With few exceptions, we save cookies on your device only if you consent to it. By clicking the “Accept” button you agree to saving cookies on your device and using them for analytical and security purposes as well as in order to ensure the comfort of using the website.

By appropriately adjusting your browser settings you can delete the already saved cookies or block saving of new cookies. More information can be found in Stock Spirits Group Privacy Policy https://www.stockspirits.com/privacy_cookies.aspx

Skip to main content

Stock Spirits Group Privacy Policy

We attach great importance to protecting and respecting privacy.

This Privacy Policy describes the way in which we handle personal data collected via the websites: www.stockspirits.com, www.stock-polska.pl, www.stock-spa.it, www.stock.sk, www.stock.cz, www.stock.hr, www.stock.ba and other Stock Spirits Group websites containing links to the provisions hereof (“Websites”) as well as personal data collected via email or other means of electronic communication. This Privacy Policy also describes how the Stock Spirits Group handles the information and data saved by the Websites and stored on your device (even if such information does not constitute personal data).

In addition to the provisions of this Privacy Policy, the Code of Conduct, and the other documents referred to in this Policy apply.

Who are we and how to contact us?

We are a controller, within the meaning of Article 4 point 7 of GDPR, for personal data of Website users, including data of persons who apply for a job with Stock Group Companies using online forms.

You can contact us in any matters related with the use of your personal data, also when you wish to object to the processing of your personal data and exercise your rights in this respect. You can contact us by sending an email message to: gdpr@stockspirits.com

What do the terms used in this Policy mean?

Personal data

They mean data about living individuals identifiable on the basis of such data or on the basis of such data and other information held by the data controller (or data and information the controller can acquire).

They include information about Websites users, including persons applying for a job with Stock Group Companies using online forms.

Use of personal data

It means any operation carried out on personal data, including their collection from a given individual or obtaining them from other sources, as well as their recording, storage, modification, transfer and disclosure to other parties.

GDPR

It means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, pp. 1-88).

Stock

It means Stock Spirits Group PLC, Solar House, Mercury Park, Wooburn Green, Buckinghamshire, HP10 0HH, United Kingdom

Stock Group Companies,

They mean:

  • Stock Spirits (UK) Limited – Solar House, Mercury Park, Wooburn Green, Buckinghamshire HP10 0HH, UK
  • Stock Polska Sp. z o.o. with its registered office in Lublin, Poland, address: ul. Spółdzielcza 6, 20-402 Lublin, Poland
  • Stock Slovensko s.r.o. with its registered office in Bratislava, Slovakia, address: Galvaniho 7/A 821 04 Bratislava, Slovakia
  • Stock Plzeň – Božkov s.r.o. with its registered office in Plzeň – Božkov, the Czech Republic, address: Palírenská 641/2, 326 00, Plzeň – Božkov, the Czech Republic
  • Stock s.r.l. with its registered office in Milan, Italy, address: Via Tucidide, 56 bis - Torre 2, 20134 Milan, Italy
  • Stock BH d.o.o. with its registered office in Sarajevo, Bosnia and Herzegovina, address: Džemala Bijedića 185/12, 71000 Sarajevo, Bosnia and Herzegovina
  • Stock d.o.o. with its registered office in Zagreb, Croatia, address: Josipa Lončara 3, 10090 Zagreb, Croatia
  • Stock International s.r.o. with its registered office in Plzeň – Božkov, the Czech Republic, address: Palírenská 641/2, 326 00, Plzeň – Božkov, the Czech Republic

We, our, etc.

It means, depending on the context, Stock or Stock Group Companies

You, your

It means a living individual whose personal data is used by Stock or Stock Group Companies, namely a Website user, including a person applying for a job with Stock Group Companies using online forms.

How do we use your personal data?

We use your personal data in connection with maintaining the Websites for the purposes described below. Depending on the use made of data, either Stock or one of the Stock Group Companies will be the data controller – the party responsible for ensuring that data use is consistent with data protection laws.

