Goldmark × Draft Pick · The small print

Privacy
policy.

Version 2.13 · Last updated 26 October 2026

1. Who we are

Goldmark Craft Beers Ltd (Company No. 08366457), 23 The Vinery, Poling, Arundel, West Sussex, BN18 9PY, operates this website and is the data controller for personal data collected through it.

Draft Pick is a beer and merchandise range brewed and sold by Goldmark Craft Beers Ltd. It is a brand, not a separate company, and buying a Draft Pick item is a contract with Goldmark Craft Beers Ltd.

For anything on this page, contact us at info@goldmarkdraftpick.com or 01903 297 838.

2. What we collect, and why

We only collect what a specific job needs. There is no profiling and no advertising.

When	What	Why we’re allowed to
You place an order	Name, email, phone, billing and delivery address, what you bought and what you paid	To perform our contract with you
You use our Saturday shop stamp card	Nothing that identifies you. The card in your Apple Wallet carries a random card number. Against it we keep your stamps, your level, and each stamped sale by brand and size (for example one Goldmark 2-pint) with the date and which of our staff stamped it. Apple Wallet gives us a random device number and an update address so your card can refresh; neither is your phone number or name	Our legitimate interest in running the loyalty card you added, and in knowing which of our beers sell
You join Cellar Club	Your email and payment details, held by Stripe to take the yearly payment, send receipts and handle renewal or cancellation. We keep only the date your membership runs to and Stripe’s reference numbers, against your card number. You confirm you are 18 or over	To perform our contract with you
You contact us	Name, email, phone, venue, what you’re interested in, your message	Our legitimate interest in answering you
You ask for one of our beers at your local	The pub and town you name, which beer, and which QR code brought you to the page if any. Your email address only if you choose to give it, used only to tell you when the beer is pouring there. Your first name only if you choose to give it, which we pass on to that pub, and no one else, so they know a regular asked. The same scrambled counter as the contact form stops automated abuse	Our legitimate interest in getting our beer into the pubs people ask for, and in answering you. Leave your name out and the pub only hears that someone asked. If you also tick the newsletter box, that sign-up works exactly as described in the next row
You sign up for our emails	Your email address, that you confirmed you are 18 or over, the exact wording you agreed to and when, where on the site you signed up, and when you clicked the confirmation link	Your consent. We only email you after you click the link we send, and you can withdraw at any time with the link in every email
You confirm your age	A yes/no record on your own device. We do not receive a date of birth	Our legal obligation under alcohol licensing
We keep the books	Order and payment records	Our legal obligation under tax law
Anyone submits the contact form, starts a checkout or opens a page	A counter, kept against a scrambled version of your connection’s address and, for the contact form, of your email address. We keep the scrambled value and a count, never the address itself, and it cannot be turned back into one. Deleted within a day	Our legitimate interest in stopping automated abuse of a public form
Something on the site goes wrong	A note of what failed — which part of the site, and the error message it produced. Before that note is saved we strip out anything that looks like an email address, a phone number or a postcode, because an error message often quotes whatever it choked on. We are telling you this even though the result should contain nothing about you	Our legitimate interest in knowing when our own shop is broken
Anyone opens a beer’s own page	One added to a daily count for that beer, split by the QR code or link that brought the visit (for example “pump clip” or “drip mat”). Our visit counting uses no cookies and stores nothing on your device. No address, identifier or time of day is kept — only the day’s total, and it cannot be traced back to you. Links we print or send carry their tag after a # so that it never reaches our server.	Not personal data. Listed so you know it happens: it tells us which pump clips and drip mats are worth printing
Anyone opens a page on this site	One added to a daily count for that page, split by the tag on the link that brought the visit (for example “pump clip” or “email signature”) and by the name of the website that linked to us, if any (for example “google.com”, never the page itself). Our visit counting uses no cookies and stores nothing on your device. No address, identifier, browser detail or time of day is kept with the count — only the day’s total. It cannot be traced back to you. Search-engine robots and our own staff are not counted. To stop a script inflating the numbers, the same scrambled abuse counter as the contact form is used, and deleted within a day (see below). Links we print or send carry their tag after a # so that it never reaches our server.	Not personal data. Listed so you know it happens: it tells us which of our pump clips, cans, emails and printed links are worth the effort
You arrive on one of our tagged links, then contact us, ask for a beer, sign up or order	The tag on the link you arrived on (for example “pump clip / qr”), saved with that enquiry, ask, sign-up or order. Until then the page only holds it in memory: it is never written to your device, and it is forgotten when you close the tab	Our legitimate interest in knowing which of our printed links and emails bring us customers. It is kept, and deleted, with the record it is saved on

We never see or hold your card details. Card entry happens on Stripe’s own payment page. What comes back to us is a payment reference — never a card number.

3. Cookies and things stored on your device

We set no advertising or tracking storage of any kind. There is no Google Analytics, no tag manager, no advertising pixel, no session recording, and nothing about you is shared with an advertiser or a data broker.

