Privacy Policy - The Wine and Spirit Trade Association

The General Data Protection Regulation GDPR means that there are significant changes to requirements in the laws governing the way we manage your personal data. This is a high priority for the WSTA. This privacy notice explains how we will process your personal information. It explains how we will protect your information and personal data, and the controls and safeguards we provide for this data. This includes understanding, at all times, precisely what data we are storing for and about you, who (if anyone) can see that data, and whether you give permission for that data to be shared with third parties. The processing of personal data, such as the name, address, e-mail address, or telephone number will always be in accordance with the General Data Protection Regulation (GDPR) and the Privacy and Electronic Communication Regulations (PECR). By means of this privacy statement, we set out the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of their rights by means of this privacy statement

Topics

1. Who we are
2. The information we collect about you, why we need it and who it’s shared with
• Website Users
• Members and Lapsed members
• Prospective Members
• Supporters and Sponsors
• Event attendees
• Webinar and virtual meeting participants
• Complainants and Enquirers
• Suppliers, Contractors, Consultants, Guest Speakers and Service Providers
• Employees, their Families and Dependents
• Applicants

3. Your privacy rights explained
4. Changes to our privacy policy
5. How to contact us or make a complaint

Who we are

The WSTA represents over 300 companies producing, importing, exporting, transporting, and selling wines and spirits in the United Kingdom. We campaign for a vibrant and sustainable wine and spirit industry, helping to build a future in which alcohol is produced,
sold, and enjoyed responsibly.

Our objectives include:

Promoting the trade in wines and spirits and other alcoholic liquors in the United Kingdom and in other parts of the world. To support and maintain the status of the Wine and Spirit Trade and the character, status, and interests of all persons, firms and companies engaged in any branch or section of the trade
Promoting the collaboration and co-ordination of various interest groups within the Wine and Spirit Trade and other similar or related trades.
Co-ordinating and assisting the work of affiliated associations promoting the interests of the Wine and Spirit Trade.
Assisting and encouraging research in connection with wines, spirits and other alcoholic liquors, to promote improvements in growing, making, manufacture, blending, distilling, rectifying, transportation, distribution and other relevant processes.
Advising Members on any matters relating to the Wine and Spirit Trade.
Establishing and promoting uniformity in commercial practices within the Wine and Spirit Trade.
Promoting the consideration and discussion of all questions affecting the Wine and Spirit Trade.

We are registered with the Information Commissioner’s Office (ICO) as a data controller with registration number Z4676859.

The information we collect about you, why we need it and who it’s shared with

• The information that we collect will only be used lawfully (in accordance with the Data Protection Act 1998 and the General Data Protection Regulation 2018).

• Unless required otherwise by law, your personal information will never be shared with any third party, other than other organisations and individuals who perform functions on our behalf or in partnership with us. These third parties are provided with personal information necessary to perform the task and may not use it for any other purpose.
• To prevent unauthorized access to your information, we have put in place physical, electronic and managerial procedures to safeguard and secure the information we collect.
• We want to respect your wishes about how, and if, you are contacted – whether by post, by phone or by email. You may tell us you do not wish to be contacted at all.

Website Users

Basis of processing: legitimate interest

1. The WSTA website does not collect personal data from you when you browse it. We use Google Analytics to understand how the website is being used and how, or from where, people arrived at our website. This data is collected using cookies. Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. The cookies we use do not contain any personal information that can be used to identify you. You can configure your browser so that cookies are not used automatically but, in a few cases, some of our website features may not function as a result.
2. Personal data will be collected when you use our website in the following ways:

• If you sign into our members area, we log the date of signing in against your user id. We can also keep track of what documents are downloaded and viewed.
• Failed login attempts to our members area (usually by forgetting, misspelling, or using the wrong username or password) will prompt our security app to log your IP address. The IP address is sent via end-to-end encryption to servers in the USA so that we can check the IP address against known blacklisted IP addresses. By doing this we can catch brute force attacks before they happen and keep our website secure. The IP address is deleted within 1 hour if it is not a known blacklisted IP.
• If you post a Job to the Jobs Board, we need to know who you are, your company details, how to contact you via telephone and/or email, and details relating to the job. We will also need to know how to apply for the job.
• If you subscribe to the WSTA blog, we need your name and email address.
• If you post an event on our Trade Diary, we need to know who you are, your company details, any additional organisers details, where the event is being held, what the event is called, a description of the event, who it’s for and how to contact you via telephone and/or email.

