Privacy policy

Last updated: 26 September 2026

1. Who we are

This privacy policy explains how CASC Whisky Ltd (“we”, “us”) collects and uses your personal data when you visit this website or buy from us. We are the data controller for this processing. We are registered in Scotland (company number SC801677), and our registered office is Bearford House, 39/2 Hanover St, Edinburgh, EH2 2PJ, United Kingdom. For any privacy question or request, email info@cascwhisky.com.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

2. The personal data we collect

  • Contact and order details: your name, billing and delivery addresses, email address, phone number and the products you order.
  • Age confirmation: your confirmation that you are 18 or over, and any proof of age checked on delivery.
  • Payment details: payments are processed by our payment providers. We do not see or store your full card number.
  • Account details: if you create an account, your login details and order history.
  • Communications: messages you send us, for example about an order.
  • Technical and usage data: your IP address, device and browser information, and how you use the website, collected through cookies and similar technologies (see section 7).

3. How we use your data and our lawful bases

  • To process, deliver and support your order, including handling returns and refunds. Lawful basis: performance of our contract with you.
  • To meet our legal obligations, including preventing sales of alcohol to people under 18, keeping tax and accounting records, and responding to lawful requests from authorities. Lawful basis: legal obligation.
  • To keep our website and payments secure and prevent fraud. Lawful basis: our legitimate interests in running a safe business.
  • To send you marketing emails, only if you have opted in. You can unsubscribe at any time using the link in any email. Lawful basis: consent.
  • To understand how our website is used and to show you relevant advertising, only where you have accepted analytics or marketing cookies. Lawful basis: consent.

4. Who we share your data with

We share personal data only where needed, with:

  • Shopify, which hosts our online store and processes order and payment data on our behalf;
  • payment providers, to take payment and prevent fraud;
  • fulfilment partners, who store our stock and pack and dispatch your order;
  • delivery companies, to deliver your order and carry out age checks on delivery;
  • professional advisers and authorities, such as our accountants, HMRC or the police, where required by law.

We never sell your personal data.

Shopify also uses some data for its own purposes as an independent controller, as described in the Shopify Consumer Privacy Policy.

5. International transfers

Some of our service providers, including Shopify, process data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

6. How long we keep your data

We keep order and transaction records for as long as we need them for tax, accounting and legal purposes, normally six years after the end of the financial year in which the order was placed. We keep marketing data until you unsubscribe, and account data until you ask us to close your account. We keep other data only for as long as we need it for the purposes above.

7. Cookies

We use cookies and similar technologies on this website. Strictly necessary cookies make the store work, for example by remembering your basket and keeping checkout secure; these do not need your consent. We only use analytics, preference and marketing cookies if you accept them in our cookie banner. You can change your choices at any time through the cookie preferences option on this website, and you can also block or delete cookies in your browser settings.

8. Your rights

Under UK data protection law you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased, in certain circumstances;
  • restrict or object to our processing, in certain circumstances;
  • receive your data in a portable format; and
  • withdraw your consent at any time, where we rely on consent.

To make a request, email info@cascwhisky.com. We will respond within one month.

9. Children

This website is not intended for anyone under 18, and we do not knowingly collect personal data from people under 18.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

11. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page.