WILLIAM GRANT & SONS PRIVACY STATEMENT

Who we are

This is the privacy statement of William Grant & Sons (Company Number SC131772). Our registered address is at the Glenfiddich Distillery, Dufftown, Banffshire AB55 4DH.

All references to "our", "us", "we" or "Company" within this policy are deemed to refer to William Grant & Sons Limited, its subsidiaries, affiliates and associates.

We own and operate www.glenfiddich.com

We are committed to protecting your personal data; your privacy matters to us. That is why we have developed this Privacy Notice to explain how we collect, use, share and store your personal information when you use this website, and to inform you about how we will look after that information. This includes any information you may provide us with when you sign up to keep in touch with us or take part in any competitions that we might run.

It is important that you take some time to read and familiarise yourself with this notice, together with our website terms and conditions and any other privacy or fair processing notices that we may provide on specific occasions when we are collecting or processing personal data about you. This will help you to be fully aware of how and why we are using your information.

If you do not agree with any term in this policy, please do not use the website or submit any personal information to or through it.

Types of personal information we collect

We may collect, use and store different types of personal information about you, which we have grouped together as follows:

Types of personal information	Description
Personal identifying	Your first name and last name.
Contact	Your billing and delivery addresses including postcode, your contact email and telephone numbers
Technical	Information sent to us as a result of connecting to our website, including internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
Financial	Your bank account and payment card details.
Transaction	Details about payments to and from you and other details of products and services you have purchased from us.
Contractual	Details about the services we provide to you.
Social-demographic	Details about your work or profession, nationality, education and where you fit in to various social or income groupings.
Usage	Information about how you use our website, products and services.
Marketing and Communications	Information about your preferences in receiving marketing from us and your communication preferences.

How we use your personal information

In general terms, we collect and use personal information to:

deliver our services and meet our legal responsibilities
verify your identity where this is required
contact you by post, email or telephone
understand your needs and how they may be met
maintain our records
process financial transactions

More specifically, the table below explains how we use your personal information and the reasons that we rely on in doing so. Where these reasons include legitimate interests, we explain what these legitimate interests are.

What we use your information for	Our reasons	Our legitimate interests
To deliver our services to make and manage customer payments To manage fees, charges and interest due on customer accounts To collect and recover money that is owed to us	Contractual performance Legitimate interests Legal obligations	Being efficient about how we fulfil our legal and contractual duties Complying with regulations that apply to us
To manage our relationship with you which may include asking you to leave a review of take a survey or notifying you about changes to our terms or privacy statement.	Contractual performance Legal obligations Legitimate interests	Keeping our records updated and to study how customers use our products/services)
To enable you to partake in a prize draw, competition or complete a survey	Contractual performance Legitimate interests	Being able to study how customers use our products/services, to develop them and to grow our business.
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising that we serve to you	Legitimate interests	To study how customers use our products/services to develop them, to grow our business and to improve our marketing strategy
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences	Legitimate interests	Defining types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy
To run our business in an efficient and proper way. This includes managing our financial position, business capability, planning, communications, corporate governance and audit	Legitimate interests Legal obligations	Being efficient about how we fulfil our legal duties Complying with regulations that apply to us
To exercise our rights set out in contracts and agreements	Contractual performance
To make suggestions and recommendations to you about goods or services that may be of interest to you	Legitimate interests	Developing our products/services and to be able to grow our business

Where we collect your personal information from

We may collect personal information about you (or your business) from the following sources:

Data you give to us e.g. by entering into any competitions that we may run on this site or completing online questionnaires or if you contact us directly, for example, regarding career vacancies, enquiries or other feedback.

Technical Data e.g. your IP address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.

Data we collect when you use our services e.g. payment and transaction information, identity and contact information, etc.

Data from third parties that we work with.

Information you post on public areas of our site and social media

Information that you post on or through any public areas of the website (such as chatrooms, bulletin boards or discussion forums) and on any social media pages that we operate is publicly available information. This means that it is generally accessible to, and may be collected by, others and may be used by them to send you unsolicited messages. We do not have control over if or how other people may use that information therefore you should use caution and ensure not to disclose personal information when using public web areas or social media. We will not be responsible for any postings that you make with personal information in them.