3. Our website includes links to other sites which may be of interest to you. This privacy policy only applies to the WSTA website. We cannot, and have not, reviewed the sites linked to our site and cannot be held liable for their content. Users link to, and use, other sites at their own risk. As the internet uses an open system, we cannot warrant that the site and downloads reach you virus-free. You must, therefore, take all appropriate precautions for your own safety

• The legal basis for processing your data under this head is ‘legitimate interest’.

• We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.

Members and Lapsed Members

Basis of processing: contract and legitimate interest

1. We collect business contact details when a business becomes a WSTA member. These contact details may include, but are not limited to, the business name and trading name, address(es), website address, telephone number(s), registered company number and VAT number (where applicable).
2. When a business becomes a WSTA member we also collect details of named contacts nominated by, and within, the business. This will include, but may not be limited to, a person’s name, work email address, work contact number(s) and job title.
3. When a business becomes a WSTA member they enter a contract and agree to the terms and conditions of membership. The WSTA provides that business with the membership benefits as stated – this includes contacting that business, via the nominated member(s) of staff, on areas that we consider may be beneficial to the business.
4. Data is collected when a business applies for membership, when staff members subscribe to publications, mailing lists or committees, register for an event, voluntarily complete surveys, request information, advice or guidance from us and/or when they provide feedback to us.
5. If members attend an event held by, hosted by or in conjunction with the WSTA, we may collect data relevant to that event e.g. dietary requirements for catering purposes. A guest list may also be provided if requested or required by the event organiser or venue for legitimate reasons e.g. for security purposes or entry into the building.
6. Members may be contacted to participate in surveys, polls, and/or qualitative research interviews (either online or in person). Results of this research may be published and shared with external parties. Any personal data collected will be anonymised. If members are contacted in this capacity and advise us that they do not wish to participate in our research, either at that time or on future occasions, we will make a note of this.
7. We only share your data with select 3rd parties as listed below.

a. Brevo – to provide our email mailing service. The information uploaded includes your name, email address, job title and organisation. We also sync which committees and mailing lists you are subscribed to so that we can email you relevant and opted-in information. Data uploaded to Brevo is updated at least fortnightly. Brevo are French-based and are fully GDPR compliant. Personal data entered in to Brevo will stay within the EEA.

b. CRM solution hosted by Centrepoint Computer Services Limited (t/a oomi) –to provide our Customer Relationship Database. Oomi abide by the current GDPR regulations, and they use AWS servers located in the UK.
c. We do not share your data with other 3rd party services. When data is submitted via Eventbrite, Zoom, Zapier and/or Typeform, this is submitted by you, not the WSTA, and falls under their relevant privacy statements. We use these services to provide event registrations, hosting, and survey solutions.

8. We want to respect your wishes about how, and if, you are contacted. We record details of which WSTA committees and mailing lists you are included in, newsletters you’ve requested to receive, along with other membership benefits. You may also tell us you do not wish to be contacted at all, and we will respect your wishes.
9. All the information we collect is kept confidential and is processed to deliver our membership benefits and any other requests received, along with providing you with member benefits and other information the WSTA considers appropriate and relevant to your business.

• The legal basis for processing your data under this head is ‘contract’, so that the WSTA can provide the services as part of membership. We also process information under this head based on ‘legitimate interest’, so that we can send you information that we consider may benefit you as a member or be of interest to you or the business.
• If a business is in membership, and a staff contact leaves, their business contact details will be deleted within 7 working days.
• After membership has ceased, we will keep data on that business indefinitely. Personal contact details for staff will not be kept other than the main contact and invoice contact.
• We do not use your personal data for any automated decision making.