Stock is the controller for personal data processed for the purposes of:

  • ensuring compliance with the legal restrictions on advertising and promotion of alcoholic beverages,
  • newsletter subscription,
  • optimising the Website operation,
  • monitoring website traffic and ensuring correct operation of the Websites,
  • monitoring the effectiveness of marketing campaigns,
  • improving the user Website experience,
  • ensuring Website use safety.

The local Stock Group Company is the controller for personal data processed for the purpose of:

  • responding to queries,
  • recruitment.

In addition, both Stock and Stock Group Companies – each within their own scope of responsibility – are controllers for personal data processed for the purpose of handling and resolving any requests, complaints and queries they receive in relation to the exercise of the rights granted to data subjects by GDPR.

Stock Group Companies are data controllers in the scope of the activity of the above mentioned relation to the following Websites:

www.stock-polska.pl

www.stock-spa.it

www.stock.sk

www.stock.cz

www.stock.hr

www.stock.ba

and to any other websites containing links hereto.

Ensuring compliance with legal restrictions on advertising and promotion of alcoholic beverages

We use personal data including information about the country of residence and date of birth provided by users to ensure that messages associated with advertising and promotion of alcoholic beverages are not addressed to minors. The legal basis under which we use your personal data for this purpose is our legal obligation (Article 6(1)(c) of GDPR) provided for by national laws which restrict advertising and promotion of alcoholic beverages.

Your data will be deleted as soon as the age verification has been successfully completed. The information about the successful passage of verification will be stored in the memory of your device via cookies until the end of the Website browsing session (session cookies). However, if you tick the “Remember me on this device” checkbox (by which you agree to having persistent cookies saved on your device), such information shall also be stored after the end of the browsing session. In such case, depending on the website browsed, such information may be stored even for up to 10 years. The cookies we use come from our websites, which means that no third parties have access to the information saved on your device.

Responding to queries

We use your personal data including your email address, telephone number, and any data you choose to provide to us by filling out the query form, for the purpose of contacting you, responding to your query or taking other action in relation to your message. The legal basis under which we process your personal data for this purpose is our legitimate interest (Article 6(1)(f) of GDPR), which is to provide appropriate service to Website users, including customers.

However, if – when completing the query form – you decide to submit data we cannot use by invoking our legitimate interest, we will assume that by submitting the query, you agree for such data to be used for the above purpose. In such a case, the processing of your personal data will be based on your consent (Article 6(1)(a) of GDPR). You can withdraw your consent at any time without any consequences.

Your data will be stored for a period necessary to answer your query or to take other action in relation to your message, but for not longer than 1 year.

Newsletter subscription

We use your personal data including your name, surname and email address to send you a newsletter with updates about Stock Spirits Group PLC. We assume that by subscribing to the mailing list, you agree for your personal data to be used for this purpose. The legal basis for the processing of your personal data will be the performance of a contract (Article 6(1)(b) of GDPR).

Your data will be stored up to 2 years, but not longer than until you withdraw subscription.

Recruitment

We use your name, email address, telephone number, country of residence, information about your professional interests, and any other details you choose to share with us when enclosing your application documents (including your CV) or when completing the form. We use the above data to create a list of candidates for vacant jobs and to contact you in matters related to your recruitment process. The legal basis for the processing of your personal data for this purpose will vary depending on:

  • the legal basis for the employment you are seeking,
  • the scope of information you submit in the application documents and in the message form,
  • the provisions of the labour law effective in the individual countries.

Therefore, the legal basis under which we process your personal data for this purpose is our legal obligation (Article 6(1)(c) of GDPR), your consent (Article 6(1)(a) of GDPR) or legitimate interest (6(1)(f) of GDPR).

You can withdraw your consent at any time without any consequences. After withdrawing your consent, your data will not be used for recruitment.

Your data will be stored for 1 year from the date on which you submit your application using the online form.

Contests and events

You may find the detailed information on the processing of your personal data as part of the contests and events we organise on the website dedicated to the contest or event.

