Privacy Policy

Last updated: 13 August 2026

The privacy of our customers, visitors and community is important to us, and we take care to safeguard your personal information.

This Privacy Policy explains how Isle of Harris Distillers Limited (“Isle of Harris Distillery”, “Harris”, “we”, “us” or “our”) collects, uses, stores and shares personal information when you:

• visit or use our website;
• shop with us;
• visit the Isle of Harris Distillery;
• book or attend a tour, tasting, experience or event;
• contact us or receive customer service;
• receive communications from us;
• join or use Your Harris; or
• otherwise interact with Isle of Harris Distillery.

Who we are

Isle of Harris Distillers Limited is registered in Scotland under company number SC334836. Our registered address is Tarbert, Isle of Harris, Scotland, HS3 3DJ.

We are the Data Controller responsible for the personal information described in this policy.

We do not sell personal information for money. Some privacy laws use broader definitions of “sale”, “sharing” or “targeted advertising”. Where those definitions apply, we provide the controls required by applicable law.

Age restrictions

Our alcohol products, Your Harris membership and alcohol-related marketing are intended for adults aged 18 or over. We may ask you to confirm your age or complete an age-verification step where appropriate.

We do not knowingly use personal information from anyone under 18 for alcohol marketing or Your Harris. If you believe that a person under 18 has provided personal information to us inappropriately, please contact us.

What information we collect

The information we collect depends on how you interact with us. It may include:

• your name, title and contact details;
• postal, billing and delivery addresses;
• email address and telephone number;
• date of birth, age confirmation or age-verification information where required;
• account, authentication and sign-in information;
• Your Harris profile, membership status and activity;
• orders, purchases, payments, refunds and returns;
• products you own, have purchased or have expressed an interest in;
• delivery and fulfilment information;
• distillery visits, tours, tastings, events and experiences you have booked or attended;
• guest details and booking information;
• private-cask or other Harris relationship information, where relevant;
• invitations, opportunities or benefits you have received, accepted or expressed an interest in;
• interests and preferences you choose to give us, including Gin, Whisky and Limited Releases;
• marketing choices, including The Journal and From Time to Time;
• competition entries, survey responses and feedback;
• customer-service enquiries, complaints and correspondence;
• information about how you interact with our emails and communications;
• information about how you use our website and digital services;
• device, browser, network, consent and approximate-location information;
• website interactions such as pages viewed, clicks, taps, scrolling and navigation;
• images or recordings where these are collected with appropriate notice; and
• information provided by service providers, booking partners, delivery partners or other organisations where we are permitted to receive it.

If you voluntarily provide accessibility, dietary, allergy, health or other sensitive information in connection with a visit or experience, we use it only where necessary to understand and safely meet your request. We will identify an appropriate additional condition for using this information, such as your explicit consent, where required by law.

Payment-card information is processed by our payment providers. We do not normally receive or retain complete payment-card details ourselves.

How we collect information

We collect personal information:

• directly from you when you shop, book, join Your Harris, update your preferences or contact us;
• automatically through our website, cookies, pixels and similar technologies, subject to your choices;
• from Shopify when you use our online store or customer account;
• from Mailchimp when it processes your subscription status and communication preferences;
• from AnyRoad when you make or attend a relevant booking or provide a choice through a booking journey;
• from payment, delivery, fulfilment and customer-service providers;
• from event, competition or experience partners; and
• from other organisations where you have authorised the disclosure or it is otherwise lawful.

Where appropriate, we may match information from different Harris systems using an identifier such as your email address. This allows us to recognise that an order, booking, preference or enquiry relates to the same person and provide a more consistent service.

Your relationship with Harris

Your relationship with Harris may extend across different interactions. For example, you may visit the distillery, make an online purchase, attend an event, join Your Harris and later express an interest in a whisky release.

Where appropriate, we may connect information from these interactions so that we can understand and support your relationship with Harris as a whole. We do this only for the purposes and on the lawful bases described in this policy.

