Privacy Policy
How the Company collects, uses, and protects personal data on this site
Introduction and Scope
This Privacy Policy explains how pelaxorivo.com (referred to throughout as the Company) collects, uses, stores, and protects personal data obtained through the use of this website. The Company is committed to handling personal data responsibly and in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, and any other applicable data protection legislation in force in the United Kingdom. This policy applies to all personal data collected via pelaxorivo.com, including data submitted through contact forms, data collected automatically through the use of the website, and any data provided through correspondence with the Company.
By accessing and using this website, the user acknowledges that they have read and understood this Privacy Policy. The Company reserves the right to amend this policy at any time. Any changes will be published on this page and, where appropriate, notified to users directly. The user's continued use of this website following any amendment constitutes acceptance of the revised policy. Users who do not agree with any aspect of this policy should discontinue use of the website and contact the Company if they wish to exercise any rights in relation to data already collected.
Information the Company Collects
The Company collects two categories of personal data: information provided directly by the user and information collected automatically when the user accesses and navigates the website. The Company collects only the personal data that is necessary for the purposes described in this policy and does not collect sensitive categories of personal data as defined under applicable data protection legislation. The specific types of data collected in each category are described in the sections that follow. The Company does not purchase personal data from third parties or collect data from social media platforms without the explicit consent of the user.
Information Provided Directly
- • Name and contact details submitted through the website enquiry form, including first name, last name, email address, and telephone number where provided by the user.
- • The content of any message or enquiry submitted by the user through the contact form, including the nature of the enquiry and any specific questions or information volunteered by the user.
- • The area of interest and enquiry type selected by the user when completing the contact form, which assists the Company in directing the enquiry to the appropriate area of its work.
- • Any correspondence exchanged between the user and the Company by email or other written communication, including replies, follow-up messages, and any attachments provided by the user.
- • Preferences or settings information provided voluntarily by the user in the course of any interaction with the Company, including stated preferences regarding communication frequency or format.
Information Collected Automatically
- • The user's IP address and general geographic location, collected automatically when the user accesses the website, used to understand the geographic distribution of site visitors and to support security monitoring.
- • Browser type, version, and operating system information, collected to help the Company understand the technical environments in which the website is accessed and to support compatibility improvements.
- • Pages visited, time spent on each page, and navigation paths through the website, collected via analytics cookies to help the Company understand how users interact with site content and identify areas for improvement.
- • Referring website or search term that directed the user to pelaxorivo.com, where available, collected to help the Company understand how visitors discover the site and assess the effectiveness of its online presence.
- • Date and time of each visit to the website, recorded automatically as part of standard server logging and analytics processes to support security monitoring and site performance assessment.
How the Company Uses Personal Data
The Company uses personal data collected through this website only for the purposes described in this policy and only where a lawful basis for processing exists under applicable data protection legislation. The primary lawful bases relied upon are the legitimate interests of the Company in operating this website and responding to user enquiries, the performance of a contract or pre-contractual steps taken at the user's request, compliance with legal obligations, and, where applicable, the consent of the user. The Company does not use personal data for automated decision-making or profiling in ways that produce legal or similarly significant effects for the user.
- • Responding to enquiries submitted through the website contact form, including providing information about whisky cask maturation, directing users to appropriate resources, and following up where the user has indicated a wish to continue the conversation.
- • Improving the content, structure, and performance of this website based on aggregated and anonymised analytics data, in order to provide a better experience for all users who visit pelaxorivo.com.
- • Maintaining the security and integrity of the website, including monitoring for suspicious activity, preventing unauthorised access, and addressing technical vulnerabilities as they are identified.
- • Complying with legal and regulatory obligations applicable to the Company under UK law, including obligations relating to data protection, anti-money laundering, and any other applicable statutory requirements.
- • Communicating updates to this Privacy Policy or other legal documents governing the use of this website, where the Company determines that such communication is necessary or appropriate.