Who we share your information with

We may share your personal information with the following third parties:

payment processors and providers
members of our group of companies
agencies or third parties that we are partnering with to deliver events and services
third parties for the purpose of marketing, where you have provided consent
Security providers
Health & Safety providers

Information Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to any of our affiliated websites. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures.

Marketing

We aim to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

We will get your express opt-in consent before directly sending you marketing communications or before sharing your personal information with any third party for marketing purposes.

You can ask us or third parties to stop sending you marketing messages at any time by contacting us.

Where you opt out of receiving these marketing messages, this will not apply to personal information provided to us as a result of our providing of services to you.

If you choose not to give your personal information

If you choose not to give your personal information it may prevent us from being able to provide our services to you.

How long we keep your personal information

We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting obligations that we may have. We will only keep personal data for longer where there is a legal requirement for us to do so.

To determine how long we should keep your information for, we will consider the amount, type, and sensitivity of the personal information involved as well as the potential risk of harm if it is lost, or used or disclosed without authorisation. We will also consider the purposes for which we process your personal data and whether we can achieve those purposes through other means without the need to keep your data.

In some circumstances you can ask us to delete your data (see section on "Your rights" below for more information).

In some circumstances, we may also anonymise your personal data so that it can no longer be associated with you, for example for statistical purposes. Where we do this, we may use this information indefinitely without further notice to you.

Where we hold your personal information internationally

If you are based in the EU, we may transfer your personal information we collect about you to countries outside the EU in order to perform our contract with you. To ensure that your personal information receives an adequate level of protection we will put in place appropriate measures to ensure that your personal information is treated by third parties in a way that is consistent with and which respects EU and UK laws on data protection. If you require further information about these protective measures, you can request if from our Compliance Counsel.

If you are based outside the EU, we will collect your personal data in line with our global standards and your data will be processed both inside and outside the EU. To ensure that your personal information receives an adequate level of protection we will put in place appropriate measures to ensure that your personal information is treated by third parties in a way that is consistent with and which respects EU and UK laws on data protection and any local applicable laws.

Using our website

We collect and process the following information from our website:

details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that you access;

IP addresses – we will automatically receive your IP address when you visit the site; and

cookies – we will use cookies in accordance with our Cookies Policy you configure your browser not to accept them. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.

Where this website contains links to other sites, William Grant & Sons is not responsible for the privacy policies or practices of any third party. By clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Your rights

Access to your information – You have the right to request a copy of the personal information about you that we hold.

Correcting your information – We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.

Deletion of your information – You have the right to ask us to delete personal information about you where:

You consider that we no longer require the information for the purposes for which it was obtained

We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below

You have validly objected to our use of your personal information – see Objecting to how we may use your information below

Our use of your personal information is contrary to law or our other legal obligations.

Objecting to how we may use your information – You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest or pursuant to the legitimate interests of us or a third party then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

Restricting how we may use your information – in some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information but you don't want us to delete the data. Where this right to validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Portability – if we process personal information that you provide to us on the basis of consent or because it is necessary for the performance of a contract to which you are party, and in either case that processing is carried out by automated means, then you have the right to have that personal information transmitted to you in a machine readable format. Where technically feasible, you also have the right to have that personal information transmitted directly to another controller.

Automated processing – if we use your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual to whom you may make representations and contest the decision. This right only applies where we use your information with your consent or as part of a contractual relationship with you

Withdrawing consent using your information – Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.

Please contact us in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.

CALIFORNIA SPECIFIC PROVISIONS

Notwithstanding the information, disclosures, and obligations set forth above, if you are a California resident, California law may provide you with additional rights regarding our use of your personal information, as follows:

A. Sale of Data:

You have the right to know if any personal information of yours was sold (as defined by the California Consumer Protection Act) to a third party (including the identity of those third parties, the method of sale and what rights they were granted in the personal information). We will not sell your personal information to third parties if we have received and processed a request from you not to do so. To submit such a request, pursuant to the California Consumer Protection Act, please contact us by clicking here. DO NOT SELL MY PERSONAL INFORMATION.

We do not sell information about individuals we know are under age 16.

