Privacy Policy

1. Introduction

Jerry Can Spirits Ltd ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we look after your personal data when you visit our website and tells you about your privacy rights and how the law protects you.

2. Data Controller

Jerry Can Spirits Ltd

Email: support@jerrycanspirits.co.uk

We are the controller and responsible for your personal data (collectively referred to as "Jerry Can Spirits," "we," "us," or "our" in this privacy policy).

3. Information We Collect

3.1 Information You Give Us

• Newsletter Signup: Email address, name (optional), marketing preferences
• Contact Forms: Name, email address, message content
• Age Verification: Confirmation that you are of legal drinking age in your region

3.2 The Expedition Log

The Expedition Log is an opt-in public registry for founding supporters. When you submit an entry, we collect your name, approximate location (town or city level), bottle type, and bottle number. This information is displayed publicly on our website.

The legal basis for processing this data is your consent, given when you submit the form.

Your location is passed to Mapbox to place your entry on the map. Mapbox's privacy policy is available at mapbox.com/legal/privacy.

To have your entry removed, email support@jerrycanspirits.co.uk. We will remove it within 7 days.

3.3 Information We Collect Automatically

• Technical Data: IP address, browser type, device information, operating system
• Usage Data: Pages visited, time spent, click patterns, referral sources
• Cookies: Session cookies, preference cookies, analytics cookies (with consent)

3.4 Trade account applications

If you apply for a trade account, we collect information about your business, premises licensing, primary contact, and one director or owner. This includes a copy of your premises licence and photo identification of a director or owner.

Lawful basis. We process this data to meet our legal obligations under HMRC’s Alcohol Wholesaler Registration Scheme (AWRS) due diligence requirements, and our legitimate interest in verifying the businesses we trade with.

Retention. Photo identification and premises licence copies are deleted from our systems 30 days after submission. Application details and verification records are retained for the life of the trade account and for six years after closure, in line with HMRC record-keeping requirements.

Recipients. This data is accessible only to Jerry Can Spirits directors. It is stored in Cloudflare R2 (United Kingdom and European Union regions) and Cloudflare D1.

Your rights. You can request access, correction, or deletion of your data by emailing hello@jerrycanspirits.co.uk. Deletion requests for active trade accounts will close the account.

3.5 Pour IQ™

If you hold a Pour IQ licence, we process the cocktail menu data you enter, including cocktail names, recipes, ingredient costs, sale prices, and the resulting analyses. Pour IQ now runs at app.pour-iq.co.uk; its full, current privacy policy is published at pour-iq.co.uk/privacy-policy and takes precedence for platform data.

Lawful basis. Contract performance — providing the menu analysis service your licence entitles you to.

Recipients. Cocktail menu data is sent to Anthropic PBC (United States) for AI-powered analysis. Anthropic does not train its models on API data per their commercial terms. Menus and analyses are stored in Cloudflare D1 (United Kingdom and European Union regions). Pour IQ data is strictly per-tenant — never shared between trade customers.

Retention. Menu and analysis data is retained for the lifetime of your Pour IQ licence and for two years after cancellation, then deleted. Individual menus can be deleted at any time from within Pour IQ. Scanned supplier invoice PDFs and their extracted line-item data are retained on the same schedule. This aligns with HMRC’s six-year VAT-records requirement.

International transfers. Data sent to Anthropic in the United States is protected under the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge). Anthropic is self-certified under that framework.

Your rights. You can request access, correction, or deletion of your Pour IQ data by emailing hello@jerrycanspirits.co.uk.

4. How We Use Your Information

4.1 Legal Basis for Processing

• Consent: Marketing communications, analytics cookies, optional data collection
• Legitimate Interest: Website functionality, security, essential analytics
• Legal Obligation: Age verification for alcohol-related content
• Contract Performance: Order processing, account management (future)

4.2 Purposes

• Send you marketing communications about our products (with consent)
• Provide and improve our website functionality
• Comply with legal requirements (age verification)
• Analyze website usage to improve user experience
• Respond to your inquiries and provide customer support
• Detect and prevent fraud and security threats

5. Cookies and Tracking

5.1 Cookie Categories

• Necessary Cookies: Essential for website functionality and age verification (no consent required)
• Analytics Cookies: Google Analytics and Google Ads for usage statistics and conversion tracking (requires consent)
• Marketing Cookies: Meta Pixel, Klaviyo, and Metricool for advertising, email marketing, and content analytics (requires consent)
• Third-Party Cookies: Trustpilot for customer reviews (requires consent), Cookiebot for consent management

5.2 Cookie Management

Your cookie preferences are managed through Cookiebot. You can review or change your preferences at any time using the Cookiebot icon on any page or the "Cookie Preferences" link in the website footer. You can also control cookies through your browser settings. For detailed information, see our Cookie Policy.