This used to say something different. Until 17 September 2026 the hosting platform this site runs on stored an identifier for your browsing session and sent the platform a note of which pages you looked at. We had not asked for it and got nothing from it, but it was switched on by default and we had not checked. We have now turned it off at the source: no identifier is stored and no page views are sent. Our visit counting uses no cookies and stores nothing on your device. It identifies nobody: one added to a daily total per page, described in section 2. Because nothing is stored on or read from your device for the counting, it does not appear in the table below and needs no consent. If we ever want statistics that would need a cookie or an identifier, we will ask you first — in the same release, not afterwards.

Everything stored on your device is listed here in full, ours and theirs. For a visitor who is not signed in that is the age confirmation alone, plus the bag once something is in it; brewery staff who sign in also have the sign-in keys. The only other thing ever written is the platform’s entry in the last row, and only when one of our older links is followed.

Name	What it’s for	How long it stays	Strictly necessary
gmdp_age_verifiedCookie, local storage and session storage	Remembers you confirmed you are 18 or over, so we don’t ask on every page. Required by our licence	The cookie and the local-storage copy last 30 days; the session copy goes when you close the tab	Yes
gmdp_cartLocal storage	Remembers what you put in your bag. Written only once something is in it; holds item and quantity only — never a price	Until you clear it or empty your bag	Yes
base44_access_token, tokenLocal storage	Keeps brewery staff signed in to the admin area. Not set for ordinary visitors	Until you sign out or clear it	Yes
b44_landing_attrCookie and session storage	Set by our hosting platform, not by us, and only if you follow one of our older links that carries its tag after a “?”. Our current links carry the tag after a “#” instead, which sets nothing at all	Set and cleared by the platform, so we cannot say — and cannot shorten it	No — which is why our current links avoid it

Everything we set ourselves is strictly necessary — the site cannot do what you asked of it without them — so no consent is required. The one entry that is not is set by our hosting platform rather than by us, and only on our older links; it is the reason our current links carry their tag after a “#”, which sets nothing on your device at all. You can clear any of these at any time in your browser settings; the age question will simply be asked again.

4. Who else handles your data

We use a small number of suppliers. Each one is named here rather than hidden behind “our partners”.

Base44 — hosts this website and its database.
Stripe — takes the payment. Stripe handles your card details directly; we never receive them. For Cellar Club, Stripe also holds your email for receipts and renewal.
Apple — delivers the stamp card to your Apple Wallet and tells it to refresh. We send Apple only the random card number and the update address your Wallet gave us.
Resend — sends your order emails, and our newsletter emails if you sign up. It also delivers your “ask for it at your local” request to our own inbox.
Royal Mail — delivers posted orders, and is given the name and address on the label.
OpenStreetMap — draws the maps on our website. To show a map, your browser fetches map images from OpenStreetMap’s servers, which see your connection’s address the way any website does. We send them nothing about you.
Microsoft — holds our nightly backup. So that we could recover if the website’s platform ever lost data, a copy of the database is saved to Microsoft OneDrive each night. That copy includes order and enquiry records, and therefore the details you gave us. It is not shared with anyone and is not used for anything else.
Google — held our nightly backup until 21 September 2026, in Google Drive. Those earlier copies are still there until we delete them, which we will do once the new backup has run reliably. No new copies go to Google.

We do not sell your data, and we do not share it for anyone else’s marketing. If we ever add a supplier that handles your personal data, this list changes before they do.

5. How long we keep it

Orders and payment records — six years after the end of the tax year they fall in, because tax law requires it. At that point your name, email, phone number and address are removed from the record and only the financial detail is kept.
Enquiries — two years from your last contact with us, then deleted.
Email sign-ups — for as long as you stay subscribed. When you unsubscribe your address is deleted, not just marked. If you never click the confirmation link, the request is deleted after 7 days.
Requests to ask for a beer at your local — 12 months from when you sent it, then deleted, including any email address you gave. The daily visit counts hold nothing about you and are kept as business records.
Daily visit counts — hold nothing about you and are kept as business records. The tag on the link you arrived on is kept, and deleted, with the enquiry, ask, sign-up or order it was saved on.
Stamp card — your stamps and sale counts stay while the card is in use. Remove the card from your Wallet and its update address is deleted straight away; the card number and counts hold nothing about you and are kept as business records.
Cellar Club — Stripe keeps your email and payment records for as long as tax law requires (see orders above). On our side only the end date and Stripe’s reference numbers stay against your card number, which holds nothing about you.
Abuse counters — deleted within a day.
Fault notes — 90 days, or 30 days once we have dealt with the fault.
Age confirmation — never reaches us. It lives on your device for 30 days.

This happens automatically. A job runs every night and removes whatever has passed the periods above. It is not a promise somebody has to remember to keep.

If you ask us to remove your data sooner we will do it within one month, and we will tell you if any part must be kept for the tax reason above.

6. Your rights

You can ask us to:

Give you a copy of the personal data we hold about you.
Correct anything that is wrong.
Delete it, or restrict what we do with it.
Object to us using it where we rely on our legitimate interests.

Email info@goldmarkdraftpick.com or call 01903 297 838. We answer within one month, and it costs nothing.

One honest limit: where you have bought something, we cannot delete the order and payment record until the tax retention period has passed. We can remove the parts that are not needed for that record.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

7. Changes to this notice

This notice is versioned. The version and date at the top of this page change whenever the notice does. This is version 2.13, published 26 October 2026.

Privacypolicy.