Prospective Members

Basis of processing: legitimate interest

1. Prospective members refer to businesses who are not currently members of the WSTA and who the WSTA consider would benefit from being in membership, or at least from knowing more information about the WSTA.
2. We collect data about prospective members when you register for an event, when you provide feedback to us and when you contact us for information and/or advice.
3. We gather information on prospective members from various sources, such as articles that we read, internet searches, coming across them ‘organically’ i.e. a search that leads to other searches, because of recommendations from current WSTA members and/or by attendance at WSTA and non-WSTA events and training courses.
4. We only share your data with select 3rd parties as listed below.

• The legal basis for processing your data is ‘legitimate interest’, to respond to requests for advice and/or information and/or to provide you with information that we feel may benefit you by becoming a member of the WSTA or be of interest to you or your business.
• We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
• We do not use your personal data for any automated decision making or profiling.

Supporters and Sponsors

Basis of processing: legitimate interest

1. WSTA holds business contact details of non-member supporters. These include, but are not limited to, groups such as MP’s, MEP’s, MSP’s, Assembly Members, Councillors and their staff and any other people with a professional role in Parliament and/or politics. The details we hold will include, but may not be limited to, a person’s name, work email address, work contact number(s), job title and political party preference.
2. When applying for membership, applicants provide the business and contact details of two sponsors. These details include a contact name, company name and a contact email address. As part of the membership approval process, sponsors will be contacted via email, and asked to verify the relationship, trade or otherwise, with the applicant. They will be asked to supply any other information to support the application.
3. Data is collected when a supporter or sponsor supports a membership application, subscribe to publications, register for an event, voluntarily complete surveys, request information, advice or guidance from us and/or when they provide feedback to us.
4. We only share your data with select 3rd parties as listed below.

b. Brevo – to provide our email mailing service. The information uploaded includes your name, email address, job title and organisation. We also sync which committees and mailing lists you are subscribed to so that we can email you relevant and opted-in information. Data uploaded to Brevo is updated at least fortnightly. Brevo are French-based and are fully GDPR compliant. Personal data entered in to Brevo will stay within the EEA.
c. CRM solution hosted by Centrepoint Computer Services Limited (t/a oomi) to provide our Customer Relationship Database. Oomi abide by the current GDPR regulations, and they use AWS servers located in the UK.
d. We do not share your data with other 3rd party services. When data is submitted via Eventbrite, Zoom, Zapier and/or Typeform, this is submitted by you, not the WSTA, and falls under their relevant privacy statements. We use these services to provide event registrations, hosting, and survey solutions.
5. We want to respect your wishes about how, and if, you are contacted. We record details of any WSTA committees and mailing lists you are included in or newsletters you’ve requested to receive. You may also tell us you do not wish to be contacted at all, and we will respect your wishes.
6. All the information we collect is kept confidential and is processed to provide you with information the WSTA considers appropriate and relevant to you.

• The legal basis for processing your data under this head is ‘legitimate interest’, so that we can send you information that we consider may benefit you as a sponsor or supporter or be of interest to your business.
• We will keep supporter’s data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
• If you provide a sponsor reference for a WSTA member, we will keep your name, business name, email address, date of reference and the contents of your reference for the duration of that business’s membership with the WSTA. When the business leaves WSTA membership, we will keep their original contract, including your sponsor reference name, business name, and email address.
• We do not use any personal data for automated decision making or profiling.

Event attendees

Basis of processing: legitimate interest

1. If you attend, or sign up for an event hosted by, or in conjunction with the WSTA, we collect personal data which may include, but not be limited to, the participants name, business name (if relevant), job title, business address(es), business telephone number(s) and email address. We may also collect additional data relevant to that event e.g. dietary requirements for catering purposes. A guest list may also be
provided if requested or required by the event organiser for legitimate reasons e.g. for security purposes or entry into the building.
2. We only share your data with select 3rd parties as listed below.