6. Data Sharing

6.1 Third-Party Services

• Shopify: Checkout, order processing, and customer accounts (Canada with global infrastructure) — Standard Contractual Clauses and UK-US Data Bridge
• Klaviyo: Email marketing platform (United Kingdom and United States regions) — UK adequacy regulations and Standard Contractual Clauses
• Resend: Transactional email delivery for trade application notifications (United States, with EU sending region) — Standard Contractual Clauses
• Anthropic PBC: AI analysis provider for Pour IQ (United States) — UK-US Data Bridge. Does not train models on API data.
• Sanity: Headless CMS hosting Field Manual content (United States with EU regions) — Standard Contractual Clauses
• Google Analytics / Google Ads: Website analytics and conversion tracking (USA) — UK-US Data Bridge and Google Ads Data Processing Terms
• Meta (Facebook) Pixel and Conversions API: Advertising and conversion tracking (USA) — UK-US Data Bridge and Standard Contractual Clauses
• Metricool: Social media and content analytics (Spain/EU) — GDPR-compliant
• Mapbox: Map rendering and location geocoding for the Expedition Log (USA) — Standard Contractual Clauses
• Cloudflare: Website hosting, CDN, R2 file storage, D1 database, Turnstile bot protection (United Kingdom and European Union edge regions for our services) — GDPR-compliant with Data Processing Addendum
• Trustpilot: Customer review platform (Denmark/USA) — Standard Contractual Clauses
• Sentry: Error monitoring and performance tracking (USA) — Standard Contractual Clauses
• Cookiebot (Cybot A/S): Consent management platform (Denmark) — GDPR-compliant, data processed within the EU

6.2 Legal Requirements

We may disclose your information if required by law, court order, or to protect our rights and safety.

7. Data Retention

• Expedition Log Entries: Until you request removal by emailing support@jerrycanspirits.co.uk
• Newsletter Subscribers: Until you unsubscribe or 3 years of inactivity
• Contact Form Data: 2 years for customer service purposes
• Analytics Data: 14 months (Google Analytics setting)
• Age Verification: 12 months via browser cookie
• Cookie Consent: 12 months or until consent withdrawn

8. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Access: Request copies of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restrict Processing: Request limitation of how we use your data
• Data Portability: Request transfer of your data
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, email us at support@jerrycanspirits.co.uk. We will respond within one month.

9. Data Security

We implement appropriate technical and organizational security measures to protect your personal data, including:

• SSL/TLS encryption for data transmission
• Secure hosting with regular security updates
• Access controls and authentication
• Regular security assessments
• Staff training on data protection

10. International Transfers

Some of our service providers are located outside the United Kingdom and the European Economic Area. We rely on the following transfer mechanisms depending on the provider:

10.1 UK or EU adequacy

Data processed by providers in the UK or EU (or in regions covered by a UK or EU adequacy decision) does not require additional safeguards. This applies to Klaviyo's UK infrastructure, Cloudflare's UK and EU edge regions, Cookiebot (Denmark), Metricool (Spain), and Sanity's EU regions.

10.2 UK-US Data Bridge

For US providers self-certified under the UK Extension to the EU-US Data Privacy Framework, we rely on the UK-US Data Bridge. This currently applies to Anthropic (Pour IQ AI analysis), Google (Analytics and Ads), and Meta (Pixel and Conversions API).

10.3 Standard Contractual Clauses

For US and other non-adequate destinations not covered by the UK-US Data Bridge, we rely on the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with UK Addendum. This applies to Shopify, Resend, Mapbox, Trustpilot, and Sentry.

For each transfer, we have assessed the destination's legal regime under the UK GDPR and concluded the safeguards provide protection equivalent to UK standards. You can request a copy of our transfer impact assessment by emailing support@jerrycanspirits.co.uk.

11. Age Restrictions

Our website is intended for individuals aged 18 and over due to alcohol-related content. We do not knowingly collect personal data from individuals under 18. If we become aware that we have collected such data, we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "last modified" date. For significant changes, we may notify you by email or through a prominent notice on our website.

13. Contact & Complaints

13.1 Contact Us

For any privacy-related questions or to exercise your rights:

13.2 Supervisory Authority

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF