Data Protection Policy

Blast Vintners Ltd is committed to protecting your personal data.

Customer data is protected and kept confidential. Names, email addresses and other data taken with customers full consent and are protected. In the event of a data breach, their are procedures to alert any affected parties.

There is a pro-active and new system in place to cope with individuals’ strengthened rights regarding access to and rectification or erasure of their data.

Summary:

Regarding data collected during the order process:

Data is only kept for as long as it meets the basis on which it was collected.
Data is kept accurate and up to date.
Data is only shared with 3rd parties where it is strictly necessary to process orders.
Sensitive data is sectioned off so that only approved personnel can access it.
There remains a right for clients to request all data is removed from the system where requested.

Any client has a right to request a copy of any data that is held  – if you as an individual wish to do so, please contact datacompliance@blastvintners.com

The GDPR will permit an individual to lodge a complaint with the supervisory authority where they believe that their data has been processed unlawfully.

We follow the below guidelines regarding data processing:

Article 6(1) of the GDPR sets out the conditions the must be met for the processing of personal data to be lawful. They are:
(a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by a controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This shall not apply to processing carried out by public authorities in the performance of their tasks.
These conditions are all equally valid and organisations should assess which of these grounds are most appropriate for different processing activities and then fulfil any further requirements the GDPR sets out for these conditions (GDPR Article 5).

For further information, please email datacompliance@blastvintners.com