Privacy Policy

1. Who controls your information

Blast Drinks is the controller of the personal information described in this policy. Before launch, Blast must add its complete legal entity name, registered address and company number here. Privacy questions and rights requests can be sent to privacy@blastdrinks.co.uk.

2. Information we collect

We collect the contact name, business name, email address, mobile number, delivery address and account credentials you provide. We also keep allocation and order choices, payment references and status (not full card details), consent timestamps, order messages, expected delivery dates and account security information such as session, device and IP data.

3. Why we use it

We use personal information to create and secure your account; take and fulfil stockist orders; process payment; allocate inventory; arrange delivery; send required payment, production, safety, cancellation and delivery messages; respond to questions; prevent fraud; keep accounting records; and establish or defend legal claims.

Our lawful bases are performance of the stockist contract, compliance with legal obligations, and our legitimate interests in operating a secure ordering and fulfilment service. Where we ask for consent, you may withdraw it, although we may still send information strictly necessary to perform an active order where another lawful basis applies.

4. Service messages, not marketing

The required SMS option is limited to factual, non-promotional messages about an active or past order—for example payment confirmation, production progress, expected delivery, delay, cancellation or product safety. We do not use that acknowledgement as permission for promotional texts. Marketing, if introduced later, will use a separate optional choice and a simple opt-out.

5. Who receives information

We share only what is needed with service providers that help us operate Blast, including our authentication and database hosting providers, Stripe for payments, Twilio for SMS, hosting and security providers, and delivery partners. We may also disclose information where law requires it or as part of a corporate transaction subject to appropriate safeguards.

6. International transfers

Some providers may process information outside the UK. Where this happens, we use an applicable adequacy regulation or approved contractual safeguards and supplementary measures where required. You may contact us for more information about the safeguards used.

7. How long we keep it

Account information is kept while the account is active and normally for up to 24 months afterwards. Order, payment and tax records are generally kept for six years after the relevant financial period. Operational message logs are normally kept for 24 months. We may keep information longer where required for a dispute, legal hold, safety matter or other legal obligation.

8. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, objection or portability of your personal information. You may also withdraw consent where consent is the basis used. To exercise a right, email privacy@blastdrinks.co.uk. We may need to verify your identity.

You may complain to the UK Information Commissioner’s Office. We would appreciate the chance to resolve the issue first.

9. Security and account choices

We use proportionate technical and organisational safeguards, including access controls, secure sessions, restricted staff tools and payment processing through Stripe. No internet service is risk-free. Use a unique password and contact us promptly if you suspect unauthorised account activity.

10. Changes

We may update this policy when the service, providers or law changes. We will show the effective date and provide a prominent account notice where a change materially affects how we use information.