Your Harris

Your Harris provides a personal connection between you and the Isle of Harris Distillery.

When you join or use Your Harris, we may create and maintain a profile containing:

• your identity and contact details;
• your account and authentication information;
• your purchases and relevant order information;
• products you own or have previously purchased;
• visits, bookings, tours and experiences;
• events you have attended;
• private-cask or other Harris relationship information, where relevant;
• interests and preferences you have shared;
• products or releases in which you have expressed an interest;
• invitations or opportunities you have received or responded to;
• your marketing choices and engagement with Harris communications; and
• other relevant interactions you have had with us.

Joining or using Your Harris does not require you to agree to receive marketing. Your account, orders, bookings and relevant member services can be operated without marketing consent.

The Journal and From Time to Time are separate communication choices. Gin, Whisky and Limited Releases are interest preferences. Telling us about an interest does not, by itself, give us permission to send electronic marketing. Where available, you can change these choices separately in Your Harris.

We record and synchronise relevant marketing choices and interest preferences between Your Harris, Shopify and Mailchimp so that our systems respect the choices you have made. Where you provide a valid newsletter choice through an AnyRoad booking journey, we may use the recorded source and date of that choice to update your marketing status. We do not treat a booking or service enquiry as marketing consent without an appropriate recorded permission.

A product-interest registration helps us understand your interests. It does not guarantee an allocation, invitation, benefit, early access or product availability.

Personalisation and profiling

We may analyse information about your relationship with Harris to understand what may be relevant to you. This may be considered profiling under data-protection law.

For example, someone who has purchased The Hearach, visited the distillery and expressed an interest in single-cask whisky may receive different content or invitations from someone whose relationship with Harris is primarily through Isle of Harris Gin.

We may use this analysis to:

• understand our customers and community;
• organise audiences within Harris systems;
• personalise Your Harris;
• select relevant content, invitations, events, experiences or opportunities;
• identify people who may be interested in a product or release;
• improve our products, services and experiences; and
• make permitted marketing more relevant.

Membership of Your Harris does not mean you will receive every invitation, opportunity or release. Selection may take account of interests, purchase or visit history, geography, availability and the nature of your relationship with Harris.

We do not use profiling to make solely automated decisions that produce legal or similarly significant effects. You have an absolute right to object to profiling used for direct marketing.

How we use personal information and our lawful bases

UK data-protection law requires us to identify a lawful basis for each use of personal information. The basis depends on the information and purpose.

Process orders, payments, deliveries, returns and refunds

• Information typically used: Identity, contact, order, payment and delivery information
• Lawful basis: Contract; legal obligation where applicable

Manage bookings, tours, events and experiences

• Information typically used: Identity, contact, booking, guest and payment information
• Lawful basis: Contract; legitimate interests in administering the experience

Create and operate Your Harris

• Information typically used: Identity, account, order, relationship, interest and preference information
• Lawful basis: Contract where a service is requested; legitimate interests in operating and improving the membership service

Provide customer service and respond to enquiries

• Information typically used: Identity, contact, order, booking, account and correspondence information
• Lawful basis: Contract where connected to a service; legitimate interests in responding and maintaining appropriate records

Send essential service communications

• Information typically used: Relevant contact, order, booking or account information
• Lawful basis: Contract; legitimate interests; legal obligation where applicable

Send The Journal, From Time to Time and other electronic marketing

• Information typically used: Contact details, marketing choices, interests and permitted relationship information
• Lawful basis: Consent; or the electronic-marketing “soft opt-in” where all legal conditions are met

Personalise Harris content, services and permitted communications

• Information typically used: Purchases, visits, bookings, interests, preferences and engagement
• Lawful basis: Legitimate interests in providing relevant experiences; consent where required

Operate non-essential analytics cookies and connected analytics

• Information typically used: Device, browser, consent and website-interaction information
• Lawful basis: Consent

Receive limited cookieless measurement where permitted

• Information typically used: Page, device, technical and consent information
• Lawful basis: Legitimate interests in understanding basic site operation, subject to safeguards and applicable law

