99W Wines Privacy Policy and Cookies Policy

We collect, use and store your personal data so that we can offer you the products and services you expect from us. We will always aim to be clear about what we do with your personal data. We collect your personal data for three main reasons: 1. To process any orders you make and to deliver those orders to you 2. To personalise, report on, and improve the products and services we provide 3. To send you special offers, which may be tailored to what you have told us you would like to hear about We promise: • You can control the personal data you provide to us • We will explain what personal data we collect from you, how we collect it, and how we will use it • We will only use your personal data for the purposes we originally told you about • We will only send you marketing communications if you have agreed that we can do so and we will provide you with the means of changing your preferences: click here to view and amend your preferences

99W Wines Ltd. ("99W Wines"), a private company registered in England and Wales with company number 12238592. Our registered office is: 8 Merchants Row, Bristol, BS1 6JN If you have any questions about how we look after your personal data, you can contact us by email at this address: dataprotection@99WWines.com

We collect your personal data in two main ways: (1) When you give it to us directly When you create a customer account, visit our website, communicate with us (including any telephone calls between our customer services teams and you), or purchase our products or services, you may choose to give us certain information. For example, when you give us your name and address, tell us about your wine preferences, or when clicking on active buttons such our when confirming to pay for an order. (2) When our systems collect information or personal data as you use our website, or websites or apps that are connected to our website. Whenever you use a website, app or other internet service, information gets recorded automatically by the IT systems used to operate that website, app or service. The most common type of information collected is in the form of cookies (small text files sent by your computer each time you visit our website) but can also include personal data transferred by the electronic device you use to access our website and its settings. The manufacturer of your device, or the provider of the operating system, will have details about what information your device shares with us.

We may collect the following information about you: • Your name, date of birth, and contact details. This can include your postal, billing, and delivery addresses (which would include the addresses of anyone you choose to send wine to), your telephone number(s), and your email address • Purchases and orders made by you • Your payment card details when you purchase our products or services • When you set up an account with us, your password and your marketing preferences • Your wine preferences and favourites • Your on-line browsing history on our website • Your correspondence with us including emails, letters and telephone calls In some instances, we may need to collect additional personal data for the purposes set out in this privacy policy.

We will need to process some of your personal data to fulfil any orders you place and to comply with the law. For example: • We will share your (or your recipient's) name, address and, where applicable, telephone number with our carriers • We will share your payment details with our bank or clearing house so that we can process payment for your order • We may occasionally share details with the police, or our trade body, for the purposes of preventing and investigating fraud

The law on data protection sets out a number of lawful bases for which a company may collect and process your personal data. Only 4 of these are relevant to us. 1. Personal data is processed on the basis of our legitimate interests 2. Personal data is processed on the basis of a contractual obligation 3. Personal data is processed on the basis of legal compliance 4. Personal data is processed on the basis of a person's consent Legitimate interests "Legitimate Interests" means the interests of our company in conducting and managing our business to enable us to give you the best products and services, and the best and most secure experience. When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. In addition to sending you marketing communications, we rely on our legitimate interests to process your personal data so that we can: • Improve our existing wine range, associated products and services, and develop new ones • Provide you with a quality customer service experience • Protect you, our employees and our business • Understand your likes and dislikes, what wines you want to hear about and how best to contact you to inform you about them • Manage insurance claims made by our customers • Taking legal action against any party in breach of its obligations to 99W Wines, and handling any legal claims or regulatory enforcement actions taken against 99W Wines • Handling customer contacts, queries, complaints and disputes Contractual Obligations In specific situations, we collect and process your data to comply with our contractual obligations. For example, if you order an item from us, we collect your address details, phone number and email and pass these to our couriers to deliver your purchase. Legal Compliance If the law requires us to, we may need to collect and process your data. For example, we may pass on your details to verify your age to ensure that we only sell products containing alcohol to those aged 18 or over. Consent We can collect and process your data with your consent. For example, when you tick a box to confirm that you are happy for us to share your data with third parties for marketing purposes. How and why do we use your personal data and on what lawful basis? We use your personal data: • On the basis of our contractual obligation to send you the wines and other products and services you have purchased; to manage any accounts you have registered with us so that we can provide you with products and services, you can place orders, and we can fulfil those orders and communicate with you about them • On the basis of our legitimate interests to improve the range of wines, offers and associated products we offer you and to help identify new products and services in the future to present you with personalised offers on our website, through social media channels and by placing banner advertisements on third party websites; to personalise the offers you receive from us – the wines you love, unique events, and special offers and promotions; to allow you to post links to our products on social media; to carry out research to better understand your views on our products and services • On the basis of our legal compliance to comply with the law (for example, to ensure that we only sell products containing alcohol to those aged 18 or over); to detect and prevent fraud and other illegal activities to verify your identity and your age.

