BeverageStack

1. Who we are and how this policy works

BeverageStack is an operating workspace for wine, spirits and beverage distribution teams. It helps users manage stock, batches, purchasing, sales orders, pricing, customer records, reporting, permissions and audit history from one connected platform.

This Privacy Policy applies when BeverageStack acts as a controller of personal data for website visitors, prospective customers, account contacts, authorised users, suppliers, business contacts and people who communicate with BeverageStack. Where BeverageStack processes personal data inside a customer workspace on behalf of a customer, BeverageStack will usually act as a processor or service provider, and the Data Processing Policy governs that processing.

This policy is written for users in the European Union, the European Economic Area, the United Kingdom, Switzerland, the United States and other locations where BeverageStack may be accessed. Local privacy rights apply where those laws give individuals specific rights.

Important scope note. BeverageStack is a business platform. It is not designed for children, consumers purchasing alcohol, health data, payment-card storage, employee surveillance or the processing of highly sensitive personal data unless expressly agreed in writing.

2. Personal data we collect

Category	Examples	Source
Identity and business contact data	Name, company, role, telephone number where provided, account affiliation and communication preferences.	Provided by the individual, customer administrator, sales contact or authorised account user.
Account and authentication data	Username, login credentials in protected form, account status, role, permissions, workspace membership and access logs.	Created when an account is issued, updated by administrators or generated by platform use.
Platform usage data	Pages viewed, features used, records created or amended, timestamps, device/browser information and audit trail activity.	Generated through use of BeverageStack.
Customer workspace data	Customer, supplier, contact, pricing, ordering, stock, batch, sales and account information entered by authorised users.	Provided or generated by customers and authorised users.
Support and communication data	Requests, feedback, onboarding notes, product questions, support history and related correspondence.	Provided through website forms, platform workflows or business communications.
Technical and security data	IP address, device identifiers, browser type, session data, error logs, security events and anti-abuse signals.	Generated automatically when using the website or platform.
Commercial relationship data	Plan, licence type, workspace status, invoice references, contract history and product interests.	Generated through sales, onboarding and account administration.

BeverageStack does not intentionally collect special-category personal data under the GDPR, such as health information, biometric data, religious beliefs, political opinions or trade union membership. Customers should not upload such data unless a separate written agreement permits it and an appropriate lawful basis is in place.

3. How we use personal data

to provide, secure, operate and improve BeverageStack and related website services;
to create, authenticate and administer user accounts and role-based permissions;
to process access requests, demonstrations, onboarding and customer support;
to maintain audit history, operational control and platform integrity;
to communicate about the service, changes, incidents, support matters and product updates;
to analyse usage trends, improve features, test functionality and diagnose technical issues;
to protect BeverageStack, customers and users against fraud, misuse, security threats and unlawful activity;
to comply with legal, accounting, tax, regulatory, sanctions, contractual and dispute-resolution obligations;
to manage commercial relationships with customers, prospects, partners and suppliers.

4. Legal bases and purposes

Purpose	Legal basis
Account creation, login, workspace access, support and platform delivery	Performance of a contract or steps taken before entering into a contract.
Website operation, security, abuse prevention, audit logs, error monitoring and service reliability	Legitimate interests in running a secure, reliable B2B platform; legal obligation where applicable.
Product communications, account notices, service updates and administrative messages	Performance of a contract; legitimate interests in communicating with business contacts.
Marketing to business contacts, events, product updates and related business development	Consent where required; otherwise legitimate interests, with opt-out available.
Analytics, non-essential cookies and similar technologies	Consent where required by law.
Records required for tax, accounting, regulatory compliance, legal claims and dispute handling	Legal obligation; legitimate interests in protecting legal and commercial rights.

5. How we share personal data

BeverageStack does not sell personal data in the ordinary meaning of selling customer lists for money. Personal data may be shared in limited, controlled circumstances:

with service providers that host, secure, support, analyse, deliver or operate the website and platform;
with customer administrators and authorised users inside the relevant customer workspace;
with professional advisers, auditors, insurers and legal representatives where needed;
with regulators, law-enforcement bodies, courts or public authorities where legally required or reasonably necessary;
with an acquiring, merged or reorganised business in connection with a sale, merger, investment, restructuring or similar corporate transaction, subject to appropriate confidentiality and legal safeguards.

Service providers are expected to process personal data only for agreed purposes and to apply appropriate confidentiality, security and data-protection controls.

6. International transfers

BeverageStack may use cloud, infrastructure, analytics, support and security providers located outside the country where a user is based. Where personal data is transferred from the EU, EEA, UK or Switzerland to a country that has not been recognised as providing an adequate level of protection, BeverageStack uses appropriate safeguards, such as standard contractual clauses, transfer risk assessments, technical controls and contractual restrictions.

7. Retention

Record type	Indicative retention approach
Account and workspace records	Retained while the account or customer workspace is active, then deleted or anonymised according to contract terms and operational requirements.
Security, audit and access logs	Retained for a limited period suitable for security investigation, compliance and operational control.
Support and communication records	Retained while relevant to the customer relationship, support history or legal/commercial need.
Marketing preferences	Retained until changed, withdrawn or no longer necessary. Suppression records may be kept to respect opt-out choices.
Legal, finance and contract records	Retained for the period required by law or for legitimate legal, accounting and audit purposes.

8. Your privacy rights

BeverageStack may need to verify identity before acting on a request.
Some data may need to be retained where required for legal, security, contractual or dispute-resolution reasons.
Where BeverageStack processes data on behalf of a customer, the request may need to be directed to that customer as the controller or business responsible for the workspace data.
Individuals in the EU, EEA and UK also have the right to complain to their local data-protection authority.

9. US state privacy notice

US privacy point	BeverageStack position
Categories collected	Identifiers, commercial relationship data, internet or network activity data, professional or employment-related information, customer workspace content and inferences used only for business/product purposes.
Sources	Individuals, customer administrators, authorised users, business contacts, website interactions and service providers.
Purposes	Service delivery, authentication, security, support, analytics, communications, compliance and business administration.
Sale or sharing	BeverageStack does not sell personal data for money. If any activity is considered a sale or sharing under applicable law, eligible users may opt out through available privacy controls.
Sensitive personal information	BeverageStack does not intentionally collect sensitive personal information for consumer profiling or cross-context behavioural advertising.
Non-discrimination	BeverageStack will not unlawfully discriminate against individuals who exercise privacy rights.

Eligible US residents may request to know, access, correct, delete, receive a copy of, or opt out of certain processing of personal data, depending on the law that applies. Authorised agents may submit requests where permitted by law and subject to verification.

10. Cookies and tracking

BeverageStack uses cookies and similar technologies as described in the Cookie Policy. Essential cookies are used to operate the website and platform. Non-essential cookies, such as analytics or marketing cookies, are used only where permitted and, where required, with consent.

11. Security

BeverageStack uses administrative, technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration and loss. Measures include role-based access controls, authentication, audit logging, encryption in transit where supported, controlled service-provider access, monitoring and internal security procedures. No internet-based system can be guaranteed to be completely secure.

12. Changes to this policy

BeverageStack may update this Privacy Policy to reflect changes in the platform, legal requirements, security practices, business operations or customer needs. Material updates will be communicated through the website, platform or other appropriate channels.