Privacy policy

1. Who we are

The North Hampshire Wine Society ("NHWS", "we", "us") is a members' society based in Hampshire, England. We are not a company; the society is run by a volunteer committee on behalf of its members.

For data protection purposes we are the data controller. If you have any questions about how we handle your data, please write to us at hello@nhws.co.uk.

2. What data we collect

Account information

When you create a member account you give us your name and email address. If you sign in with Google, we receive your name, email and profile picture from Google; we store the name and email.

Bookings and payments

When you book a place at an evening we record the tasting you booked, your member type (member, guest or new visitor), and the number of guests. Payments are processed by Stripe. We do not receive or store your card number, CVV or full card details at any point. After a successful payment Stripe tells us the card brand (e.g. Visa) and the last four digits, plus a Stripe payment identifier; we store only those.

Tasting notes and scores

If you use the digital tasting sheet during an evening, we store the scores (1–5) and any free-text notes you type for each wine, linked to your account and the tasting. It's yours to read back in your account, and yours to have deleted — ask us and it goes.

Attendance

We record which tastings you have attended. This helps us plan numbers and lets you see your history.

Optional: member directory

Members may opt in to a searchable directory visible only to other signed-in members. Participation is voluntary. You can withdraw consent and remove yourself at any time in your account settings.

Optional: newsletter

From time to time the committee emails members about upcoming tastings and society news. You're only on that list if you turn it on, and you can turn it off again whenever you like in your account settings — or email us and we'll do it.

Cookies and analytics

We don't run analytics on this site at the moment. If we add any it will be a privacy-friendly tool that doesn't track individuals and doesn't use advertising cookies. See our cookie notice for full details.

3. Why we process your data (lawful bases)

Under UK GDPR, we rely on the following lawful bases:

• Legitimate interests — running the society: processing bookings, managing attendance, keeping financial records, and maintaining the history of tastings. We have balanced these interests against members' privacy rights and concluded they are proportionate.
• Consent — sending the newsletter, and including you in the member directory. You can withdraw consent at any time without affecting your membership.
• Contract — where you have booked and paid for an evening, we process your data to fulfil that booking and provide a receipt.
• Legal obligation — retaining financial records as required by HMRC.

4. How long we keep your data

• Account data — kept while your account is active and for one year after you delete it, in case of billing queries. After that it is permanently deleted.
• Booking and payment records — kept for seven years to meet HMRC financial record requirements, then deleted.
• Tasting notes and scores — kept until you ask us to erase them, or until we delete your account.
• Attendance records — kept indefinitely in aggregate (e.g. total numbers per evening) but linked to your account only while it exists.
• Newsletter list — kept until you unsubscribe.

5. Who we share your data with

We do not sell your data. We use a small number of third-party processors to run the website:

• Stripe — payment processing. Stripe stores your full payment card details under their own PCI-DSS compliance. We send them your booking amount and receive back a payment confirmation and the card brand/last4. Stripe's privacy policy is at stripe.com/gb/privacy.
• Resend — email we send you (booking and refund confirmations, your membership welcome, your order receipt, and society updates the committee writes). We pass them your name and email address to send on our behalf. Their privacy policy is at resend.com/legal/privacy-policy.
• Sanity — content management. We use Sanity to manage the website's editorial content (upcoming tastings, pages). Sanity holds no personal member data. Their privacy policy is at sanity.io/legal/privacy.
• Google — if you choose to sign in with Google, Google provides your name and email to us. We do not send your data back to Google beyond the sign-in flow.

All processors are instructed to use your data only to provide the service we have contracted them for. No data is transferred outside the UK/EEA without appropriate safeguards.

6. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you. Email us at hello@nhws.co.uk and we will provide a copy within one month.
• Correct inaccurate data. You can update your name and email in your account settings; anything else, email us.
• Erasure ("the right to be forgotten") — email us and we'll delete your account. This removes your name, email, tasting notes and non-financial records. Booking records required for accounting (seven-year rule) are retained but de-identified. We aim to complete erasure within 30 days.
• Object to processing based on legitimate interests, or to receiving marketing.
• Portability — request a copy of your data in a machine-readable format.
• Withdraw consent at any time for any processing based on consent (newsletter, member directory) without affecting the lawfulness of past processing.

To exercise any of these rights, email hello@nhws.co.uk.

7. Cookies

We keep cookie use to a minimum. For the full details, see our cookie notice.

8. How to complain

If you are unhappy with how we have handled your data, please contact us first at hello@nhws.co.uk so we can try to resolve it.

You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113

9. Changes to this policy

If we make material changes we will notify members by email before they take effect. The "last reviewed" date at the top of this page will always reflect the most recent version.