Operate advertising technologies and personalised advertising

• Information typically used: Device identifiers, site interactions, product and conversion information
• Lawful basis: Consent

Prevent fraud, misuse and security incidents

• Information typically used: Account, transaction, device, network and security information
• Lawful basis: Legitimate interests; legal obligation where applicable

Maintain business, financial and regulatory records

• Information typically used: Transaction, payment, tax and relevant correspondence information
• Lawful basis: Legal obligation; legitimate interests in establishing or defending legal claims

Improve products, services and operations

• Information typically used: Feedback, aggregated analysis and relevant interaction information
• Lawful basis: Legitimate interests; consent where required

Where we rely on legitimate interests, we consider the purpose, necessity, your reasonable expectations and the possible effect on your rights. You can contact us for more information about a legitimate-interests assessment.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Email and other direct marketing

We may contact you about Harris news, stories, products, releases, invitations, events, experiences and offers where:

• you have made a clear marketing choice; or
• we are permitted to use the electronic-marketing soft opt-in for our own similar products and services, having given you a clear opportunity to opt out when your details were collected and in every later message.

Where permitted, we may use your Harris interests and relationship information to decide which communications are most relevant. For example, whisky information may be sent to people who have selected Whisky as an interest or have an appropriate existing whisky relationship.

Mailchimp, an Intuit company, helps us manage marketing subscriptions, groups, preferences and email delivery. You can read Mailchimp’s privacy information at Mailchimp privacy information.

You can unsubscribe from an email using the link in that message, update the choices available in Your Harris or contact us. Stopping marketing does not prevent essential communications about an order, booking, account, cask or another service you have requested.

We may retain a limited suppression record after you unsubscribe so that we remember and respect your choice.

Online advertising

Subject to your Marketing choice, Shopify pixels and services provided by Google may be used to:

• measure visits and conversions;
• understand the effectiveness of advertising;
• limit or improve advertising; and
• make advertising more relevant where that functionality is enabled.

When Marketing is not permitted, advertising storage, advertising user data and advertising personalisation are set to denied through our consent controls.

We do not currently upload lists of Your Harris members or customer email addresses to Meta or another social platform to create matched customer audiences, and we do not currently use those lists to create similar or lookalike audiences. If this practice changes, we will update this policy and implement any required notice, consent or objection controls before using it.

We may receive aggregated performance information from professional social-media accounts. This does not give us the identities of everyone included in the platform’s aggregated figures.

Shopify

Our online store is hosted by Shopify. Shopify processes information about visitors, customers, accounts, orders and purchases to provide the storefront, checkout, payment, security, analytics and related commerce services.

Shopify may process personal information as our service provider and, for some purposes, under its own responsibilities. Information may be shared with Shopify and its service providers in other countries to operate these services.

Where Shopify Network Intelligence or another Shopify Enhanced Service is enabled, Shopify may also use information from interactions with our store, Shopify and other merchants to improve security, performance, personalisation, insights and advertising. Applicable consent and opt-out choices are passed to Shopify through Shopify’s Customer Privacy controls.

You can read Shopify’s Consumer Privacy Policy at Shopify Consumer Privacy Policy and use Shopify’s Privacy Portal at Shopify Privacy Portal to learn about or exercise rights relating to Shopify’s own processing.

Bookings and AnyRoad

AnyRoad helps us administer relevant tours, events and experiences. When you use an AnyRoad booking journey, AnyRoad may process booking-holder and guest information, contact details, answers supplied during booking, attendance information, payment or transaction context, feedback and recorded communication choices.

We may receive relevant booking and guest information from AnyRoad and match it to a Harris or Shopify record using an identifier such as your email address. We use this to administer the booking, provide customer service, understand visits and, where a valid recorded choice exists, update marketing preferences.

AnyRoad’s privacy information is available at AnyRoad privacy information.

