Privacy policy
Last updated: 28 October 2026
1. Who we are
This Privacy Policy explains how sun and rocks wine (“we”, “us” or “our”) collects, uses, stores and shares personal data when you visit our website, browse our products, create an account, place an order or otherwise interact with us.
We operate an online wine retail business serving customers in the United Kingdom. Our online store is powered by Shopify, which provides the platform and technology that enable us to sell our products and provide our services.
We are committed to protecting your privacy and handling your personal data responsibly, in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.
Data controller: Sergej Nikolajev trading as sun and rocks
Contact email: sunandrockswine@gmail.com
Business address: Unit B15, 200 York Way, London, N7 9AX, United Kingdom
For the purposes of applicable data protection law, the data controller is responsible for deciding how and why your personal data is processed.
2. Personal data we collect
The personal data we collect depends on how you interact with our website and services. We may collect the following categories of information.
Contact and delivery information
Your name, email address, telephone number, billing address and delivery address.
Payment and transaction information
Details relating to your purchases, payment status, order confirmations, refunds and other transactions. Payments are generally processed by our payment service providers. We do not necessarily receive or retain your full payment card details.
Account information
Your username, password, account preferences and settings, where you choose to create an account.
Order and shopping information
The wines and other products you view, add to your basket or purchase, as well as your order history, returns, cancellations and customer preferences.
Communications
Information you provide when you contact us with an enquiry, request assistance, submit feedback or otherwise communicate with us.
Technical and usage information
Information such as your IP address, browser type, device information, network information, website activity and interactions with our online store. Some of this information may be collected using cookies and similar technologies.
Marketing preferences
Your preferences regarding promotional communications, including whether you have consented to receive marketing and whether you have unsubscribed.
We will only collect personal data that is relevant to our purposes and will handle it in accordance with applicable law.
3. How we collect personal data
We may collect personal data:
-
Directly from you when you place an order, create an account, complete a form or contact us.
-
Automatically when you visit or interact with our website, including through cookies and similar technologies.
-
From Shopify and other service providers that support our online store, payment processing, delivery, customer service and website operations.
-
From other third parties where this is lawful and necessary for the purposes described in this Privacy Policy.
Where personal data is not collected directly from you, we will provide the information required by applicable data protection law where appropriate.
4. How and why we use personal data
We use personal data only where we have a lawful basis for doing so. Depending on the circumstances, we may rely on the following lawful bases under the UK GDPR.
To process and fulfil orders
We use your contact, payment and transaction information to process payments, confirm orders, arrange delivery, provide customer support and manage refunds, returns and cancellations.
Lawful basis: Processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.
To manage customer accounts
Where you create an account, we use your information to maintain it, authenticate your access and manage your preferences.
Lawful basis: Performance of a contract, where necessary, or our legitimate interests in managing our online services securely.
To operate, maintain and improve our website
We may use technical and usage information to maintain website functionality, understand how customers interact with our store, troubleshoot problems and improve the shopping experience.
Lawful basis: Our legitimate interests in operating and improving our business, where those interests are not overridden by your rights and interests. Where required, we will obtain consent for cookies or similar technologies before using them.
To communicate with you
We use your information to respond to enquiries, provide customer service and send information relating to your account or orders, including delivery updates and other necessary service communications.
Lawful basis: Performance of a contract, taking steps at your request, or our legitimate interests in providing customer support, depending on the circumstances.
To send marketing communications
We may use your contact details to send promotional emails or other marketing communications about our wines, products, offers and services where permitted by law.
We will only send electronic marketing to individuals where we have the required consent or can lawfully rely on an applicable exception, such as the existing-customer exception for marketing similar products.
You can unsubscribe from marketing emails at any time using the unsubscribe link in the message or by contacting us.
Lawful basis: Consent or, where appropriate, our legitimate interests in promoting our business. We will also comply with the separate requirements of PECR.
To prevent fraud and protect our business
We may use relevant information to detect and investigate suspicious transactions, protect customer accounts, maintain website security and prevent fraud or other unlawful activity.
Lawful basis: Our legitimate interests in protecting our business, customers and systems, or compliance with a legal obligation where applicable.
