Skip to content

Legal

Privacy Policy

Placeholder — for solicitor review

This is draft template copy provided as a starting point only. It is not legal advice and must be reviewed and finalised by a qualified solicitor before launch.

Last updated: Draft — 3 June 2026

This Privacy Policy explains how LapalmaTrade Ltd (“we”, “us”, “our”) collects, uses, shares, and protects the personal information of trade visitors to www.magueyandco.co.uk. We are committed to handling your data lawfully, fairly, and transparently in accordance with the UK GDPR and the Data Protection Act 2018.

1. Who we are

Maguey & Co. is a trading name of LapalmaTrade Ltd, a UK specialist B2B importer and wholesaler of mezcal, registered in England & Wales under company number 14868700, with its registered office at 20-22 Wenlock Road, London, N1 7GU. LapalmaTrade Ltd is the data controller for personal information collected through www.magueyandco.co.uk.

We are not required to appoint a statutory Data Protection Officer. For any privacy query, or to exercise your rights, contact us at contact@magueyandco.co.uk.

2. Information we collect

We only collect the information we need to operate a B2B trade relationship:

  • Information you give us through our trade application, contact, sample request, and order request forms — for example your name, job role, business/company name, work email, phone number, town or city, and where relevant your company or VAT number and order details.
  • Trade portal access — the trade portal is protected by a shared password. We do not create an individual account or store a username for each visitor; logging in sets a short-lived technical cookie (see our Cookie Policy).
  • Communications — the content of emails and messages you send us, and our replies.
  • Technical data — limited information processed by our hosting and form providers to deliver and secure the site, such as IP address, browser type, and request logs.

3. How we use your information

  • To assess, set up, and manage trade account applications.
  • To respond to enquiries and to arrange tastings or samples.
  • To process, confirm, and fulfil order requests.
  • To operate, secure, and improve the website and trade portal.
  • To send service or relationship communications relevant to your trade account.
  • To comply with our legal, accounting, and regulatory obligations.

We do not use your information for automated decision-making or profiling, and we do not sell your personal data.

4. Lawful bases for processing

We rely on the following lawful bases under UK GDPR:

  • Performance of a contract — to set up your trade account and to process and fulfil your orders.
  • Legitimate interests — to manage and develop B2B relationships, respond to trade enquiries, and keep the site secure. Where we rely on legitimate interests, we have considered that these are not overridden by your rights and interests.
  • Legal obligation — to meet accounting, tax, alcohol-trade, and other regulatory requirements.
  • Consent — for any non-essential cookies, which are only set if you accept them via our cookie banner. You may withdraw consent at any time.

5. Marketing

We do not currently send marketing communications. We may contact you about your trade account, enquiries, and orders. If we introduce marketing in future (for example a trade newsletter), we will only do so where permitted and will give you a clear way to opt out at any time by emailing contact@magueyandco.co.uk.

6. Who we share your information with

We use trusted third-party service providers (processors) to operate the site and our business. They act on our instructions and are bound by appropriate data protection obligations. We currently use:

  • Netlify — website hosting, content delivery, and the trade-portal access function.
  • Formspree — receiving and forwarding submissions from our website forms.
  • Google Workspace — our business email, used to receive and respond to your communications.

We may also share information with professional advisers, and with authorities or regulators where required by law. We do not sell your data.

7. International transfers

Some of our providers are based outside the UK (for example in the United States or the EU). Where personal data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

8. How long we keep your information

We keep personal data only for as long as necessary for the purposes set out above, after which it is securely deleted or anonymised. Our intended retention periods are:

  • Unsuccessful trade applications and general enquiries — up to 12 months.
  • Active trade account records — for the duration of the relationship and then up to 6 years after the last transaction, to meet accounting and tax requirements.
  • Order and transaction records — at least 6 years, in line with HMRC requirements.

9. How we protect your information

We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS) and restricted access to information on a need-to-know basis. No method of transmission over the internet is completely secure, but we take reasonable steps to safeguard your information.

10. Your rights

Under UK data protection law you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. Where we rely on consent, you may withdraw it at any time. To exercise any right, email contact@magueyandco.co.uk; we will respond within the time limits required by law.

If you are unhappy with how we have handled your data, you may complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — telephone 0303 123 1113, or ico.org.uk. We would, however, appreciate the chance to address your concerns first.

11. Cookies

See our Cookie Policy for details of the cookies and similar technologies we use.

12. Changes to this policy

We may update this policy from time to time. The latest version will always appear on this page, with the “last updated” date amended accordingly.

13. Contact

Questions about this policy or your personal data? Email contact@magueyandco.co.uk or write to us at our registered office, 20-22 Wenlock Road, London, N1 7GU.