
1. Data We Collect From You or About You and Our Sources of That Data
We may collect, use, store and transfer the following categories of data about you.
Data you provide to us
You may give us personal data when you:
- fill in a form on our Website or via our Chatbot (including when accessing the Chatbot via QR code);
- subscribe to our newsletter;
- choose to receive marketing communications;
- enter a competition or prize draw;
- contact us by phone, email, social media or otherwise;
- provide comments, feedback or survey responses.
This may include:
- First and last name
- Email address
- Mobile number (including dialling code)
- Country of residence (and if in the US, your state)
- Date of birth or age confirmation (e.g., confirming you are 21+)
- Any other information you choose to give us
Data we collect automatically
When you use our Website or Chatbot, we may automatically collect:
- Device details, unique device identifiers
- IP address
- Browser type, version, time-zone settings, plug-ins
- Operating system, platform, mobile network information
- Log and usage information, including pages viewed, clickstream data, visit length, response times, interaction data (scrolling, clicks, mouse-overs)
Data from third parties
We may receive personal data about you from:
- Our online shop partner (if you purchase products through them)
- Social media platforms (according to your settings)
- Service providers assisting with analytics, advertising or marketing
Aggregated Data
We may create and use aggregated, statistical or demographic data that cannot identify you. If aggregated data is combined with identifiable data, we treat it as personal data.
2. Additional Processing Specific to Our AI Chatbot
When you access and use our Chatbot, we collect and process:
Chatbot Interaction Data
- Your messages, questions and conversation history
- Metadata such as timestamps, session IDs
- Your identity if you provided it via the Chatbot access form
Monitoring and Human Review
To ensure the quality, safety, legal compliance and improvement of our Chatbot:
- Your conversations may be reviewed by authorised Compass Box staff.
- Conversations may also be processed by our trusted service providers who host or support the AI system.
We will never use Chatbot conversation content for unrelated purposes, and we do not sell personal data to third parties.
Purposes for Chatbot-specific data
- To operate and deliver the Chatbot service
- To improve the accuracy, safety and performance of the Chatbot
- To respond to questions or follow up on your queries
- To maintain audit logs for security, fraud detection and age-restricted product compliance
- For internal analysis (e.g., FAQs, product interest trends), using anonymised or aggregated forms where possible
3. Purposes and Legal Bases for Processing Your Personal Data
We will only use your personal data when the law allows us to. Most commonly, we rely on:
- Consent
- Performance of a contract
- Legitimate interests
- Compliance with a legal obligation
Below is an overview of how we use your data.
|
Purpose of Processing |
Type of Data |
Legal Basis |
|
To provide access to and operate the Chatbot |
Name, contact details, Chatbot conversation data |
Consent (for processing personal data in the Chatbot) |
|
To respond to enquiries, correspondence, complaints, or requests |
Name, contact details, message content |
Legitimate interests – to manage interactions and improve our services |
|
To send you marketing communications you have opted in to |
Name, email, mobile number |
Consent |
|
To manage competitions, prize draws or surveys |
Name, contact details |
Performance of a contract |
|
To maintain Website and Chatbot security |
Technical and usage information |
Legitimate interests – ensure security and prevent misuse |
|
To analyse Website and Chatbot performance |
Technical and usage information, anonymised interaction data |
Legitimate interests – improve user experience |
|
To enforce age restrictions (21+) |
Date of birth/age confirmation, country of residence |
Legal obligation; legitimate interests – compliance with alcohol marketing rules |
|
To comply with regulatory or law-enforcement requests |
Any relevant data |
Legal obligation |
Where processing is based on consent, you may withdraw your consent at any time.
4. Marketing
We only send marketing communications where you have actively opted in.
- You may opt out at any time by using the unsubscribe link or by contacting us.
- We do not sell your data or share it with third parties for their own marketing.
Marketing consent is separate from Chatbot usage.
You may use the Chatbot without consenting to marketing.
5. Disclosure of Your Personal Data
We may share your personal data (where necessary and appropriate) with:
- Our online shop partner
- Service providers supporting our Website, Chatbot, CRM, analytics, email delivery or IT systems
- Professional advisers (lawyers, auditors, insurers)
- Regulators, government authorities or law enforcement where required
- Analytics or search engine providers assisting in optimisation of our services
All service providers operate under strict confidentiality and data-processing agreements.
We never sell personal data.
6. International Transfers
Your data may be transferred outside the UK/EEA (e.g., to the US) where necessary for hosting, support or service delivery.
We ensure adequate protection by using:
- Countries approved as providing adequate data protection; or
- Standard Contractual Clauses approved under UK/EU law.
You can contact us for more information on specific safeguards.
7. Security
We use appropriate technical and organisational measures to protect your data, including secure servers and access restrictions.
However, transmission of data over the internet can never be guaranteed 100% secure.
8. Data Retention
We retain personal data only as long as necessary for the purposes collected.
Indicative retention periods:
- Chatbot conversation logs: typically 12–24 months, unless legal or security requirements necessitate longer retention
- Marketing data: until you withdraw consent
- Competition/contractual data: for the duration required under contract and legal obligations
- Technical logs: short-term operational logs plus secure long-term logs for security and compliance
We may anonymise data for analysis, in which case it is no longer personal data.
9. Your Legal Rights
Under data protection law, you have rights including:
- Access to your data
- Rectification of inaccurate data
- Erasure (“right to be forgotten”)
- Restriction of processing
- Data portability
- Objecting to processing based on legitimate interests
- Withdrawal of consent, at any time
- Right to lodge a complaint with the Information Commissioner’s Office (ICO)
To exercise any rights, please contact us.
10. Changes to this Privacy Policy
We may update this policy from time to time. Changes will be posted on this page and, where appropriate, notified by email.
11. How to Contact Us
For questions, requests or concerns regarding this Privacy Policy or our handling of personal data, please contact:
Compass Box Delicious Whisky Ltd
3rd Floor Darpen House
3 Water Lane
Richmond
TW9 1TJ
Email: hello@compassboxwhisky.com
Phone: +44 20 8995 0899