To comply with legal obligations
We may process personal data where necessary to comply with legal requirements, including applicable tax, accounting, consumer protection and regulatory obligations, and to respond to lawful requests from competent authorities.
Lawful basis: Compliance with a legal obligation.
To establish or defend legal claims
Where necessary, we may process personal data to establish, exercise or defend legal claims.
Lawful basis: Our legitimate interests in protecting and enforcing our legal rights, where applicable.
Where we rely on legitimate interests, those interests will be assessed against your rights and freedoms. You may have the right to object to certain processing, as explained below.
5. How we share personal data
We do not make personal data available to third parties indiscriminately. We may share it where necessary for the purposes described in this Privacy Policy, including with the following categories of recipients.
Shopify
Our online store is hosted and powered by Shopify. Personal data submitted through our store may be processed by Shopify to provide hosting, checkout, order management, security and related services. Shopify may also process certain information for its own purposes, in accordance with its applicable privacy terms.
You can read more in the Shopify Consumer Privacy Policy.
Payment service providers
We share relevant information with payment providers to process transactions, verify payments and help prevent fraud.
Delivery and fulfilment providers
We share the information needed to deliver your order, such as your name, delivery address and contact details, with the relevant courier or fulfilment provider.
Website and business service providers
We may use third-party providers for services such as website maintenance, customer support, analytics, cloud storage and other operational functions.
Marketing and advertising providers
Where we use marketing, analytics or advertising services, relevant information may be shared with those providers in accordance with applicable law and any required consent. This may include information about your website activity or interactions with our store.
Professional advisers and public authorities
We may disclose personal data to professional advisers, regulators, law enforcement agencies or other authorities where required or permitted by law, or where necessary to establish or defend legal claims.
Business transfers
If our business is sold, restructured or transferred, personal data may be disclosed to relevant parties where lawful and subject to appropriate safeguards.
We require service providers acting on our behalf to handle personal data in accordance with applicable data protection requirements and appropriate contractual arrangements.
6. Shopify and its services
Shopify provides the platform on which our online store operates and may process personal data to deliver and improve its services.
Depending on the Shopify features we use, Shopify may also process information obtained from your interactions with our store and other merchants for its own purposes. Where Shopify determines the purposes and means of such processing, it may act as a separate data controller and will be responsible for handling applicable requests relating to that processing.
Further information about Shopify's processing and the rights available to you can be found in the Shopify Consumer Privacy Policy and, where relevant, the Shopify Privacy Portal.
7. Cookies and similar technologies
Our website may use cookies, pixels and similar technologies to operate the store, remember your preferences, maintain your shopping basket, measure website performance and support analytics or advertising.
Some cookies are strictly necessary to provide services you request, such as maintaining your shopping basket or securing the checkout. Other cookies, including those used for certain analytics or advertising purposes, may require your consent.
Where consent is required, we will seek it before placing or accessing the relevant cookies or using similar technologies. You should be able to reject non-essential cookies as well as accept them, and change your preferences where the relevant consent mechanism allows this.
You can also manage cookies through your browser settings, although disabling certain cookies may affect website functionality.
The cookies and similar technologies actually used on our website, their purposes and their providers should be explained in our cookie notice or cookie settings.
8. Marketing preferences
We may send you promotional communications by email or other electronic means where permitted by law.
Where we rely on consent, you may withdraw it at any time. Where we rely on the existing-customer exception, you can object or opt out at any time.
Every marketing email will include an unsubscribe option. You may also contact us at sunandrockswine@gmail.com to update your marketing preferences.
We will act on your request within the applicable legal timeframe. Unsubscribing from marketing will not prevent us from sending necessary non-promotional communications, such as order confirmations, delivery updates or important information about your account.
We will not use purchased marketing lists or send unsolicited electronic marketing to individuals unless the applicable legal requirements are met.
9. How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to fulfil orders, provide our services, comply with legal obligations, resolve disputes and enforce agreements.
The appropriate retention period depends on the type of information and the circumstances. For example:
-
Order, payment and accounting records may need to be retained for applicable tax, accounting and other legal requirements.
-
Account information may be retained while your account remains active and for a reasonable period afterwards where necessary.