- • Conducting internal record-keeping and administrative functions necessary for the operation of the Company's activities, including maintaining records of correspondence with users and enquiries received.
- • Where the user has provided explicit consent, sending relevant updates or information about topics covered on this website, subject to the user's right to withdraw consent at any time without detriment.
Our Commitment: The Company is committed to processing personal data fairly, lawfully, and transparently. Personal data is collected only for specified and legitimate purposes, retained only for as long as necessary, and protected by appropriate technical and organisational security measures at all times. The Company does not sell personal data to third parties under any circumstances and does not use personal data for purposes incompatible with those described in this Privacy Policy.
Sharing of Personal Data
The Company does not sell, rent, or trade personal data with third parties for commercial purposes. Personal data may be shared with third parties only in the limited circumstances described in this section and only to the extent necessary for the specific purpose identified. Where personal data is shared with third-party service providers, the Company ensures that appropriate contractual safeguards are in place to govern the processing of that data and that the provider offers sufficient guarantees regarding data protection compliance. The Company remains responsible for personal data shared with third-party processors acting on its behalf.
Third-Party Service Providers
The Company engages third-party service providers to support the operation of this website and the management of user communications. These providers may process personal data on behalf of the Company in the course of providing their services and are permitted to use that data only for the specific purposes for which it has been shared. Service providers engaged by the Company include website hosting and infrastructure providers, email delivery and communication services, and website analytics providers. All such providers are contractually required to process personal data in accordance with applicable data protection legislation and to implement appropriate security measures to protect the data entrusted to them.
Disclosure Required by Law
The Company may disclose personal data to regulatory authorities, law enforcement agencies, or other public bodies where required to do so by applicable law, court order, or regulatory requirement. In such circumstances, the Company will disclose only the minimum personal data necessary to comply with the obligation and will, where legally permissible, notify the affected user of the disclosure.
Anonymised and Aggregated Data
The Company may share aggregated and fully anonymised statistical data about the use of this website with third parties for analytical or reporting purposes. Such data does not identify individual users and does not constitute personal data for the purposes of applicable data protection legislation. No individual user can be identified from the anonymised data shared in this manner.
Rights of the Data Subject
Under the UK General Data Protection Regulation and the Data Protection Act 2018, users whose personal data is processed by the Company have a number of rights in relation to that data. These rights are described in the following section. The Company will respond to requests to exercise these rights within one calendar month of receipt, in accordance with applicable legal requirements. Where a request is particularly complex or numerous, the Company may extend this period by a further two months, in which case the user will be informed of the extension and the reasons for it. The Company will not charge a fee for handling requests to exercise data subject rights unless a request is manifestly unfounded or excessive.
- • The right to request a copy of the personal data held by the Company about the user, along with information about how that data is being processed and the purposes for which it is used.
- • The right to request correction of any inaccurate or incomplete personal data held by the Company, ensuring that the data processed about the user is accurate and current at all times.
- • The right to request erasure of personal data held by the Company where the data is no longer necessary for the purposes for which it was collected, or where the user withdraws consent and no other lawful basis for processing applies.
- • The right to receive personal data provided to the Company in a structured, commonly used, and machine-readable format, and to request that such data be transmitted directly to another controller where technically feasible.
- • The right to object to the processing of personal data on grounds relating to the user's particular situation, where processing is based on the legitimate interests of the Company or carried out for direct marketing purposes.
- • The right to request restriction of processing in certain circumstances, including where the accuracy of the data is contested, where processing is unlawful, or where the data is no longer needed but the user requires it for legal claims.
To exercise any of the rights described above, the user should contact the Company using the contact details available on the contact page of this website. The user will be asked to provide sufficient information to verify their identity before the Company processes a request. If the user is dissatisfied with the Company's response to a data subject rights request, they have the right to lodge a complaint with the Information Commissioner's Office, the supervisory authority for data protection matters in the United Kingdom, at ico.org.uk.