Cookies and similar technologies

Cookies are small files placed on a browser or device. Similar technologies include pixels, tags, local storage and other methods that store information on, or access information from, a device.

We use these technologies for the following categories:

• Strictly necessary: required for security, sign-in, shopping baskets, checkout, payments, consent records and core website operation. These cannot be disabled through our cookie controls.
• Preferences: remember choices such as language, location or other website preferences.
• Analytics: help us understand website use and improve the experience.
• Marketing: support advertising measurement, attribution and personalised advertising where enabled.

The principal technologies currently used on our storefront include:

Shopify: _shopify_essential, _shopify_test, cart, cart_currency, localization, shopify_pay

• Purpose: Store operation, security, cart, checkout, location and payment functions
• Category: Strictly necessary
• Typical duration: From one minute or the browser session up to one year; cart and localisation cookies are normally up to two weeks

Shopify: _tracking_consent

• Purpose: Stores the consent choice made for the visitor’s region
• Category: Strictly necessary
• Typical duration: Up to one year

Shopify: _shopify_s, _shopify_y, _shopify_analytics, shop_analytics, _landing_page, _orig_referrer

• Purpose: Storefront reporting, session measurement, landing-page and referral analysis
• Category: Analytics
• Typical duration: From 30 minutes to one year; landing and referral cookies are normally up to two weeks

Google Analytics 4: _ga, _ga_<property-id>

• Purpose: Distinguishes browsers and maintains analytics session information
• Category: Analytics
• Typical duration: Up to two years, subject to browser limits and our settings

Microsoft Clarity: _clck, _clsk

• Purpose: Maintains a pseudonymous Clarity identifier and connects page views into an analytics session
• Category: Analytics
• Typical duration: _clck may last up to one year; _clsk is short-lived, normally about one day

Shopify: _shopify_marketing; Google advertising cookies such as _gcl_au, where used

• Purpose: Advertising measurement, attribution and permitted personalisation
• Category: Marketing
• Typical duration: Shopify marketing cookies may last up to one year; Google advertising cookies vary and are normally shorter-lived

Microsoft advertising cookies such as MUID, where used

• Purpose: Advertising measurement and Microsoft advertising functions
• Category: Marketing
• Typical duration: As specified by Microsoft and subject to Marketing consent

Cookie names and durations can change when providers update their services, and browsers may shorten their life. Shopify’s current storefront cookie list is available at Shopify storefront cookie list. Google explains its cookie use at Google cookie information. Microsoft explains Clarity cookies at Microsoft Clarity cookie information.

Where consent is required, non-essential Preferences, Analytics and Marketing cookies are denied unless and until you choose to allow them. You can accept all, reject non-essential technologies or manage purposes separately through our cookie banner.

You can change or withdraw your choice at any time by selecting Cookie preferences in the website footer. Withdrawing consent does not affect processing that occurred before withdrawal.

When Analytics or Marketing consent is denied, Google and Microsoft may still receive limited cookieless signals where permitted. These signals can include consent status and technical, page-view, device or event information. They do not set the corresponding analytics or advertising cookies, and their features are restricted. We use these limited signals to understand basic site operation and consent performance, not to override your choice.

Google Analytics

We use Google Analytics 4 to understand how the website is used and how it performs. When Analytics consent is granted, Google Analytics may use first-party cookies to distinguish browsers and sessions and process page, device, campaign and interaction information.

When Analytics consent is denied, Google Consent Mode keeps analytics storage denied. A limited cookieless measurement signal may still be sent, but normal analytics cookies are not set.

Our internal reporting imports use identifiers only transiently to create aggregate reports. Stored reporting datasets are daily aggregates, and URL query strings are removed. Google’s privacy information is available at Google Privacy Policy.

Microsoft Clarity

We use Microsoft Clarity to understand how visitors use our website and identify ways to improve the experience. Clarity can collect page views, clicks, taps, scrolling, navigation, device and browser information, website performance information, heatmaps and session playback information.

