PRIVACY NOTICE

This Privacy Notice sets out how Speymalt Whisky Distributors Ltd t/a Gordon & MacPhail processes your personal data.

Important information and who we are

The purpose of this Privacy Notice is to explain to you the reasons why we may hold, process and use your personal data and explain your rights under the current data protection laws. This Privacy Notice explains how we collect and use personal information about you, as our customer, potential customer or previous customer, visitors, suppliers and contractors, website users and dependents.

Speymalt Whisky Distributors Ltd t/a Gordon & MacPhail is the controller and responsible for your personal data. We are registered with the Information Commissioner’s Office (ICO’). Our registration number is Z7146187.

This Privacy Notice also applies to our subsidiaries: Gordon & MacPhail Ltd, The Cairn Distillery Co Ltd, The Benromach Distillery Co Ltd and the Red Door Gin Company Ltd. Speymalt Whisky Distributors Ltd and are subsidiaries are collectively referred to as "G&M", "we", "us" or "our" in this Privacy Notice.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact the DPO using the information set out below.

The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data about you which includes, but is not limited to the following:

• Identity Data includes first name, last name, any previous names, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data includes address, , email address and telephone numbers.
• Personal data relating to members of your family and household, where provided by you
• Financial Data includes bank account and payment card details.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• CCTV imagery and other imagery
• Health data, e.g. dietary and / or mobility requirement
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website.
• Marketing and Communications Data includes your preferences in receiving marketing communications from us and our selected third parties and your communication preferences.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

How is your personal data collected?

We use different methods to collect data from and about you including through:

G&M may collect personal information in a variety of ways including:

• Personal data which you have provided to us, such as when you interact with us, such as browsing or purchasing our products and services, when you book an event / tour, when you create an account, when you request that we send marketing communications to you, when you enter a competition or promotion, when you participate in surveys, when you provide us with feedback
• Information we receive from third parties, such as our subsidiaries, analytic providers, advertising networks and payment and delivery providers
• Information received from people purchasing goods or services on your behalf and colleagues

We may use this personal information in order to:

• Undertake and perform our obligations and duties in relation to the services we provide
• Enable us to supply you with the goods, services and information that you have requested
• Improve and develop the goods and services we offer
• Keep you updated on any changes to our services
• Monitor our performance in relation to service delivery
• Meet our legal obligations
• Keep you updated on any changes to our services
• Progress all other purposes consistent with the proper performance of our operations and business
• Contact you for your views on our goods and services
• Send marketing communications to you

If you do not wish to provide your personal data

If you have a contract / potential contract with us, you will need to provide us with certain required personal data. If you do not provide this information, this may prevent G&M’s ability to enter into or maintain a contract with you.

Who do we share your personal information with?

We may disclose your personal data to any of our employees, officers, contractors, insurers, professional advisors, agents, suppliers or subcontractors, selected third parties, insofar as reasonably necessary, and in accordance with data protection legislation.  

We may also disclose your personal data:

• With your consent;
• To the extent that we are entitled or required to do so by law;
• If we enter into a joint venture with or merge with another business entity, your information may be disclosed to our new business partners or owners;
• If we are conducting a survey of our products and / or service, your information may be disclosed to third parties assisting in the compilation and analysis of the survey results
• If required by law, we will disclose your information to statutory bodies such as courts and Police Scotland;
• If we are making an insurance claim following an incident, we may share your information with our insurers;
• Unless required to do so by law, we will not otherwise share, sell or distribute any of the information you provide to us without your consent; and
• Our subsidiaries.

We do not share your data with third party for marketing purposes.

How we use your personal data

What are the legal bases for us processing your personal data?  

We will only process your personal data on one or more of the following legal bases: 

• contract 
• consent 
• our legitimate interests (including CCTV imagery, radio communications, visitor access and monitoring, soft opt-in, surveys, profiling, auditors, dependents of our employees’ details, details regarding VIP clients and for hospitality purposes)  
• vital interests 
• public interest / official authority  
• where we have a legal obligation to do so  

Processing special category personal data  

Special categories of personal data means information about your racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; health; sex life or sexual orientation; criminal convictions, offences or alleged offences; genetic data; or biometric data for the purposes of uniquely identifying you.   

The special categories of personal information referred to above require higher levels of protection.  We need to meet additional legal requirements for collecting, storing and using this type of personal information. 

Our legal basis for processing your special category data is:

(a)        Explicit consent

(b)        Employment, social security and social protection (if authorised by law)

(c)        Vital interests

(d)        Not-for-profit bodies

(e)        Made public by the data subject

(f)         Legal claims or judicial acts

(g)        Reasons of substantial public interest (with a basis in law)

(h)        Health or social care (with a basis in law)

(i)         Public health (with a basis in law)

(j)         Archiving, research, and statistics (with a basis in law)

Opting out of marketing

You can ask to stop sending you marketing communications at any time by logging into the website and checking or unchecking relevant boxes to adjust your marketing preferences, by following the opt-out links within any marketing communication sent to you or by contacting us at dataprotection@gordonandmacphail.com.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes, for example relating to order confirmations for a product, booking reminders, updates to our Terms and Conditions and checking that your contact details are correct.

Cookies

For more information about the cookies we use and how to change your cookie preferences, please see our Cookie Policy

International transfers

Your information will only be processed within the United Kingdom except where international transfers are authorised by law.

Data security

When you give us information, we take steps to make sure that your personal information is kept secure and safe. All personal data is processed in accordance with G&M’s data protection policies and procedures. Our systems are password protected, and all electronic data is stored securely. All paper files are kept in locked cabinets.

Data retention

We review our data retention periods regularly and will only hold your personal data for as long as is necessary for the relevant activity, or as required by law and in accordance with our Data Retention Policy and Schedule and set out in any relevant contract we have with you.

Your data subject’s rights

You have the right at any time to exercise your data subjects’ rights in relation to the following:  

• the right to be informed
• the right to access
• the right to rectification
• the right to object to processing
• rights in relation to automated decision making and profiling
• the right to be forgotten
• the right to data portability
• the rights to restrict processing

When you make a request, we are required to verify your identity and may ask you for specific information to fulfil this purpose.  Normally, you will not need to pay a fee when you make any of the above requests, but we may charge a reasonable fee or refuse to comply if your request for access is clearly unfounded or excessive.

If you wish to exercise your right to access your information, or any other right, please contact our Data Protection Officer (‘DPO’) for more information.

It is important that the personal information that we collect, hold and use about you is accurate and current.  Please keep us informed of any changes by contacting our assigned DPO. 

If you wish to exercise any of the rights set out above, please contact our DPO dataprotection@gordonandmacphail.com.

Changes to the Privacy Notice and your duty to inform us of changes

We keep our Privacy Notice under regular review.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the Privacy Notice of every website you visit.

Queries and Complaints

We seek to directly resolve any queries or complaints about how we handle information and would request that they be directed, in the first instance, to

• Email address: dataprotection@gordonandmacphail.com
• Postal address: George House, Boroughbriggs Road, Elgin, IV301JY
• Telephone number: 01343 545111

Our Data Protection Officer is RGDP LLP and can be contacted either via 0131 222 3239 or info@rgdp.co.uk

You also have the right to complain to the Information Commissioner’s Office in relation to our use of your information. The Information Commissioner’s contact details are noted below:

Telephone: 0303 123 1113 

Online: Make a complaint | ICO

We keep this Privacy Notice under regular review and will place any updates on this website.

This Privacy Notice was last updated on 25/04/2025