Monitoring the website traffic and ensuring correct operation of the Websites

We use your personal data including your IP address, information about your operating system and browser and terminal equipment, the content of the Websites you view (identified based on the URL), as well as other information about your activity on our Websites, including the information recorded and stored in cookies. We use such data and information to:

  • monitor the Website traffic and to estimate the visit time and number, to monitor channels generating traffic and the Website use habits;
  • ensure correct operation of the Websites and to adjust the Websites to user’s terminal equipment and browsers, to detect errors in Website operation and to make the search faster.

The legal basis for the processing of your personal data for this purpose is our legitimate interest (Article 6(1)(f) of GDPR), consisting in learning more about the needs, expectations and habits of Website users and ensuring effective communication via the Websites.

Your data will be stored for the above purposes for no longer than 1 year. However, this does not concern the identifiers and data stored in persistent cookies with longer lifespan (as described in more detail hereinbelow).

In connection with the monitoring of traffic on the Websites (also in connection with the use of Google Analytics tools), we use unique identifiers and other data stored in the memory of your device using persistent cookies. The cookies we use come both from our websites as well as from .google.com. Such cookies’ lifespan is no longer than 2 years. The identifiers and other data stored in the memory of your device may be accessed by Google Ireland Limited.

Monitoring the effectiveness of marketing campaigns

In connection with the monitoring of the effectiveness of active campaigns, also in connection with the measurement of the view through conversion, we use certain data (including the identifiers) which constitute personal data. The legal basis for the processing of your personal data for this purpose is our legitimate interest (Article 6(1)(f) of GDPR), consisting in the marketing of own products. Such data may be stored in the memory of your device using persistent cookies and they include:

  • unique identifiers used for the purpose of measuring the view through conversion and the information about whether you have viewed the advertisement or whether you moved between the websites;
  • other auxiliary information relating to the temporary storage of the aforesaid data before their transfer to the server, and to the diagnostics of the server connection.

Your data shall be stored for the above-listed purposes for a period corresponding to the lifespan of persistent cookies, i.e. for the maximum of 1 year.

The cookies we use come from the .cloudflare.com website, which means that Cloudflare, Inc. may have access to the identifiers and other data stored in the memory of your device.

Improving user Website experience

In connection with improving the user Website experience, also with preventing the recurring display of communications, we use certain information, including the identifiers, which does not constitute personal data. Such information may be stored in the memory of your device using cookies and it includes:

  • the information about the display of the contents of websites on a small-screen device (we use persistent cookies with the lifespan slightly exceeding 1 year);
  • the information about the display of the cookies message (we use persistent cookies with the lifespan of 1 year or 3 years, depending on the website).

The cookies we use come from our websites, which means that no third parties have access to the information stored on your device.

Ensuring Website use safety

In connection with ensuring Website use safety, we use certain information (including the identifiers of the browsing session or of the device) which constitute personal data. Such information is stored in the memory of your device using cookies. The legal basis for the use of such data is the legal obligation imposed on us under Article 6(1)(c) of the GDPR consisting in ensuring safety (also privacy and integrity) of the personal data sent as part of the users’ communication with the Website servers and, in cases going beyond the legal obligation imposed on us, our legitimate interest (Article 6(1)(f) of the GDPR) consisting in ensuring the safety of users’ communication with the Website servers. Your data shall be retained for the above purposes for a period corresponding to the lifespan of persistent cookies (as described in more detail hereinbelow).

As regards the session identifiers, we use them to ensure the safety of logging in to the Website contents, the access to which is restricted. For this purpose, we use session cookies from our websites, which means that no third parties have access to the information stored on your device.

As regards the device identifiers, we use them for the purpose of distinguishing the devices to which the same IP address has been assigned, and thus for the purpose of distinguishing the users visiting the website in good faith from the users who do so in order to distribute spam messages and malware. For this purpose, we use cookies with the lifespan of 1 year which come from the .cloudflare.com website, which means that Cloudflare, Inc. has access to the information stored on your device.