So that we can provide you with our products and services, we have to share some of your personal data with certain third parties. When we share your personal data, we make sure that it remains secure: • Every external company we work with is required to have a contract with us which clearly describes our expectations about the way in which they keep your personal data secure, the purposes for which they can use your personal data and which holds them fully responsible for meeting those expectations • We will only send to third parties the personal data that is necessary for the purposes it is required for. We share your data as follows: With core service providers to enable our business to function We rely on a set of external companies to provide us with services that enable our business to run properly. Our core service providers include the courier companies we use to deliver our products to you; banks and clearing houses to process your payments; companies we use to carry out fraud protection and age verification checks; IT services providers; and companies that help us with our marketing. With social media companies for marketing purposes We may share information we hold about you with social media companies (such as Facebook) to enable them to display our advertisements to you. We will do so only if we have permission to send you marketing electronically. If you have opted out of email marketing, we will share your email address solely to ensure you do not receive advertisements on social media. With other partners when we have your consent to do so We work with a number of other third party companies to provide value to our business and to you. These companies may include our marketing partners who help manage communications with you and social media partners (for instance you can publish a link on Facebook or Twitter to any wines of ours that you have enjoyed). We will only partner with a company that meets our own high standards and that we think is a good fit for our business and our customers. Each of these third parties is required by the terms of the contract we have agreed with them to use your personal data only as we instruct it and to ensure that your personal data is secure. With regulators and law enforcement agencies when required to do so by law We are required to co-operate with regulators (like the Information Commissioner's Office or HMRC) and law enforcement agencies (like the police or the Serious Fraud Office). Although it does not happen often, regulators and law enforcement agencies can require us to share information with them as part of an investigation; this may include your personal data. We would have to disclose your personal data where we believe that disclosure is reasonably necessary to comply with the regulator or crime enforcement agency's demand. When we think it is reasonably necessary to protect you or us Occasionally businesses are subject to attempted criminal activities; this can affect both us and you. We will take all reasonable steps to protect you and our business but sometimes we may need to share your personal data where we think it is reasonably necessary to: • Detect, monitor, investigate or prevent any suspected illegal activities, fraud or security issues • Enforce our terms and conditions and to protect your and our rights and property • Investigate and defend any third party claims or allegations

We may use service providers outside the UK, in particular for the provision of IT services, and as a result we may transfer your data to suppliers in countries outside the UK. If we do share your personal data with service providers outside the UK, we will ensure reasonable safeguards are put in place to protect your personal data.

We will not keep your personal data for longer than is necessary for the purposes described in this policy. As a guide: • we will keep personal data while your account is active • Currently we retain data for 6 years from date of last purchase with us, but we may keep certain categories of personal data after your account is closed in order to meet any legal or regulatory requirements, or to resolve a legal dispute. • and, because of this, we may keep different types of personal data for different lengths of time (for instance, we may need to keep certain personal data relating to your purchases in order to comply with HMRC's VAT reporting requirements).