• The legal basis for processing your data under this head is ‘legitimate interest’, to respond to your requests to attend our events.
• We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
• We do not use any personal data for automated decision making or profiling

Webinar and virtual meeting participants

Basis of processing: legitimate interest

1. If you take part in a webinar or virtual meeting hosted by the WSTA, we collect personal data which may include, but not be limited to, the participants name, business name (if relevant), job title, business address(es), business telephone number(s) and email address.
2. We only share your data with select 3rd parties as listed below.

a. Brevo – to provide our email mailing service. The information uploaded includes your name, email address, job title and organisation. We also sync
which committees and mailing lists you are subscribed to so that we can email you relevant and opted-in information. Data uploaded to Brevo is
updated at least fortnightly. Brevo are French-based and are fully GDPR compliant. Personal data entered into Brevo will stay within the EEA.
b. Zoom – to enable us to host webinars and virtual meetings. When you participate in a WSTA webinar or meeting via Zoom and enter personal data as part of the registration process, Zoom will store this data for the purpose of providing restricted access to that event only. This information is retained for 1 year for reporting purposes. Zoom does not sell this personal data. Zoom collects user data that is required to provide the Zoom service e.g. they collect information such as a user’s IP address and OS and device details. If the WSTA records a webinar or meeting session we may store this on WSTA servers or on Zoom servers which are based in the EEA (cloud-based recordings are auto-deleted within 90 days of recording). Zoom do not have access to these recordings. Zoom do not use data obtained on you for any advertising. They do use data obtained from you when you visit their marketing websites, such as zoom.us and zoom.com however you have control over your own cookie settings when visiting these sites. The WSTA does not use any third-party apps through Zoom.
c. CRM solution hosted by Centrepoint Computer Services Limited (t/a oomi) to provide our Customer Relationship Database. Oomi abide by the current
GDPR regulations, and they use AWS servers located in the UK.
d. We do not share your data with other 3rd party services. When data is submitted via Eventbrite, Zoom or Zapier and/or Typeform, this is submitted by you, not the WSTA, and falls under their relevant privacy statements. Weuse these services to provide event registrations, hosting, and survey solutions.

3. We want to respect your wishes about how, and if, you are contacted. You may tell us you do not wish to be contacted at all, and we will respect your wishes.
4. All the information we collect is kept confidential and is processed to deliver a service to you.

• The legal basis for processing your data under this head is ‘legitimate interest’, to respond to your requests to participate in a webinar or virtual meeting.
• We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
• We do not use any personal data for automated decision making or profiling

Complainants and Enquirers

Basis of processing: legitimate interest

1. We collect data about you when you provide feedback to us, when you contact us for information and/or advice or to make a complaint.
2. The personal data we collect may include, but not be limited to, your name, email address, phone number, mobile phone number and business name (if relevant).
3. We do not share your details with any 3rd parties.

• The legal basis for processing your data is ‘legitimate interest’, to respond to requests for advice and/or information and/or to respond to your complaint and/or to provide you with any other information requested by you.
• We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
• We do not use any personal data for automated decision making or profiling.

Suppliers, Contractors, Consultants, Guest Speakers and Service Providers

Basis of processing: contract and legitimate interest

1. We hold information about suppliers, contractors, consultants, guest speakers and service providers to enable us to employ your services or offer them to members.
2. The personal data we hold may include, but not be limited to, your name, trading name, job title, email address, phone number, mobile phone number and bank details.
3. The information is only disclosed to employees of the WSTA and contracted processors e.g. processing BACS transfers, sending postal mail and emails.

• The legal basis for processing your data is ‘contract’, while we are your customer or ‘legitimate interest’, where you are offering services to members but have no direct contract with the WSTA.
• When you are no longer an active supplier, the legal basis for processing your data is ‘legitimate interest’ because we may want to employ your services again.
• We will hold your personal data for 6 years after your last invoice to us, after which time we will either delete it or keep it if you have asked us to.
• We do not use your personal data for any automated decision making or profiling.

