Privacy Notice

Last updated 24 April 2026

Thank you for choosing to be part of our community at The Cotswold Brewing Company Ltd, doing business as Hawkstone ("Hawkstone," "we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this privacy notice or our practices with regard to your personal information, please contact us at info@hawkstone.com

This privacy notice describes how we might use your information if you visit our website at www.hawkstone.com or engage with us in other related ways including as customers, potential customers, clients, business contacts, or attendees at our events.

In this privacy notice, if we refer to:

"Website," we are referring to any website of ours that references or links to this policy

"Services," we are referring to our website, and other related services, including any sales, marketing, or events.

The purpose of this privacy notice is to explain to you in the clearest way possible what information we collect, how we use it, and what rights you have in relation to it. Please read this privacy notice carefully, together with our other published privacy information, to help you understand how we use your personal data and know your rights under data protection law.

1. What Information Do We Collect?

Personal information provided by you

We collect personal information that you voluntarily provide to us when you register on the Website, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Website or otherwise when you contact us, as follows:

Identifying details: first name, last name, any previous names, login details, marital status, title, date of birth and gender.

Contact details: billing address, delivery address, email address and telephone numbers.

Transaction details: records of payments to and from you and details of products and services you have purchased from us.

Profile and usage details: purchases or orders made by you, your interests, preferences, feedback and survey responses, and information about how you interact with and use our website, products and services.

Marketing preferences: your preferences in receiving marketing from us and our third parties and your communication preferences.

Payment details: All customer payments are managed within Shopify who process payments using Shopify Pay and Paypal. You may find their privacy notice links here:

https://www.shopify.com/legal/privacy
https://www.paypal.com/myaccount/privacy/privacyhub

Personal information collected automatically

Some information is collected automatically when you visit our Website. This information does not reveal your identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name/ID, country, time zone setting and location, information about how and when you use our Website and other technology on the devices you use to access this website. This is explained in more detail below:

Log and usage data: Log and usage data is service-related, diagnostic, usage and performance information our servers automatically collect when you access or use our Website and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type and settings and information about your activity in the Website (such as the date/time stamps associated with your usage, pages and files viewed, searches and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called 'crash dumps') and hardware settings).

Device data: We collect device data such as information about your computer, phone, tablet or other device you use to access the Website. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model Internet service provider and/or mobile carrier, operating system and system configuration information.

Location data: We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Website. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. Note however, if you choose to opt out, you may not be able to use certain aspects of the Services.

Like many businesses, we also collect information through cookies and similar technologies, which is explained in our Cookie notice.

2. Who is the controller of your personal data?

The Cotswold Brewing Company Ltd trading as Hawkstone (registered number 05252279) is the controller for your personal data (referred to as “Hawkstone”, "we", "us" or "our" in this notice). Hawkstone is registered with the Information Commissioner’s Office (ICO) with registration number ZA367391.

If you have questions or comments about this notice, you may email us at info@hawkstone.com or write to us at:
The Cotswold Brewing Company Ltd
College Farm
Stow Road
Cheltenham,
Gloucestershire
GL54 2HN
United Kingdom

3. How do we use your information?

We will only use your personal data where the law allows us to and we will only use your personal data for the purposes for which we collected it, unless we consider that we need to use it for another reason and that reason is compatible with the original purpose, in which case we will notify you and we will explain the legal basis which allows us to do so. We use personal information collected via our Website for a variety of business purposes described below. If you wish to obtain an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at info@hawkstone.com.

The most commonly used legal bases we rely on for processing your personal data are as follows:

  • Consent: We may process your data if you have given us specific consent to use your personal information for a specific purpose. Where we are relying on your consent to process your personal data you can withdraw this consent at any time. For example, we post testimonials on our Website that may contain personal information. Prior to posting a testimonial, we will ask for your consent to use your name and the content of the testimonial. If you wish to update, or delete your testimonial, please contact us at info@hawkstone.com and be sure to include your name, testimonial location, and contact information.
  • Legitimate Interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests or that of a third party. We will always make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our/a third party’s legitimate interest. We rely on the legitimate interests legal basis for our marketing, for example if you have purchased a product or service from us we may use the details you provided with your order to contact you with details of products or services we believe may be of interest to you.
  • Performance of a Contract: Where we have entered into a contract with you, or are taking steps at your request to enter into a contract, we may process your personal information to fulfil the terms of our contract, for example for the fulfilment of orders placed by you, or participation in the “Hawkstonian Loyalty Programme”, and facilitation of associated payment processing.
  • Legal Obligation: We may disclose your information where we are legally obliged to do so in order to comply with applicable law, for example where we are required by court order to provide requested information.

The table below explains the ways in which we use your personal data and the legal basis which is used.