Handling requests, complaints and queries related to the exercise of rights granted to data subjects

We use your personal data including your email address and any data you choose to provide to us in email for the purpose of handling and resolving your requests, complaints and queries related to the exercise of the your rights granted by GDPR, taking action in response to your request, complaint, or query, and communicating such actions to you.

The legal basis for the processing of your personal data for this purpose is our legal obligation arising under GDPR (Article 6(1)(c) of GDPR).

Your data will be stored for this purpose for 5 years from the date of request, complaint or query.

Shareholder administration

In addition to processing personal data in connection with maintaining the Websites, Stock also processes as a personal data controller certain personal data within the scope specified below in connection with its shareholder administration activities, in particular in order to maintain and update its share register, shareholder records and share transactions register, pay dividends and interest, manage shareholder enquiries, organise general meetings, provide services to Stock’s staff and its shareholders in connection with shareholder administration, including online services available through online web portals allowing Stock’s staff to view the share register and Stock’s shareholders to access and manage their shareholdings. The processing of personal data within these activities is carried out to comply with Stock’s legal obligations and fulfil Stock’s legitimate interest in administering matters relating to the shareholders of the company.

Processing of personal data for the abovementioned purposes concerns the following data subjects and categories of personal data:

Data Subjects Categories of Personal Data
a) Registered shareholders
b) Executors, administrators and legal representatives of a deceased shareholder or in relation to a bankruptcy order
c) Transferees where there is a change of ownership
d) Indirect shareholders (for example through a registered nominee or custodial shareholding), and including indirect shareholders with information rights
e) Indirect or beneficial shareholders where their details are obtained under section 793 of the UK Companies Act 2006 (or equivalent legislation)
f) Any person or entity requesting copies of information and document circulated by Stock to its shareholders
g) Stock’s employees, directors or contractors
Full name, email address, registered address, telephone number, full date of birth, nationality, bank account details, national insurance number, passport number and overseas identification card numbers, shareholdings, communication method preference, and any data that is mirrored from the CREST system, copies of documents such as death certificates and grants of probate.

In relation to the online portal: mother’s maiden name, user names combined with passwords, cookies and online identifiers, security questions plus answers.

In relation to due diligence and anti-money laundering checks: scanned or photocopied images of passports, driving licences and utility bills.

Regulatory requirements: In addition to some of the above categories, details of the countries where tax resident.

The personal data of a particular data subject may be processed for up to 13 years from the date that the shareholding of such data subject becomes a nil share balance and no outstanding cash balance is held in relation to such data subject.

Personal data within the abovementioned scope in connection with Stock’s shareholder administration activities will be processed by Link Market Services Limited, a company registered in England with registered number 2605568 and having its registered office situated at The Registry, 34 Beckenham Road, Beckenham, Kent, BR3 4TU (“Link”), which provides to Stock services connected to shareholder administration and acts as a personal data processor, based on a separate data processing agreement between Stock and Link. Link may engage another processor, with which Link shall conclude a contract setting out personal data protection obligations which are no less onerous than those imposed on Link. The data may also be transferred outside the European Economic Area provided that such a transfer satisfies the requirements of the GDPR.

Who do we share your personal data with?

We share your personal data in the following cases:

  • when this is required by applicable laws, in particular at the request of the Public Prosecutor’s Office, the Police and other state authorities
  • when this is necessary in pursuit of our needs, in particular by:
    • law firms
    • other Stock Group Companies

In addition, your personal data may be shared with service providers - parties which process personal data at our request or on our behalf:

  • providers of ICT services, such as hosting, and supply or maintenance of computer systems and applications;
  • Google Ireland Limited, the provider of Google Analytics tools;
  • Cloudflare, Inc., the provider of security tools and measurement of the effectiveness of marketing campaigns.

Your personal data are shared with service providers under contracts whereby they are required to follow our instructions.