B. Do Not Track:

We do not track our customers or website users over time and across third party websites for the purpose of providing targeted advertising. We do not respond to Do Not Track (DNT) signals. However, some third party sites do keep track of your browsing activities when they serve you content, which enables them to tailor what they present to you. If you are visiting such sites, some browsers allow you to set the DNT signal so that third parties know you do not want to be tracked. If you would like any more information regarding our DNT policy, please contact our Compliance Counsel in writing.

C. Data Requests:

You may also submit requests for access, correction, erasure, objection, or restriction by calling us at (insert number). You must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. You do not need to create an account with us to submit a request. We will only use personal information provided in the request to verify the requestor's identity or authority to make it

Changes to our privacy statement

We keep this privacy statement under regular review and will place any updates on this website. We recommend that you check this page regularly to ensure that you have read the most recent version.

This privacy statement was last updated on 29/10/2021

Contact information and further advice

Our contact details are:

UK	EU Representative
William Grant & Sons Ltd The Old Court House, 7 Parkshot, Richmond TW9 2RF	William Grant & Sons Irish Brands Ltd 4th Floor Block D, Iveagh Court, Harcourt Road, Dublin 2, 662881

Complaints

We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner’s Office:

Online: https://ico.org.uk/global/contact-us/email/

By phone: 0303 123 1113

By post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Cookies notice

1. Information about our use of cookies

1.1. This policy explains how we use cookies on [insert website] (this “Website”). We recommend that you read our cookies policy so that you are aware of how we use them and can take steps to reject or delete the cookies if you do not agree to them being used.

1.2. Cookies are small text files stored on your device and used by website operators in order to make websites work, or work more efficiently, as well as to provide information to the operators of the website or certain third parties. Each cookie usually contains a unique string of characters, which allows a website to distinguish your browser or device from other users.

1.3. We use cookies to enable you to navigate between pages and to generally improve your user experience. We also use cookies to analyse how users interact with this Website, to enable you to share content using social media, and to provide you with embedded content from third parties. We also sometimes use cookie type technologies in emails to identify how users come to this Website so that we can evaluate and measure the effectiveness of our email marketing.

1.4. We may combine information collected via cookies with information such as your IP address, the type of browser, device and operating system, for example to provide statistical information about visitors to the Website. Where this Website uses third party cookies, you should check with the relevant third party to see how they use cookies (see section 3 below).

1.5. The cookies that we currently use on the Website are summarised in more detail below. We recommend that you read our cookies policy so that you are aware of how we use them and can take steps to reject or delete the cookies if you do not agree to them being used.

1.6. In this cookies policy, we use the term "cookie" to mean a cookie and any other similar technology, such as web beacons, local stored objects, and pixel tags.

2. Consent to the use of cookies

2.1. Cookies that are essential to the operation of the Website are set automatically. These are described in section 3.1 below.

2.2. We also use analytics cookies on this Website to help us understand how it is used. Our use of analytics cookies is described in section 3.2 below. Unless you use the cookie control to opt-out, the analytics cookies will be set automatically upon closing clicking "save and close" in the cookie control.

2.3. The other cookies described in this policy will only be set where you have given your consent. You can control your consent using the cookie control on the Website.

2.4. We may also remind you about our use of cookies and ask you to reconfirm your consent to cookies when you register for certain services or activate a certain function on the Website that relies on the use of cookies.

3. Cookies we use

We use the following cookies on this Website:

3.1. Strictly Necessary. These cookies are essential in order to enable you to move around the Website and use its features, such as accessing secure areas of the Website. Without these cookies, services that you have asked for cannot be provided. These cookies are set automatically.

3.2. Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around this Website when they are using it. This helps us to improve the way this Website works, for example, by ensuring that users are finding what they are looking for easily.

3.3. Functionality cookies. These are used to recognise you when you return to this Website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

3.4. Targeting cookies. These cookies record your visit to this Website, the pages you have visited and the links you have followed. We will use this information to make this Website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

3.5. Third Party Cookies. In addition to the cookies listed above, we also use the following third party cookies for performance and functional purposes, to provide additional function and to make it easier for you to share content on this Website. These are cookies that are set by a third party when you access this Website, and controlled by that third party.