You have a number of rights under data protection laws; these are summarised below. • the right to be informed We need to be clear with you about how we process your personal data. We do this through this Privacy Policy, which we will keep as up to date as possible. • the right of access You can access the personal data we hold on you by contacting us at dataprotection@99WWines.com. To process your request, we will ask you to send us two forms of proof of identity so that we can be sure we are releasing your personal data to the right person. We will process your request within one month or, if the request is particularly complex, two months. We can provide you with a copy of your personal data in electronic format or hard copy. If we consider the frequency of your requests is unreasonable, we may refuse to comply with your request. In those circumstances, we would notify you of your right to complain to the Information Commissioner's Office. • the right to rectification We welcome feedback from you to ensure our records are as accurate and up-to-date as possible. If you think that the information we hold about you is inaccurate or incomplete please ask us to correct it by contacting us at dataprotection@99WWines.com or by updating your details at any time through the My Details section in your online account. We will process your request as soon as we receive it or within one month of receipt at the latest. • the right to erasure You can ask us to delete your personal data; however, this is not an absolute right. We can refuse to erase personal data which we need to keep (i) to comply with a legal obligation (for instance, we are required by HMRC to keep certain personal data for up to 6 years for VAT reporting purposes); and (ii) in relation to the exercise or defence of any legal claims. When you ask us to delete your personal data, we assume that you do not want to hear from us again. To ensure that we do not send you any special offers in the future (for example, if we purchased your details from a third party list), we will retain just enough of your personal data solely for suppression purposes. Other than as described above, we will always comply with your request and do so promptly. We would also notify any third parties with whom we have shared your personal data (for instance, our carriers for the purposes of delivering wine to you) about your request so that they could also comply. Some customers would still like to order our products but do not want to receive any marketing communications from us. This is not a problem as you can simply update your marketing preferences by contacting us through the preference centre in your online account. • the right to transfer your personal data (known as data portability) You have the right to move, copy or transfer your personal data from one organisation to another. We hold little information that would be much use to another wine merchant but if you do wish to transfer your personal data we would be happy to help. If you ask for a data transfer, we will give you a copy of your personal data in a structured, commonly used and machine-readable form (for instance, in a CSV file format). We can provide the personal data to you directly or, if you request, to another organisation. Please note that we are not required to adopt processing systems that are compatible with another organisation, so it may be that the recipient organisation cannot automatically use the personal data we provide. When making a transfer request, it would be helpful if you can identify exactly what personal data you wish us to transfer. We will comply with your request within one month or, if the request is complex or there are a number of requests from you, within two months. • the right to object If you would like us to stop processing your personal data for marketing purposes simply let us know by contacting us at dataprotection@99WWines.com or through the preference centre in your online account.

If you feel that your data has not been handled correctly, or you are unhappy with our response you have the right to lodge a complaint with the Information Commissioner's Office.

We may update this policy from time to time to take account of any new business activity or to reflect any changes in law or best practice in relation to data protection. We will notify you if we do so. This policy was last updated on 1st July 2021.

Cookies are tiny text files stored on your computer when you visit certain web pages. Please note that cookies can't harm your computer. We don't store personally identifiable information such as credit card details in cookies we create, but we do use encrypted information gathered from them to help improve your experience of the site. For example, they help us to identify and resolve errors, or to determine relevant related products to show you when you're browsing. At 99WWines.com we use cookies: 1. to keep track of what you have in your basket, and to remember you when you return to our site 2. as part of the security measures we use to protect your and other users' accounts, including preventing the fraudulent use of login credentials 3. analyse the performance of the website. To order products on 99WWines.com, you need to have cookies enabled. If you don't wish to enable cookies, you'll still be able to browse the site and use it for research purposes. We have relationships with carefully-selected suppliers who may also set cookies during your visit to be used for remarketing purposes - in other words to show you different products and services based on what you appear to be interested in. If you'd like to opt out, please go to the Network Advertising Initiative website (please note that we're not responsible for the content of external websites). For more information on cookies, visit the official ICO website at ico.org.uk or whatarecookies.com. Strictly necessary cookies - These cookies enable you to navigate our site and gain full access to its features and secure areas. Without these cookies essential services you have asked for like 'Your Basket' cannot be provided. Performance cookies - These cookies remember information about how you and other customers use our website. This gives us vital information such as which pages are visited most often and if customers are receiving error messages from certain pages. The role of these cookies is to allow us to analyse and improve the performance of our website ensuring you receive a consistent look, feel and shopping experience. Performance cookies (often known as web analytic cookies) don't collect any information that identifies the customer and all information collected is aggregated and therefore anonymous. Functionality cookies - These cookies remember choices you made on previous visits to our site such as your username, language or region so we can provide enhanced, more personal features. They can also be used to remember changes you've made to text size, fonts and other parts of web pages you can customise. Functionality cookies can also be used to provide services you have previously asked for such as watching videos or commenting on a blog. The information collected by these cookies may be anonymised and they cannot track your browsing activity on other sites. Targeting or advertising cookies - These cookies are used to deliver adverts more relevant to your personal interests. Alongside this they limit the amount of times you see an advert and measure the effectiveness of adverts. This means you won't keep seeing irrelevant adverts or the same adverts over and over. These cookies are usually placed by advertising networks with the website operator's permission. They remember that you have visited a website and the information is shared with other organisations such as advertisers. Quite often targeting or advertising cookies will be linked to site functionality provided by the other organisations that generate the advert. When one of these adverts is presented to you on a site there will be a quick and easy way to click in and opt out of receiving further adverts.