Privacy Policy

SUGAR HOUSE TRADING COMPANY LTD (trading as Sugar House) is the data controller for personal data processed through sughoutra.shop. We are a private limited company registered in Scotland, United Kingdom.

• Registered address: 86 Bellahouston Drive, G52 1HJ, Scotland
• Contact for privacy matters: support@sughoutra.shop
• Telephone: +44 7113274966

We have not appointed a statutory Data Protection Officer, as we are not required to. Privacy requests are handled directly by our support team at the address above.

We collect only what we need to sell and deliver drinkware and hosting tools:

• Order and delivery data: name, email address, telephone number, shipping address, billing address, basket contents, order value and order history. Your shipping address is used for order fulfilment and is passed to the carrier that delivers your parcel.
• Payment data: the payment confirmation, last four digits, card brand and transaction reference returned to us by Stripe. We never receive or store your full card number, expiry date or security code.
• Account and membership data: email address, plan tier, billing interval, renewal and cancellation records.
• Support and enquiry data: anything you send through our contact form, wholesale enquiry form or by email or telephone, including your country and enquiry topic.
• Pour Finder input: the free-text brief you enter (flavour, occasion, tools you own) and the recipe and product suggestion returned.
• Technical data: IP address, device and browser type, and pages visited, collected in order to keep the site secure and working.
• Age band: confirmation that you are 18 or over, or a guardian email address where you are aged 13 to 17.

We do not collect identity documents, and we do not ask for or store special category data such as health information.

We collect personal data from these collection sources, and no others:

• Directly from you, when you place an order, enter a shipping address at checkout, subscribe to a membership, contact us, request a return or use the Pour Finder.
• Automatically from your device, when you browse the site, through the strictly necessary storage described in our cookie section.
• From Stripe, our payment processor, when it confirms or declines a payment, or reports a refund or a dispute.
• From our delivery carriers, who report dispatch, tracking and delivery status back to us during order fulfilment.

We do not buy personal data, and we do not obtain it from data brokers, public records, social networks or advertising networks.

Because we ship physical goods, order fulfilment is the single largest use of your personal data. This is exactly what happens to it:

• Shipping address: the shipping address you enter at checkout is stored against your order and disclosed to the parcel carrier assigned to it, together with your name and telephone number, so the carrier can deliver and contact you about the delivery. Carriers act as independent controllers for their own delivery records.
• Order fulfilment records: basket contents, order value, dispatch date, tracking reference and delivery outcome are retained so we can prove what we sent, answer support questions and meet our obligations under consumer law.
• Returns and replacement handling: if you return an item or report breakage, we process your order number, the reason you give and any photograph you send, in order to authorise the return, issue a replacement or refund and, where relevant, make a damage claim against the carrier.
• Billing data: your billing address and the card brand, last four digits and transaction reference returned by Stripe are held against the order for reconciliation, refunds and dispute evidence.
• Abandoned checkout details: if you complete the delivery form but do not pay, we keep those details so we can help you finish the order. See the legal bases table below.

We do not use your shipping address or order history to build advertising profiles, and we never disclose them to anyone beyond the processors listed below.

Where we rely on legitimate interests, we have balanced those interests against your rights and you may object at any time using the contact details above.

Card payments are processed by Stripe, Inc. and its group companies. Card details are entered directly into Stripe's hosted checkout and are processed on Stripe's PCI DSS compliant systems. Sugar House never has access to your full card number, expiry date or security code, and never stores them in any form.

Stripe acts as an independent controller for fraud prevention and regulatory purposes and processes your data under its own privacy policy. We receive only the transaction outcome and the limited details needed to identify your order, issue refunds and respond to disputes. All transactions are charged in US dollars and appear on your statement as SUGAR HOUSE.

We share personal data only with providers that help us run the shop, each under a written data processing agreement:

• Payments: Stripe — card processing, refunds, disputes and subscription billing.
• Hosting and delivery of this website: Vercel Inc.
• Database and lead storage: Supabase — order, enquiry and membership records.
• Transactional and support email: our email provider, to send order and enquiry correspondence.
• Delivery carriers: the parcel carrier assigned to your order receives your name, shipping address and telephone number for order fulfilment, so it can deliver and, where needed, contact you.
• Professional advisers and authorities: accountants, auditors, or law enforcement where we are legally required to disclose.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We do not disclose it to data brokers.

We are based in the United Kingdom, and some of our providers process data in the United States or the European Economic Area. Where personal data leaves the UK or EEA, the transfer is protected by an adequacy decision or by the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, together with additional technical safeguards such as encryption in transit and at rest. You can request a copy of the relevant safeguard by contacting us.

• Order, payment and tax records: six years after the end of the relevant financial year, as required by UK tax and accounting law.
• Delivery details captured before payment completes: up to 24 months, then deleted.
• Contact and wholesale enquiries: up to 24 months after the last correspondence.
• Membership records: for the life of the subscription, then within the six-year accounting window.
• Pour Finder input: processed in your browser session and not retained as an identifiable record.
• Marketing consent records: until you withdraw consent, plus a suppression record so we do not contact you again.

The site is served exclusively over HTTPS. Data is encrypted in transit and at rest with our hosting and database providers. Administrative access is restricted to authenticated staff accounts on a least-privilege basis, secret keys are held in server-side environment variables and are never exposed to the browser, and we review our processors' security posture before engaging them. No system can be guaranteed perfectly secure, and if a breach affects your rights we will notify you and the Information Commissioner's Office as the law requires.

Under the UK GDPR and EU GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where we no longer need it;
• restrict or object to processing, including profiling and direct marketing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing already carried out.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to request deletion or correction, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA, so no opt-out is necessary; we honour requests submitted through the contact details below in any event.

To exercise any right, email support@sughoutra.shop. We respond within one month and may ask for enough information to verify your identity. Exercising these rights is free.

We use strictly necessary storage to keep your basket and your session working. Non-essential analytics cookies are set only with your consent, and you may withdraw consent at any time. Our Cookie Policy lists each cookie, its purpose and its lifetime.

We do not make decisions producing legal or similarly significant effects about you by automated means alone. The Pour Finder returns informational recipe and product suggestions using a rules-based match; it does not profile you and it does not affect your rights. See our AI Disclaimer.

Our shop is not intended for children under 13, and we do not knowingly collect their data. Customers aged 13 to 17 must have the consent of a parent or guardian and must supply a guardian email address at checkout and on our forms. If you believe a child under 13 has given us personal data, contact us and we will delete it.

If you are unhappy with how we have handled your data, please contact support@sughoutra.shopso we can put it right. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113), or with the supervisory authority in your country of residence.

We update this policy when our processing changes. The version date is shown at the top of this page, and material changes are announced on this page before they take effect. This policy is governed by the laws of England and Wales.