Security of Personal Data
The Company takes the security of personal data seriously and implements a range of technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. No method of transmission over the internet or electronic storage is entirely secure, and the Company cannot guarantee absolute security. However, the measures described in this section reflect the Company's commitment to protecting personal data to a standard appropriate to the nature and sensitivity of the data processed. Users who believe that their personal data has been compromised should contact the Company immediately using the details provided on the contact page.
Technical Security Measures
- • Encryption of data transmitted between the user's browser and this website using industry-standard TLS protocols, ensuring that personal data submitted via contact forms is protected during transmission.
- • Access controls restricting access to personal data held by the Company to authorised personnel only, with access granted on a need-to-know basis and subject to regular review and audit.
- • Secure hosting of this website and associated data on infrastructure maintained by reputable third-party providers who implement their own security measures in accordance with applicable industry standards.
- • Regular monitoring of the website and associated systems for security vulnerabilities, with prompt remediation of any issues identified through monitoring, security assessments, or third-party disclosure.
Organisational Security Measures
- • Internal policies governing the handling, storage, and disposal of personal data, ensuring that all individuals with access to personal data understand their responsibilities under applicable data protection legislation.
- • Contractual requirements imposed on all third-party service providers who process personal data on behalf of the Company, including obligations regarding security standards and breach notification procedures.
- • Procedures for identifying, assessing, and responding to personal data breaches, including notification to the Information Commissioner's Office and affected users where required by applicable law.
- • Periodic review of this Privacy Policy and associated data protection practices to ensure continued compliance with applicable legislation and alignment with current guidance from the Information Commissioner's Office.
Retention of Personal Data
The Company retains personal data only for as long as is necessary to fulfil the purposes for which it was collected or to comply with applicable legal obligations. The specific retention periods applied to different categories of personal data are described in this section. Once personal data is no longer required for its original purpose and no legal obligation requires its continued retention, it will be securely deleted or anonymised in a manner that prevents identification of the individual concerned. Users may request deletion of their personal data at any time, subject to the Company's legal obligations and any overriding legitimate interest in retaining the data.
- • Enquiry and correspondence data submitted by users through the contact form is retained for a period of up to three years from the date of last contact, after which it is securely deleted unless a legal obligation requires longer retention.
- • Website analytics data, including aggregated and anonymised information about site usage and visitor behaviour, is retained for a period of up to twenty-six months from the date of collection, in accordance with standard analytics practice.
- • Email correspondence between the user and the Company is retained for a period of up to three years from the date of the most recent communication, unless the user requests earlier deletion and no legal obligation requires continued retention.
- • Any financial or transactional records created in connection with services provided by the Company are retained for a minimum of six years from the date of the transaction, in accordance with applicable statutory requirements under UK law.
- • Where the user has consented to receive communications from the Company, contact preference data is retained until the user withdraws consent, at which point the relevant personal data is removed from active mailing lists without undue delay.
Users who wish to request deletion of their personal data, or who have questions about the retention periods applied to their data, should contact the Company using the contact details provided on the contact page of this website. The Company will respond to all such requests within the timeframes required by applicable data protection legislation.
International Transfers of Personal Data
The Company endeavours to store and process personal data within the United Kingdom and the European Economic Area wherever possible. In certain circumstances, personal data may be transferred to, or processed by, third-party service providers located outside the United Kingdom. Where such transfers occur, the Company ensures that appropriate safeguards are in place to protect the personal data transferred, in accordance with the requirements of applicable data protection legislation. The safeguards relied upon by the Company for international transfers are described in this section.
- • Where personal data is transferred to countries that have received an adequacy decision from the UK Government or the European Commission, the Company relies on that decision as the basis for the transfer without requiring additional safeguards.
- • Where personal data is transferred to countries that have not received an adequacy decision, the Company ensures that appropriate safeguards are in place, including the use of standard contractual clauses approved by the Information Commissioner's Office or the European Commission.
