Last updated: 18 September 2026
This policy explains what personal information The Welsh Whisky Company Limited ("Penderyn", "we", "us") collects when you use penderyn.wales, our online shop at shop.penderyn.wales and our tour booking system, why we collect it, and the choices you have.
The Welsh Whisky Company Limited, trading as Penderyn Distillery. Registered in England and Wales, company number 03620949. Registered office: Penderyn Distillery, Pontpren, Penderyn, Aberdare, CF44 0SX. VAT registration number: GB 741 7147 39.
We are the data controller for the personal information described here. Questions about this policy or your data: email [email protected] or write to the address above, marked "Data Protection".
| When you | We collect | We use it to | Legal basis |
|---|---|---|---|
| Buy from the shop | Name, email, phone, billing and delivery address, order details, payment status (card details go directly to Shopify Payments; we never see them) | Fulfil and deliver your order, take payment, handle returns, keep accounting records, prevent fraud | Contract; legal obligation (accounting, alcohol licensing); legitimate interests (fraud prevention) |
| Book a tour or masterclass | Name, email, phone, booking details, party size, any access requirements you tell us | Run your booking, send confirmation and reminder emails, contact you about changes | Contract |
| Sign up to our newsletter | Email, optionally your first name | Send you news, releases and offers from Penderyn | Consent (unsubscribe at any time) |
| Join the Penderyn Club | Name, email, membership code, your gift choice | Run your membership, apply member discounts and benefits | Contract |
| Use the contact form | Name, email, subject, your message | Answer your enquiry | Legitimate interests (responding to you) |
| Visit the website | Anonymous, aggregated visit statistics (page, referrer, country, device type). No cookies and no personal identifiers. | Understand how the site is used | Legitimate interests |
We do not collect special-category data. We do not sell personal information.
Our products are for adults. You must be of legal drinking age in your country of residence to buy from us, and 18 or over to buy in the UK. We do not knowingly collect information from anyone under 18.
We share personal information only with providers who need it to deliver our services, under contracts that protect your data:
We may also disclose information where the law requires it (for example HMRC, trading standards or the police).
Some providers process data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Agreement, UK adequacy regulations or equivalent safeguards.
Under UK GDPR you can ask us to: access the personal information we hold about you; correct it; delete it; restrict or object to how we use it; provide it in a portable format; and withdraw consent at any time (for example by clicking unsubscribe in any marketing email). Email [email protected]. We respond within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Payment is handled by Shopify Payments, a PCI DSS Level 1 provider; we do not store card numbers. Our website and booking system use HTTPS throughout, and access to customer data is limited to staff and contractors who need it.
See our Cookie Policy.
We will post any changes here and update the date at the top. Significant changes will be announced on the site.