Clarity session playback is not a conventional video recording. It is a reconstruction created from website structure and interactions. Privacy-sensitive fields are intended to be masked so that their entered text is not included in playback data.

When Analytics consent is denied, Clarity operates in a restricted cookieless mode. It may receive a limited, single-page interaction record, but it does not set Clarity analytics cookies or connect activity into a continuous multi-page session. When Analytics consent is granted, Clarity cookies and its fuller session, heatmap and playback functions may operate. If consent is later withdrawn, the consent signal is updated and applicable Clarity cookies are removed.

When you are signed into Your Harris and your Analytics choice permits the relevant Clarity functionality, we may provide Clarity with a pseudonymous Your Harris member identifier. Clarity hashes the identifier before storing it. This allows authorised Harris staff to find relevant sessions when investigating website experience or service issues. We do not provide your email address as the Clarity identifier, and Clarity recordings are not copied into Your Harris.

Clarity playback data is normally retained by Microsoft for 30 days. Click, heatmap, labelled, favourited and selected sample information may be retained for up to nine months. Microsoft’s current Clarity retention information is available at Microsoft Clarity retention information and Microsoft’s Privacy Statement is available at Microsoft Privacy Statement.

Information received from other organisations

We may receive personal information from organisations that help us provide products, visits, experiences and communications. These may include:

• ecommerce, payment and fulfilment providers;
• delivery companies;
• booking and experience platforms;
• customer-service and technology providers;
• marketing and communications providers;
• analytics and advertising providers;
• event and competition partners; and
• other organisations you have interacted with where sharing is lawful and appropriate.

Where we obtain information from another source, we use it in accordance with applicable law and this policy. Where required, we will provide privacy information within the applicable period.

How we share personal information

We share only the information reasonably required for the relevant purpose. Recipients may include:

• Shopify for ecommerce, customer accounts, checkout, payments, security, analytics and related services;
• payment providers;
• fulfilment, warehousing and delivery partners;
• AnyRoad for bookings and experiences;
• Mailchimp and Intuit for marketing preferences and communications;
• Google for consented analytics, advertising measurement and related services;
• Microsoft for Clarity analytics;
• technology, hosting, security and customer-service providers;
• event, competition and experience partners;
• accountants, auditors, insurers, legal advisers and other professional advisers;
• fraud-prevention and debt-recovery providers where appropriate;
• regulators, law-enforcement agencies, public authorities and courts where disclosure is required or permitted; and
• a buyer, investor or adviser involved in a genuine corporate transaction, subject to appropriate protections.

Where an organisation processes information on our behalf, we require appropriate contractual, privacy and security protections. Some providers, including payment, platform and advertising providers, may also act as separate Data Controllers for purposes explained in their own privacy information.

We do not currently share customer lists with social-media platforms for matched-audience creation.

International transfers

Some providers, including Shopify, Google, Microsoft, Mailchimp and AnyRoad, operate internationally. Personal information may therefore be transferred to, stored in or accessed from countries outside the United Kingdom, including the United States.

Where this is a restricted international transfer, we use an appropriate safeguard. Depending on the circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses;
• an applicable recognised data-privacy framework; or
• another lawful transfer mechanism.

We also consider whether supplementary contractual, organisational or technical measures are appropriate. You may contact us for more information about the safeguards relevant to your information.

How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and for relevant legal, regulatory, security and business requirements.

Our principal retention criteria are:

Orders, payments, refunds and financial records

• Retention approach: Kept for fulfilment and customer service, then for the period required by tax, accounting and company law and for relevant legal claims

Delivery and fulfilment information

• Retention approach: Kept for delivery, service and dispute resolution, then deleted or minimised when no longer required

Your Harris profile and relationship information

• Retention approach: Kept while the account or relationship is active, then for a limited period needed to close the account, resolve enquiries, protect the service and meet legal obligations

Booking, guest and experience records

• Retention approach: Kept to administer and support the booking and for a reasonable period afterwards for service, safety, accounting and claims requirements