3.6. A list of the cookies used on {Brand Name} can be found at the bottom of this notice.

4. Accepting and rejecting cookies

4.1. Other than those cookies listed as being strictly necessary for the operation of this Website, we will not deploy any cookies without your consent. You can provide consent through use of OneSpan technology or by amending your browser settings – more information on this is in section 4.3 below.

4.2. Some cookies are strictly necessary to allow you to use the website and its features, such as storing items in your basket. Without these cookies these features cannot be provided which may impair the functionality of the website meaning you are unable to shop on our website.

4.3. You can select the cookies you would like this website to store on your device by changing your browser settings. Each browser allows you to restrict or block cookies in different ways. Details on how to do this in each browser can be found on the ICO website (please note that we are not responsible for the content of external websites), visit: https://ico.org.uk/your-data- matters/online/cookies/.

4.4. Within most browsers you can utilise private browsing modes that typically do not save local data associated with the session, such as cookies. These are typically deleted when you close all the windows.

4.5. You can install a browser add-on to opt-out of Google Analytics in your browser across all websites (please note that we are not responsible for the content of external websites), visit: https://tools.google.com/dlpage/gaoptout

4.6. Please note that Cookie Control uses a cookie to remember your preferences. If you clear any cookies from your browser or device then you will need to reactivate your Cookie Control preferences when you next visit this Website.

Changes to this policy

This cookies policy may be amended by us at any time. Please check this page periodically so that you are aware of any changes.

Contact us

6.1. For further information from us on any of this cookies policy or for any queries relating to them, please contact us by email at dataprotection@wgrant.com or write to us at William Grant & Sons Ltd, The Old Court House, 7 Parkshot, Richmond TW9 2RF.

Cookie Name	Cookie Purpose	More Information
_qca	Quantcast. This cookie may use your computer’s IP address, pixel code, referring HTTP location, current HTTP location, search string, time of the access, browser’s time, any searches made on the applicable website, and other statistics” in order to “analyze Log Data from different websites and combine it with other non Personally Identifiable Information to produce the Reports that are made available on the Quantcast.com Site, to enable web publishers and advertisers to deliver audience segments that are appropriate for their products or services.	Click here for an overview of privacy at Quantcast https://www.quantcast.com/privacy/
__utma __utmb __utmz __utmc _utm*	Google Analytics. Google Analytics. These cookies are used to collect information about how visitors use our Website(s). The cookies collect information in an anonymous form, including the number of visitors to the Website(s), where visitors have come to the Website(s) from and the pages they visited.	Click here for an overview of privacy at Google
_ga _gid	Google Analytics uses these cookies to distinguish between users	Click here for an overview of privacy at Google
ym_uid	Yandex Metrica, as above.	Click here for an overview of privacy at Yandex https://yandex.com/legal/privacy/
BVBRANDID BVImpl_mainsite	BazaarVoice. These cookies enable user-generated content submission e.g. product reviews.	Click here for an overview of privacy at BazaarVoice https://www.bazaarvoice.com/legal/privacy-policy/
_atuvc	AddThis Social Sharing widget enable visitors to share content with a range of networking and sharing platforms.
age_gate	Glenfiddich. This cookie shows that the user has passed the age gate and the contains their date of birth and country.
dob	Glenfiddich. This cookie shows that the user has passed the age gate.
GatedContentLogin	Glenfiddich. This cookie gives member users access to member content.
PastMember	This cookie identifies a user with a Glenfiddich account.	Checkout locale for templates
PHPSESSID	Glenfiddich. PHP Session cookie that helps pass information across page changes	Checkout Session ID
verified_locale	This cookie keeps the user on the country website they selected on the age gate.	This cookie name is associated with the Netscaler load balancing service from Citrix. This is a pattern type cookie with the root being NSC_ and the rest of the name being a unique encrypted alpha numeric identifier for the virtual server it originated from. The cookie is used to ensure traffic and user data is routed to the correct locations where a site is hosted on multiple servers, so that the end user has a consistent experience.
mxmroi	This cookie is set by Maxemail, our marketing email service provider.	Click here for an overview of privacy at Maxemail https://maxemail.xtremepush.com/cookies-and-privacy-policy/