-
Customer service communications may be retained for as long as needed to resolve enquiries and maintain appropriate records.
-
Marketing information may be retained while you remain subscribed, subject to applicable requirements. We may retain limited suppression records to ensure that we respect your decision to unsubscribe.
-
Technical information and cookie-related records may be retained for periods appropriate to their purpose and any applicable legal requirements.
When personal data is no longer required, we will delete it or anonymise it securely, unless we are legally required or otherwise permitted to retain it.
10. International transfers of personal data
Although our retail business currently operates in the United Kingdom, some of our service providers, including Shopify or other technology providers, may process personal data outside the UK.
Where a transfer of personal data is subject to the UK GDPR's international transfer rules, we will ensure that an appropriate legal mechanism is in place. Depending on the circumstances, this may include a UK adequacy regulation, an approved international transfer agreement or addendum, or another lawful exception.
Where required, we will take the additional steps necessary to ensure that the transfer provides the level of protection required by UK data protection law.
Further information about relevant international transfers may be available from our service providers' privacy notices.
11. How we protect personal data
We take appropriate technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure or destruction.
These measures may include access controls, appropriate security procedures and the use of service providers that support secure website and payment operations.
However, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect the information entrusted to us.
If a personal data breach occurs, we will take the steps required by applicable law, including notifying the Information Commissioner's Office and affected individuals where legally required.
12. Your data protection rights
Under the UK GDPR, you may have the following rights in relation to your personal data. These rights are subject to certain conditions and exemptions.
Right of access: You can request a copy of the personal data we hold about you and information about how we use it.
Right to rectification: You can ask us to correct inaccurate personal data or complete information that is incomplete.
Right to erasure: You can ask us to delete personal data in certain circumstances.
Right to restriction: You can ask us to restrict the processing of your personal data in certain circumstances.
Right to data portability: You can request a copy of certain personal data in a commonly used, machine-readable format and, where the legal conditions are met, ask us to transfer it to another organisation.
Right to object: You can object to processing based on our legitimate interests in certain circumstances. You have an absolute right to object to the processing of your personal data for direct marketing.
Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before you withdrew consent.
Rights relating to automated decisions: Where applicable, you may have rights concerning decisions made solely by automated means that have legal or similarly significant effects on you.
You can exercise your rights by contacting us at sunandrockswine@gmail.com. We may need to verify your identity before responding.
We will respond within the timeframe required by applicable law. In some circumstances, we may be entitled to refuse a request or charge a reasonable fee where the law permits this. If we refuse a request, we will explain the reasons and inform you of any applicable rights to complain.
We will not unlawfully discriminate against you for exercising your data protection rights.
13. Children's privacy and age restrictions
Our website and products are intended for adults. Alcohol is subject to legal age restrictions in the United Kingdom, and we do not intend to sell alcohol to anyone below the applicable legal purchasing age.
We do not knowingly collect personal data from children for purposes unrelated to providing lawful services or meeting legal obligations. Where we become aware that personal data has been collected unlawfully, we will take appropriate steps to address the situation.
We may need to process limited information to operate age-verification or age-restricted delivery procedures where these are used by our business or required by law.
14. Third-party websites
Our website may contain links to websites or services operated by third parties. Those websites have their own privacy policies and practices.
We are not responsible for the privacy, security or content of third-party websites that we do not control. We recommend reviewing their privacy information before providing them with personal data.
15. Complaints
If you have concerns about how we collect or use your personal data, please contact us first at sunandrockswine@gmail.com so that we can try to resolve the issue.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
You can find information about making a complaint at https://ico.org.uk/make-a-complaint/.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business, the services we use, our data processing practices or applicable law.
When we make changes, we will publish the updated policy on our website and revise the “Last updated” date at the top. Where required by law, we will provide additional notice or take other appropriate steps.
17. Contact us
If you have any questions about this Privacy Policy, how we handle your personal data or how to exercise your rights, please contact:
sun and rocks wine
Email: sunandrockswine@gmail.com
Business address: Unit B15, 200 York Way, London, N7 9AX, United Kingdom
Legal business name: Sergej Nikolajev trading as sun and rocks