Given that Cloudflare, Inc. has its registered seat in the United States of America, your personal data may be transferred outside of the European Economic Area. Therefore, we made sure that Cloudflare, Inc. guarantees the high level of personal data protection corresponding to the level ensured under the GDPR. Such guarantees result from the participation of Cloudflare, Inc. in the “Privacy Shield” programme established under Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-U.S. Privacy Shield. Please find the Cloudflare, Inc. entry in the list of entities participating in the “Privacy Shield” programme below.

What rights do you have?

You have the right to:

  • request access to your personal data, confirmation that your personal data are used, copies of your personal data and information about the purposes of use, categories of personal data, categories of recipients to whom personal data has been or will be disclosed, the planned personal data retention period, and the source from which we have acquired the data (based on Article 15 of the GDPR).
  • request a copy of the personal data you have submitted to us and demand that it be provided to you or other party named by you in a commonly used, computer readable format – this applies to cases where we use your data on the basis of your consent or for the purpose of performing a contract (based on Article 20 of GDPR)
  • request that your data be rectified when incomplete or incorrect (based on Article 16 of GDPR)
  • request that all or some of your personal data be erased (based on Article 17 of GDPR) if:
    • you have withdrawn your consent, and we have no other legal basis for using the data,
    • Your personal data are no longer necessary in relation to the purposes for which they were collected or used,
    • You have filed an objection, and we have granted it,
    • Your personal information is used unlawfully
  • request restriction of the use of your personal data (pursuant to Article 18 of GDPR), i.e. demand that we stop using the data; however, this does not apply to the storage of your personal data where:
    • you contest the accuracy of your personal data; in such a case we will restrict use for a period needed to verify the accuracy of your data;
    • you contest the lawfulness of the use of your personal data by us;
    • we no longer need the data, but you need them to establish, exercise or defend legal claims;
    • you have objected to the use of your data – until we establish whether your objection is based on legitimate grounds.

You also have the right to:

  • object, on grounds related to your particular situation, against the use of your personal data on the basis of our legitimate interests. Following such an objection, we will consider whether – on account of your particular situation – the protection of your interests, rights and freedoms overrides the interests we pursue in using your personal data. If your objection proves to be justified and there is no other legal basis for the use of the data, we will erase them (pursuant to Article 21(1) of GDPR)
  • withdraw your consent to the use of your personal data at any time. Such withdrawal is without prejudice to the lawfulness of the use of the data on the basis of your consent prior to withdrawal (pursuant to Article 7 of GDPR)

If you have any questions, comments and requests regarding this Privacy Policy, wish to withdraw your consent or exercise your rights, please contact us You can contact us by sending an email to: gdpr@stockspirits.com

You are also entitled to file a complaint to the supervisory authority relevant for yours place of employment or residence.

How can you manage cookies?

We save cookies on your device if you consent to it. This does not concern only the session and persistent cookies required to ensure the Website use safety and session cookies required for the purpose of age verification. You may grant your consent by clicking the “accept” button in the cookie banner displayed on our Websites. To remember your choice regarding the acceptance or rejection of cookies we will save an additional cookie on your device for no longer than 1 year.

With respect to the persistent cookies storing information about the successful passage of age verification (described above) you grant your consent by ticking the “Remember me on this device” checkbox during the age verification process.

By introducing a relevant change to the browser settings, you may delete the already saved cookies (e.g. together with the browser history and caches) or block the possibility of storing new cookies. Depending on the selected settings, you may block or delete all or some of the cookies. For example, you may block the storing of persistent cookies or cookies from other websites as well as delete cookies stored in particular timeframes or during a given session. You may also choose to view our website in the “private” mode, which will restrict the range of the data registered by the computer.

You may find more information on the relevant browser provider’s website:

To find information relating to other browsers, visit the browser provider’s website.

To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org

How will you learn about a change to this Privacy Policy?

Any future changes to our Privacy Policy will be published on this website and, where appropriate, communicated to data subjects by electronic means, providing relevant information about intended changes and the date of their entry into force.