Privacy notice

Awaiting owner / legal review. A public privacy contact, ICO registration status, final processor list and owner-approved retention schedule remain outstanding. Checkout stays closed until launch review is complete.

Who is responsible for your data

ROMAL GROUP LIMITED, trading as BILLIONAER Spirits, is the data controller. Its registered office is 167 Great Portland Street, London, England, W1W 5PF. Until a dedicated privacy address is confirmed, use the contact form.

What we collect and why

• Orders and returns — name, email, telephone number, delivery address, order contents, status and support records, where necessary to enter into or perform our contract, meet legal duties and establish or defend legal claims.
• Age verification — our system is designed to retain a provider session reference, method, threshold result, status and short-lived assertion, not your date of birth, identity images or document numbers. This supports our legal obligation not to sell alcohol to under-18s.
• Payment data — when payment is configured, the payment provider will process card details. This shop will keep order/payment references and status, not full card numbers, to perform the contract and meet accounting and fraud-prevention duties.
• Accounts, enquiries and essential site data — account profile and order access if you register, messages you send, plus basket, a 48-day age-confirmation and versioned consent choices stored on your device. These support the service, security and your requests. The entry confirmation contains no date of birth or identity data and does not replace the separate age check required before payment and delivery.

Marketing emails

Newsletter email is based on your consent and uses double opt-in. You can withdraw consent through the unsubscribe link at any time. Withdrawal does not affect earlier lawful use. We do not send marketing until the email service is configured.

Analytics and advertising

Pseudonymous first-party page-view records are sent only after analytics consent. They use a random browser identifier and exclude query strings and order references. The identifier is removed from the browser when consent is withdrawn, expires or becomes invalid. No third-party analytics or advertising provider is configured, and advertising tracking does not run. You can change or withdraw your choice on our cookie notice.

Who we share data with

We use service providers only where needed to host and secure the shop, store records, verify age, take payment, send email or deliver an order. Supabase currently hosts shop records. Yoti, the payment provider, email provider and carrier are not operational until configured and approved. We may also share data where law requires it.

Awaiting owner / legal review. Final processor names, locations and any UK adequacy decision, UK IDTA or other transfer safeguard must be recorded before those services become operational.

How long we keep it

We keep data only as long as needed for the purpose collected, legal/accounting and licensing duties, fraud prevention and claims. Short-lived age assertions expire by design; the minimum verification result and provider reference may be retained with the order. Cookie choices stored in the browser expire after 180 days, while the 18+ self-declaration expires after 48 days without renewal merely because the shop is revisited. Enquiries and marketing records are reviewed and erased or anonymised when no longer needed. The final owner-approved retention schedule is a launch requirement.

Your rights

Depending on the circumstances, you can ask for access, correction, deletion, restriction or portability, object to certain processing, and withdraw consent. You can complain to the Information Commissioner’s Office or call 0303 123 1113. This page is operational information, not legal advice.