Privacy policy

Your privacy is important to us. This policy explains how Breww Ltd ("Breww", "we" or "us") collects, uses and protects personal information when you use our website at https://breww.com, the Breww web app, our mobile apps, and the trade stores we host for breweries.

Breww Ltd is a company registered in England and Wales (company number 11283731), whose registered address is 23 The Forresters, Burgundy House, Harpenden, Hertfordshire, AL5 2FB, United Kingdom. We are registered with the Information Commission (ICO) under registration number ZB179055.

1. Information we collect

Log data

When you visit our website or use our apps, our servers automatically log the standard data provided by your web browser or device. This may include your Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, and other details.

Device data

We may also collect data about the device you use to access our services. This may include the device type, operating system, unique device identifiers, device settings and location data. What we collect can depend on the settings of your device and software. We recommend checking the policies of your device manufacturer or software provider to learn what information they make available to us.

When you sign up for a Breww account or a trade store account, we collect signals about your browser and device, such as a browser fingerprint, to detect automated and fraudulent sign-ups (see section 8).

Personal information

We may ask for personal information, such as your:

• name;
• email address;
• phone number;
• home or mailing address;
• work address and job title;
• website address;
• payment and bank account details; and
• tax and government identification numbers, where we need them to verify identity or for tax.

Phone calls

Some phone calls with our team are recorded and transcribed, to keep a record of what was agreed, for training, and to improve our service. Not every call is recorded.

Business data

Business data is data that builds up as you use our platform. This may include transaction records, stored files, user profiles, analytics data and other metrics, and other information created or generated as you use our services.

2. Information we process for breweries

Breweries use Breww to run their business, and put information about other people into Breww to do so. This includes their own customers and suppliers, the people who buy through their trade stores, and their staff. For that information, the brewery is the data controller and Breww processes it on the brewery's behalf and on its instructions, under our data processing agreement.

If you are one of a brewery's customers, suppliers or staff and have a question about your information, or want to exercise your rights, please contact that brewery. We will help them respond.

3. Legal bases for processing

We process your personal information lawfully, fairly and in a transparent manner, and only where we have a legal basis for doing so under the UK General Data Protection Regulation ("UK GDPR"). These legal bases depend on the services you use and how you use them. We process your information only where:

• it is necessary to perform a contract with you, or to take steps at your request before entering into one (for example, when we provide a service you have signed up for);
• it is in our legitimate interests, and those interests are not overridden by your data protection rights. Our legitimate interests include running and improving our services, keeping them secure, preventing fraud, marketing our services to businesses, and protecting our legal rights;
• you have given us consent for a specific purpose (for example, to receive our newsletter); or
• we need to process it to comply with a legal obligation, such as keeping tax records.

Where we rely on your consent, you can withdraw it at any time. This does not affect any processing that has already taken place.

You do not have to give us personal information. However, some of our services cannot be provided without it. For example, we need your name and email address to create an account.

4. How we use your information

We collect, hold and use personal information to:

• provide our platform's features to you;
• process payments for our services, and payments you take through our services;
• enable you to access and use our website, web app and mobile apps;
• contact and communicate with you, including providing customer support;
• keep our services and your account secure, and detect and prevent fraud and abuse;
• keep internal records and for administrative purposes;
• for analytics, market research and business development, including to operate and improve our services;
• send you information about our products and services that we think may interest you, which you can opt out of at any time; and
• comply with our legal obligations and resolve any disputes.

We will not use personal information for any purpose that is incompatible with these.

5. Who we share your information with

We may share personal information with:

• service providers that help us run our services, under contracts that require them to protect it and use it only on our instructions. These include providers of hosting and data storage (Cloudflare, Google Cloud, DigitalOcean and Backblaze), email delivery (Postmark), text messages (Twilio), product analytics and session replay (PostHog), error monitoring (Sentry), customer relationship management (HubSpot), the AI features in our services (Anthropic), transcription of phone calls with our team (AssemblyAI), and courier label generation (Despatch Cloud);
• payment processors, as described below;
• other services you choose to connect to your Breww account, such as accounting software, e-commerce platforms and couriers;
• our employees and contractors, where they need it to do their jobs;
• professional advisers, such as lawyers, accountants and auditors;
• debt collectors, if you do not pay for services we have provided to you; and
• courts, tribunals, regulators and law enforcement, where the law requires it or to protect our legal rights.

Payment processors

Card and bank payments are processed by our payment processors, Stripe and Airwallex. Card details are entered directly on pages hosted by the payment processor and never reach our servers.

If you choose to set up payments through Breww, for example to take payments from your own customers, we send the payment processor the information it needs to open, verify and run your account. This can include your business details, the names, dates of birth, addresses and identification details of your business's owners and directors, and your bank account details. We only send this at your direction, when you ask us to set up or manage that account. The payment processor's own privacy policy then applies to how it uses that information: Stripe's privacy policy and Airwallex's privacy policy.

We do not sell personal information, and we do not share it for targeted advertising.

6. International transfers of personal information

Our servers are in the United Kingdom. Some of our service providers store or process personal information in other countries, including countries in the European Economic Area and the United States.

When we transfer personal information outside the UK, we make sure it is protected as UK data protection law requires. We do this by only transferring it to countries the UK has recognised as providing adequate protection (including, for certified US companies, the UK Extension to the EU-US Data Privacy Framework), or by using the ICO's International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses. You can contact us for more information about the safeguards we use.