Individual Purpose for processing Data used Legal basis relied on
All individuals covered by this notice with a Hawkstone account To facilitate account creation and logon process, to manage your account and keep it in working order. Identifying details Contact details Transaction details Profile and usage details Marketing preferences Payment details Performance of a contract
All individuals covered by this notice who have provided a testimonial To post testimonials on our Website Identifying details Testimonial content Consent
All individuals covered by this notice To request feedback on our products and services Identifying details Contact details Transaction details Legitimate interest to improve our services
All individuals covered by this notice with a Hawkstone account To send product, service and new feature information, or information about changes to our terms, conditions, and policies. Identifying details Contact details Legitimate interests to promote relevant information to account holders
All individuals covered by this notice To send you marketing and promotional communications. We and/or our third-party marketing partners may use the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. Identifying details Contact details Legitimate interests to promote our products and services to customers/potential customers
All Website visitors We may use your information as part of fraud monitoring and prevention Identifying details Contact details Transaction details Profile and usage details Payment details Legitimate interests, to minimise fraud which could be damaging for you and/or us.
All individuals covered by this notice To enforce our terms, conditions and policies for business purposes, to comply with legal and regulatory requirements or in connection with our contract. Identifying details Contact details Transaction details Profile and usage details Payment details Performance of a contract
All individuals covered by this notice To respond to legal requests and prevent harm Legitimate interests
All individuals covered by this notice who have placed an order with us To fulfil and manage your orders. To deliver and facilitate delivery of services. We may use your information to fulfil and manage your orders, payments, returns, and exchanges made through the Website. Identifying details Contact details Transaction details Payment details Performance of a contract
All individuals covered by this notice who are members of a loyalty scheme with us To administer our loyalty scheme, calculate loyalty rewards and tier status, manage your loyalty account, update your loyalty account following returns, cancellations, or other adjustments, and provide you with rewards, benefits and related communications. Identifying details Contact details Transaction details Profile and usage details Marketing preferences Payment details Performance of a contract
All individuals covered by this notice who have entered a prize draw or competition To administer prize draws and competitions when you elect to participate in our competitions. Identifying details Contact details Legitimate interests to promote our business
All individuals covered by this notice To respond to user enquiries and solve any potential issues you might have with the use of our Services. Identifying details Contact details Transaction details Profile and usage details Marketing preferences Payment details Details of any enquiries or issues encountered Legitimate interests of ensuring our services are working correctly and promoting good relationships with users
All individuals covered by this notice To deliver targeted advertising to you and people like you. We may use your information to develop and display personalised content and advertising (and work with third parties who do so) tailored to your interests and/or location and to measure its effectiveness. Identifying details Contact details Transaction details Profile and usage details Marketing preferences Legitimate interests to promote our business

 

4. Who will your information be shared with?

We may share your data with third-party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do that work. Please see below for details of the types of third parties we share your personal data with:

  • Fulfilment providers who perform services on our behalf to ensure fulfilment and delivery of orders placed by you; such as Yodel and Laithwaites
  • Service providers who provide IT and systems administration services and access to platforms we use for operational purposes to run our business, including email delivery, marketing and customer service, hosting services, data analysis, payment processors and administration of our loyalty programs; such as Klaviyo, Age Check, Gorgias or Antavo
  • Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services to us
  • Credit reference organisations for the purposes of undertaking credit checks:
  • HM Revenue & Customs, regulators and other authorities based in the UK who require reporting of processing activities in certain circumstances, for example to ensure we are complying with legal and regulatory obligations;
  • Third parties who require access to the personal data we process for the purposes of the prevention or detection of crime or for the purposes of legal proceedings;
  • Fraud prevention agencies and credit reference agencies for the purposes of undertaking anti-money laundering, anti-terrorism and other financial checks to ensure we are complying with our legal and regulatory obligations;
  • External auditors who provide auditing and similar compliance services to us to ensure we are complying with our legal and regulatory obligations when we provide goods or services to you, process your personal data or where we are certified under any relevant schemes or certifications;
  • Financial providers who provide us with financial services and facilities;
  • If you use the “Pubfinder” tool on our Website you will be have the option to share your postcode/location with Google Maps Platform APIs (e.g. Google Maps API, Place API). To find out more about Google’s Privacy Policy, please refer to this link.
  • We allow selected third parties to use tracking technology on the Website, which will enable them to collect data on our behalf about how you interact with our Website over time. This information may be used to, among other things, analyse and track data, determine the popularity of certain content, pages or features, and better understand online activity. Unless described in this notice, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes. Examples include Klaviyo, Meta, Clarity or Google Analytics.
  • We also share limited data through Ad Networks with Google and Meta, to enable us to target you or others like you with relevant advertising.
  • We may also share your information with our affiliates, in which case we will require those affiliates to honour this privacy notice. Affiliates include our parent company and any subsidiaries, joint venture partners or other companies that we control or that are under common control with us.

If there is a change of ownership or control of our business, such as a merger, restructure, sale of the business or its assets or we acquire a new business, your information may be shared with the parties involved in this change. We will anonymise the information where possible and any recipients will be bound by contractual terms to keep such information confidential.