Employees, their families and dependents

Basis of processing: contract, consent and legitimate interest

1. We hold information about employees of the WSTA to enable us to employ, pay and manage your work. We also hold information about your next of kin in case of emergencies and about your family and dependents in relation to optional employee benefits.
2. While you work at the WSTA we hold information about your recruitment, about training and development, and about your performance. We keep information about any disciplinary proceedings.
3. Next of kin information and information about your family and dependents is destroyed when you stop working for WTSA. Other records are held for longer,
including the dates of your employment, so that we can provide references.
4. Information collected is not normally disclosed to anyone except the Chief Executive and the Director of Operations.
5. In case of a dispute, or for legal purposes, we may need to disclose this information to the authorities or to other legal professionals.

• The legal basis for processing your data is ‘contract’ whilst you are an employee, sometimes ‘legal requirement’ in case of certain records, such as payroll. Where we hold next of kin and family and dependent information, it is based on ‘consent’. The legal basis for storing your data after your employment has ceased is ‘legitimate interest’.
• We do not use your personal data for any automated decision making or profiling.

Applicants

Basis of processing: legitimate interest

1. As part of any recruitment process, the WSTA collects and processes personal data relating to job applicants.
2. The WSTA collects a range of information about you. This includes your name, address and contact details, including email address and telephone number; details of your qualifications, skills, experience and employment history; information about your current level of remuneration, including benefit entitlements; whether or not you have a disability for which the WSTA needs to make reasonable adjustments during the recruitment process; and information about your entitlement to work in the UK.
3. The WSTA collects this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment. The WSTA may also collect personal data about you from third parties, such as references supplied by former employers. The WSTA will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so.
4. Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).
5. The information is not normally disclosed to anyone except those on the hiring panel and the Director of Operations.
6. In case of a dispute, or for legal purposes, we may need to disclose this information to the authorities or to other legal professionals.
7. For unsuccessful candidates, we retain application data for up to 6 months after the recruitment exercise.

• The legal basis for processing your data is ‘legitimate interest’. The WSTA has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the WSTA to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. The WSTA may also need to process data from job applicants to respond to and defend against legal claims.
• We do not use your personal data for any automated decision making or profiling.

Your privacy rights explained

At any point while we are in possession of, or processing, your personal data, you, the data subject, have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you free of charge.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply, to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or that significantly affects you.
• Right to judicial review – if the WSTA refuses your request under rights of access, we will provide you with a reason as to why. You have the right to make a complaint as outlined below.

All the above requests will be forwarded on should there be a third party involved in the processing of your personal data.

Changes to our privacy policy

We keep our privacy policy under regular review, and we will place any updates on this web page. This privacy policy was last updated on 20 September 2023.

How to contact us or make a complaint

If you wish to exercise your rights or make a complaint about how your personal data is being processed by the WSTA (or third parties above) you should contact the WSTA in the first instance. If you wish to complain about the WSTA’s processing of your data, or how your complaint has been handled, you have the right to lodge a complaint directly with the ICO and the WSTA’s data protection representative:

WSTA
GDPR@wsta.co.uk
Unit 9 Baden Place,
Crosby Row,
London,
SE1 1YW
Tel: +44 (0) 20 7089 3877

Registered address:
Lynton House,
7-12 Tavistock Square,
London
WC1H 9LT

Information Commissioner’s Office
www.ico.org.uk
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

Wine and Spirit Trade Association. Registered address: Lynton House, 7-12 Tavistock Square, London WC1H 9LT
Correspondence address: International Wine & Spirit Centre, 39-45 Bermondsey Street, London SE1 3XF
Tel: +44 (0) 207 089 3877 / Email: info@wsta.co.uk
Registered Number: 410660 England Limited by Guarantee / VAT Number: GB 243 8280 60