7. How long we keep your information

We keep personal information only for as long as we need it:

• Account and business data is kept while your account is open. When an account is closed, we delete it when you ask us to, unless we need to keep some of it for one of the reasons below.
• Billing, invoice and tax records are kept for six years after the end of the financial year they relate to, as UK tax law requires.
• Information needed to resolve a dispute or legal claim is kept until the matter is resolved and any time limit for bringing a claim has passed.
• Marketing contacts are kept until you unsubscribe. After that, we keep your email address on a suppression list so we do not contact you again.
• Log data and error reports are kept for a short period for security and troubleshooting, then deleted.

8. Automated decisions

To protect Breww and our customers from fraud and automated abuse, new sign-ups are checked automatically using the information you provide and signals from your browser and device. Based on these checks, a sign-up may go ahead, be flagged to our team for review, or be blocked.

If your sign-up is blocked, you can contact us at hello@breww.com and a member of our team will review the decision. You can also give us your point of view and challenge the decision.

9. Keeping your information secure

We protect personal information against loss, theft and unauthorised access, disclosure, copying, use or change. Our data security page explains how. No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security, but we will comply with the law if a data breach happens, including telling you and the ICO where required.

10. Your rights

Under UK data protection law, you have the right to:

• Access: ask for a copy of the personal information we hold about you;
• Correction: ask us to correct information that is inaccurate or incomplete;
• Erasure: ask us to delete your personal information;
• Restriction: ask us to limit how we use your personal information;
• Portability: ask us for your personal information in a machine-readable format, such as CSV, or to send it to another organisation;
• Objection: object to us using your personal information based on our legitimate interests. You can object to direct marketing at any time, and we will stop;
• Withdrawing consent: withdraw any consent you have given us; and
• Automated decisions: ask for a person to review a decision made about you automatically (see section 8).

Some of these rights only apply in certain circumstances. If we cannot do what you ask, we will tell you why. If you ask us to restrict or limit how we process your personal information, we will tell you how that affects your use of our services.

To use any of these rights, email us at hello@breww.com or open a support ticket from the "Need help" link in your Breww account. We will reply within one month.

Unsubscribing: to stop receiving marketing emails, use the unsubscribe link in any of our emails or contact us.

Complaints: if you are unhappy with how we have handled your personal information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commission (ICO) at ico.org.uk/make-a-complaint, or on 0303 123 1113.

11. Children

Breww is a business service for the drinks industry and is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18.

12. Cookies

We use cookies to collect information about you and your activity on our site. A cookie is a small piece of data that our website stores on your device and reads each time you visit, so we can understand how you use our site and remember your preferences. Our cookie policy explains more.

13. Business transfers

If we or our assets are acquired, or in the unlikely event that we go out of business or enter insolvency, personal information would be among the assets transferred to the new owner. They may continue to use your personal information only in line with this policy.

14. Links to other sites

Our website may link to external sites that we do not operate. We have no control over the content and policies of those sites, and cannot accept responsibility or liability for their privacy practices.

15. Changes to this policy

We may update this policy from time to time, for example when our services or the law change. The date at the top of this page shows when it was last updated. If we make a significant change, we will tell you by email or in the Breww app before it takes effect.

16. Notice to California residents

This section applies to residents of California and supplements the rest of this policy, as required by the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

Personal information we collect

In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described in sections 1 and 4:

• Identifiers, such as your name, email address, phone number, postal address, IP address and account username;
• Customer records described in Cal. Civ. Code 1798.80(e), such as your name, address, phone number and bank account details;
• Commercial information, such as your subscription, invoices, orders and payment history with us;
• Internet or other electronic network activity, such as log data and how you use our website and apps;
• Geolocation data, such as approximate location derived from your IP address or, where you allow it, your device;
• Professional or employment-related information, such as your job title and the business you work for; and
• Sensitive personal information, limited to account log-in credentials, bank account details and, where needed to verify identity or for tax, government identification numbers.

We use sensitive personal information only to provide our services, verify identity, keep accounts secure, prevent fraud and meet legal obligations. We do not use it to infer characteristics about you.

We keep each category for the periods described in section 7.

How we disclose personal information

In the past 12 months we have disclosed each of the categories above for business purposes to the recipients described in section 5: service providers and contractors working on our behalf under written contracts that restrict how they use it, and payment processors. We disclose information to payment processors either as our service providers, or at your direction when you ask us to set up or manage a payment account for you, so these disclosures are not a sale or sharing of personal information.

We do not sell or share personal information, as those terms are defined in the CCPA, and have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Your rights

Subject to the CCPA, you have the right to:

• know what personal information we have collected about you, where it came from, why we collected it and who we disclosed it to;
• get a copy of the personal information we hold about you;
• ask us to delete the personal information we hold about you;
• ask us to correct inaccurate personal information we hold about you; and
• not be discriminated against for using any of these rights.

Because we do not sell or share personal information, or use sensitive personal information to infer characteristics about you, there is nothing to opt out of or limit.

To make a request, email us at hello@breww.com, or open a support ticket from the "Need help" link in your Breww account. We will verify your identity by matching the details in your request to the information we hold, and reply within 45 days. You can use an authorised agent to make a request for you; we will ask for your signed permission and may ask you to verify your identity with us directly.

17. Contact us

If you have any questions about this policy or how we handle your personal information, please contact us:

Breww Ltd
23 The Forresters, Burgundy House, Harpenden, Hertfordshire, AL5 2FB, United Kingdom
hello@breww.com