We have contracts in place with our data processors, which are designed to help safeguard your personal information. We expect all third parties to respect the security of your personal data and to treat it in accordance with the law and the terms of the contract we have in place with them. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organisation apart from us, and they agree to protect the data they hold on our behalf and to retain it for the period we instruct.

Some of the third parties are based outside the UK and/or the European Economic Area (EEA) so their processing of your personal data will involve a transfer of personal data outside the UK and/or the EEA. Whenever we transfer your personal data out of the UK and/or the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is in place:

  • We may transfer your personal data to countries that have been granted an adequacy decision by the European Commission and/or an adequacy regulation by the UK Secretary of State (as applicable) confirming that the country in question provides an adequate level of protection for personal data; or
  • We may use specific contracts approved by the European Commission and/or the UK (as applicable) which ensure that personal data is adequately protected. When we rely on this measure, we will conduct risk assessments and take appropriate measures to ensure that the third-party can comply with the provisions of such contracts and we have confirmed that the country to which the personal data is transferred provides enforceable data subject rights and effective legal remedies for data subjects are available there; or a specific exception applies under applicable data protection law.

Please contact us at info@hawkstone.com if you want any further details about the specific third parties we may share your personal data with.

5. Do we use cookies?

We use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie notice.

If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Website. To opt out of interest-based advertising by advertisers on our Website visit http://www.aboutads.info/choices/

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

6. How long do we keep your information?

We keep your information for as long as necessary to fulfil the purposes outlined in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes we collected it for, as set out in this privacy notice.

When we no longer need to keep your personal information we will either securely delete it, or in some circumstances we may anonymise your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

If you would like more specific information about our retention periods please contact info@hawkstone.com.

7. How do we keep your information safe?

We have appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We also have in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Do we collect information from under 18s?

Our goods and services and our website are not intended for children under 18 years of age and we do not knowingly collect personal data relating to children. If we learn that personal information from children has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at info@hawkstone.com.

9. What are your privacy rights?

You have a number of rights in relation to how we use your personal data, which are set out below:

Access: This enables you to receive a copy of the personal data we hold about you.

Rectification: This enables you to have any incomplete or inaccurate personal data corrected.

Erasure: This enables you to ask us to delete personal data where there is no good reason for us continuing to process it. Note, however, that we may not always be able to comply with your request for erasure because of specific legal reasons which will be notified to you, if applicable, at the time of your request.

Objection: This enables you to object to the processing of your personal data where we are relying on our legitimate interest(s) (or that/those of a third party) and you object to processing on this ground as you feel the processing impacts your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. You also have the absolute right to object where we are processing your personal data for direct marketing purposes.

Restriction: This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) where you want us to establish the accuracy of the personal data; (b) where our use of the personal data is unlawful but you do not want us to erase it; (c) where you need us to hold the personal data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) where you have objected to our use of your personal data but we need to verify whether we have overriding legitimate grounds to use it.

Portability: This enables you, in certain situations, to request transfer of your personal data to you or to a third party. We will provide your personal data (to you, or a third party you have chosen) in a structured, commonly used, machine-readable format.

Your right to withdraw consent: If we are relying on consent to process your personal data, you can withdraw your consent at any time, however, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you wish to exercise any of the rights set out above, please email us info@hawkstone.com or write to us at the address in this policy. Before we can process your request, we may need information from you to help us confirm your identity. This is a security measure to ensure that rights are being exercised by the correct person and to ensure that personal data is not disclosed to, erased by or altered by any person who has no right to do so.

For more information on the rights set out above and when they apply, please contact us info@hawkstone.com or see the guidance from the UK Information Commissioner on individuals’ rights or other relevant supervisory authorities.

It is important to us that the personal data we hold about you is accurate and up to date. If you would at any time like to review or change the information in your account, or request to opt out of our loyalty programmes you can either log in to your account settings and update your user account or contact us at info@hawkstone.com

You can unsubscribe from our marketing email list at any time by clicking on the unsubscribe link in the emails that we send or by contacting us using the details provided in this policy. You will then be removed from the marketing email list — however, we may still communicate with you, for example to send you service-related emails that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

You have the right to make a complaint about the processing of your personal data or in relation to the exercise of any of your rights at any time to the ICO (www.ico.org.uk) or by telephone: 0303 123 1113 If or any EU data protection regulator, in particular, the regulator for the Member State in which you reside or work, or in the member state where the activity which gave rise to the complaint occurred or our lead supervisory authority. https://edps.europa.eu/data-protection/our-role-supervisor/complaints_en.

We would, however, appreciate the chance to deal with your concerns before you approach a regulator. If you have questions or comments about your privacy rights, you may email us at info@hawkstone.com.

10. Do we make updates to this notice?

We may update this privacy notice from time to time. The updated version will be published on our website and the new version indicated by a new “Last updated" date at the start of the document, and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

11. How can you contact us about this notice?

If you have questions or comments about this notice, you may email us at info@hawkstone.com or by post to:
The Cotswold Brewing Company Ltd
College Farm
Stow Road
Cheltenham,
Gloucestershire GL54 2HN
United Kingdom