- • Where personal data is transferred to third-party service providers located outside the United Kingdom, those providers are contractually required to implement security measures equivalent to those required under UK data protection law.
- • Users who wish to obtain further information about the safeguards applied to any international transfer of their personal data may contact the Company using the contact details provided on the contact page of this website.
Cookies and Tracking Technologies
This website uses cookies and similar tracking technologies to support its operation, to analyse how visitors use the site, and to remember user preferences. A cookie is a small text file placed on the user's device when they visit a website. Cookies do not contain personal data in isolation, but may be combined with other information to identify an individual user in certain circumstances. The Company uses cookies only for the purposes described in this policy and in the Cookie Policy published separately on this website. Users can manage their cookie preferences at any time through the consent tool available on this site or through their browser settings.
Types of Cookies Used on This Site
- • Strictly necessary cookies are required for the website to function correctly. They enable core functions such as page navigation and access to secure areas of the site. These cookies cannot be disabled as the website cannot operate without them.
- • Analytics cookies collect anonymised information about how visitors interact with this website, including which pages are visited and how long users spend on each page. This information is used to improve the performance and content of the site.
- • Preference cookies allow the website to remember choices made by the user, such as cookie consent decisions and display settings, in order to provide a consistent experience across visits to the site.
- • Functional cookies enable enhanced features on the website, including the ability to remember user selections within a single session. These cookies are set only where the relevant functionality is actively used by the user.
Users may withdraw consent for non-essential cookies at any time by adjusting their preferences through the consent tool available on this website or by modifying their browser settings. Withdrawing consent for certain cookies may affect the functionality and user experience of this website. For further information about the cookies used on this site, please refer to the Cookie Policy published at pelaxorivo.com.
Changes to This Privacy Policy
The Company reviews this Privacy Policy periodically and reserves the right to update or amend it at any time to reflect changes in applicable legislation, regulatory guidance, or the Company's data processing practices. Any amendments will be published on this page with an updated effective date. Where changes are material, the Company will take reasonable steps to bring them to the attention of users, which may include displaying a notice on the website or, where appropriate, contacting users directly. The user's continued use of this website following the publication of any amendment constitutes acceptance of the revised policy.
- • Where changes to this policy are required by amendments to applicable data protection legislation or regulatory guidance, the updated policy will be published on this page as soon as reasonably practicable following the relevant change in law or guidance.
- • Where changes reflect new data processing activities undertaken by the Company, users will be informed of those activities and the lawful basis relied upon before the new processing commences, where required by applicable law.
- • Where the Company engages new third-party service providers who will process personal data on its behalf, this policy will be updated to reflect those arrangements, and users will be informed of any material changes to the categories of data shared.
- • Users who have provided their email address to the Company may be notified directly of material changes to this Privacy Policy where the Company determines that direct notification is appropriate given the nature of the changes involved.
The Company encourages users to review this Privacy Policy periodically to remain informed of how their personal data is being processed. The date on which this policy was last updated is displayed at the bottom of this page. Users with questions about any aspect of this policy or about the Company's data protection practices are encouraged to contact the Company using the details available on the contact page of this website.
Contact the Company About Data Protection
Users who have questions about this Privacy Policy, who wish to exercise any of their rights as a data subject, or who have concerns about the way in which their personal data has been handled should contact the Company using the details provided on the contact page of this website. The Company will acknowledge all data protection enquiries promptly and will provide a substantive response within the timeframes required by applicable legislation. If a user is not satisfied with the Company's response, they have the right to make a complaint to the Information Commissioner's Office.
Pelaxorivo
9-10 St Andrew Square, Edinburgh, EH2 2AF, United Kingdom
Phone: +44(0)7932 851428
Email: content@pelaxorivo.com
This Privacy Policy was last reviewed and updated on September 26, 2026.
This Privacy Policy is effective from September 26, 2026 and applies to all personal data processed by the Company from that date.