Marketing status and preferences

• Retention approach: Kept while we have permission or another lawful basis to market; reviewed periodically; a minimal suppression record may be kept after opt-out

Product interests and personalisation information

• Retention approach: Kept while relevant to the active relationship or purpose, and reviewed or removed when no longer useful or justified

Customer-service correspondence

• Retention approach: Kept until the matter is resolved and for a reasonable period afterwards based on the nature of the enquiry and possible legal or service requirements

Competitions, surveys and events

• Retention approach: Kept for administration and any stated follow-up period, then deleted or anonymised unless a longer legal or consented use applies

Cookie-consent record

• Retention approach: Normally kept for the life of the consent cookie or as otherwise needed to demonstrate and respect the choice

Google Analytics reporting

• Retention approach: Kept according to the configured Google Analytics retention setting; our reporting copies are retained as daily aggregate statistics rather than user-level histories

Microsoft Clarity

• Retention approach: Playback normally 30 days; click, heatmap, labelled, favourited and selected sample information up to nine months

Security and fraud records

• Retention approach: Kept for as long as reasonably necessary to detect, prevent and investigate misuse and protect legal rights

We consider the amount, nature and sensitivity of the information, risk, purpose, legal requirements and whether the purpose can be achieved in another way. When information is no longer required, we delete, anonymise or securely dispose of it.

How we protect personal information

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, unlawful processing, accidental loss, destruction, alteration or disclosure.

Measures may include:

• access controls and appropriate authentication;
• encryption in transit and, where appropriate, at rest;
• limiting access to people who need information for their role;
• security monitoring and incident-response procedures;
• staff awareness and training;
• contractual requirements for service providers; and
• anonymisation or pseudonymisation where practical.

No system can be completely secure, but we review safeguards in light of the nature and risks of the information we process.

Your data-protection rights

Depending on the circumstances, you may have the following rights:

• Access: ask whether we process your personal information and request a copy.
• Rectification: ask us to correct inaccurate information or complete incomplete information.
• Erasure: ask us to delete personal information in circumstances where the right applies.
• Restriction: ask us to restrict processing in certain circumstances.
• Data portability: receive information you provided in a structured, commonly used and machine-readable format, or ask us to transmit it to another controller, where applicable.
• Object: object to processing based on legitimate interests in certain circumstances.
• Direct marketing: object at any time to direct marketing, including related profiling. This is an absolute right.
• Withdraw consent: withdraw consent at any time where processing is based on consent.
• Automated decisions: obtain safeguards relating to solely automated decisions that have legal or similarly significant effects. We do not currently make such decisions about you.
• Complain: raise a concern with us or complain to the Information Commissioner’s Office.

Rights are not absolute in every situation. We may need to verify your identity and may retain information where law permits or requires it. We will explain our response and any applicable exception.

Your marketing and privacy choices

Depending on the service, you can:

• unsubscribe using the link in a marketing email;
• update The Journal and From Time to Time choices in Your Harris where available;
• update Gin, Whisky and Limited Releases interests;
• object to marketing-related profiling;
• ask us not to use information for personalised direct marketing;
• use the privacy controls offered by an advertising platform;
• select Cookie preferences in our website footer to change cookie choices; and
• contact us using the details below.

Changing a marketing choice does not stop essential communications needed to fulfil an order, booking, account, cask or other requested service.

Changes to this policy

We may update this policy to reflect changes in our services, Your Harris, the technologies we use, our business practices or applicable law.

Where a change is significant, we will take appropriate steps to bring it to your attention. The current version and its last-updated date will remain available on our website.

Contact us

If you have a question or concern, or wish to exercise a data-protection right, please contact:

Data Protection Contact
Isle of Harris Distillers Limited
Tarbert
Isle of Harris
Scotland
HS3 3DJ

Email: dpo@harrisdistillery.com

You also have the right to complain to the Information Commissioner’s Office if you are unhappy with how we use your personal information.

Information Commissioner’s Office
Telephone: 0303 123 1113
Website: Information Commissioner’s Office