Privacy Policy

(Status: November 2025)

1. Introduction

The following information explains how we process personal data when you use our website uk.holy.com, and/or our social media profiles. Personal data means any information that can be linked to an identifiable living individual, for example their name or IP address.

1.1. Who We Are

HOLY Softdrinks Ltd, Suite 1, 7th Floor, 50 Broadway, London, SW1H 0DB, United Kingdom (Registered in England and Wales with company number: 16880464) is the data controller responsible for this website and responsible for the personal data we collect from you. Being the data controller means we are responsible for deciding why and how we use personal data in our business. When we mention HOLY, "we", "us" or "our" in this privacy policy, we are referring to HOLY Softdrinks Ltd. Our legal representative is Daniel Jon Macken.

You can contact us by email at: hello@uk.holy.com.

We have appointed a Data Protection Officer who is responsible for looking after questions about this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the details provided above.

1.2. Scope of Processing, Purposes, and Legal Bases

We set out the scope of processing, purposes and legal bases in detail below. The legal bases on which we process personal data are generally as follows:

  • UK GDPR Article 6(1)(a) serves as our legal basis where we obtain consent for processing.
  • UK GDPR Article 6(1)(b) is the legal basis where processing personal data is necessary for the performance of a contract, for example when a website visitor purchases a product or we provide a service to them. This legal basis also applies to processing required for pre-contractual steps, such as enquiries about our products or services.
  • UK GDPR Article 6(1)(c) applies where we process personal data to comply with a legal obligation, for example in the context of tax law.
  • UK GDPR Article 6(1)(f) serves as the legal basis where we can rely on legitimate interests for processing personal data, for example for cookies that are strictly necessary for the technical operation of our website.

1.3. Data Transfers Outside the UK

Where we transfer data to service providers or other third parties outside the United Kingdom, the security of such transfers is ensured as follows:

  • Where the UK Government has recognised a country as providing adequate protection for personal data (UK adequacy regulations), we rely on that adequacy decision as the legal basis for the transfer. This applies to transfers to EU/EEA countries, Canada and Israel, among others.
  • For transfers to service providers in the USA, the legal basis for the transfer is the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework), where the service provider is certified under that framework.
  • In other cases (e.g. where no adequacy decision exists), the legal basis for the transfer is, unless we indicate otherwise, the International Data Transfer Agreement (IDTA) or an Addendum to EU Standard Contractual Clauses, as approved by the UK Secretary of State. These mechanisms form part of our contract with the relevant third party and ensure an equivalent level of protection for personal data transferred outside the UK. Many providers offer additional contractual guarantees beyond these mechanisms, for example encryption commitments or obligations to notify individuals if law enforcement seeks access to their data.

1.4. Retention Periods

Unless otherwise expressly stated in this privacy policy, data we store will be deleted once it is no longer required for its intended purpose and where no statutory retention obligations prevent deletion. Where data is not deleted because it is required for other lawful purposes, its processing will be restricted, meaning the data will be blocked and not processed for other purposes. This applies, for example, to data we are required to retain for commercial or tax law reasons.

1.5. Your Rights

You have the following rights in relation to your personal data:

  • Right of access
  • Right to rectification or erasure
  • Right to restriction of processing
  • Right to object to processing (see below for detail)
  • Right to data portability
  • Right to withdraw any consent given at any time

You also have the right to lodge a complaint with a data protection supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; https://ico.org.uk.

Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) of the UK GDPR; this also applies to profiling based on those provisions within the meaning of Article 4(4) of the UK GDPR.

1.6. Obligation to Provide Data

In the context of a business or other relationship with us, customers, prospective customers or third parties are only required to provide the personal data that is necessary for the establishment, performance or termination of that relationship, or which we are legally required to collect. Without this data, we will generally be unable to enter into a contract or provide a service, or continue an existing contract or other relationship. Required fields are marked as such.

1.7. No Automated Individual Decision-Making

We do not generally use fully automated decision-making as referred to in Article 22 of the UK GDPR to establish or conduct a business or other relationship. If we use such processes in individual cases, we will notify you separately where legally required.

1.8. Contact

When you contact us, for example, by email, telephone or via social media, we store the information you provide (e.g. name and email address) in order to respond to your enquiry. The legal basis for processing is our legitimate interest (UK GDPR Article 6(1)(f)) in responding to enquiries directed to us. Where your enquiry relates to an existing or prospective contractual relationship, processing is carried out for the performance of pre-contractual or contractual measures pursuant to Article 6(1)(b) of the UK GDPR. We delete data arising in this context once storage is no longer necessary, or restrict processing where statutory retention obligations apply.

1.9. Prize Draws and Competitions

We occasionally offer prize draws and competitions via our website or otherwise. We process the data collected in connection with these (e.g. name, email address, postal address, date of birth, and where applicable a photo) in order to enable participation, determine winners, notify them and send prizes. The legal basis is Article 6(1)(b) of the UK GDPR (performance of a contract). Where winners are publicly announced (e.g. by name or photo), this is done exclusively on the basis of prior consent pursuant to Article 6(1)(a) of the UK GDPR. Following conclusion of the competition and notification of winners, personal data will be deleted unless statutory retention obligations apply or further consent has been given.

1.10. Customer Surveys

We periodically conduct customer surveys to better understand our customers and their preferences. We collect the data requested in each survey. Our legitimate interest in better understanding our customers serves as the legal basis for the associated data processing pursuant to Article 6(1)(f) of the UK GDPR. Data is deleted once the survey results have been evaluated.

2. Newsletter and Marketing Emails

We reserve the right to send customers who have already used our services or purchased products from us information about our offerings by email or other means from time to time, unless you have opted out. The legal basis for this processing is Article 6(1)(f) of the UK GDPR. Our legitimate interest lies in direct marketing (UK GDPR Recital 47). Customers may object to the use of their email address for marketing purposes at any time and free of charge, for example via the unsubscribe link at the bottom of any email or by emailing us at the address provided above.

Prospective customers may subscribe to our free newsletter. We process the data provided at sign-up exclusively for the purpose of sending the newsletter. Sign-up is effected by selecting the relevant field on our website, ticking the relevant box on a paper form, or by another unambiguous action through which you express your consent to the processing of your data. The legal basis is therefore Article 6(1)(a) of the UK GDPR. Consent may be withdrawn at any time, for example by clicking the relevant link in the newsletter or by notifying us at the email address above. Processing carried out prior to withdrawal remains lawful.

On the basis of recipients' consent (Article 6(1)(a) of the UK GDPR), we also measure open and click rates for our newsletters in order to understand which content is relevant to our subscribers.

We send newsletters using Klaviyo, provided by Klaviyo, Inc., 125 Summer St, Floor 6, Boston, MA 02111, USA. The provider processes content, usage, meta/communications data and contact data in the USA. Further information is available in the provider's privacy policy at https://www.klaviyo.com/privacy/policy. Transfer to the USA is based on the UK-US Data Bridge: Klaviyo is certified under this framework.

3. Data Processing on Our Website

3.1. Note for Website Visitors

Our website stores information on the end devices of website visitors (e.g. cookies) or accesses information already stored on those devices (e.g. IP addresses). The specific information involved is described in the sections below. Such storage and access takes place on the following basis: Where it is strictly necessary for us to provide a service on our website that you have explicitly requested (e.g. to operate a chatbot or to maintain the IT security of our website), it takes place on the basis of Regulation 6(1) of the Privacy and Electronic Communications Regulations 2003 (PECR). In all other cases, such storage or access takes place on the basis of your consent pursuant to Regulation 6(1) PECR. Subsequent processing of that data is governed by the following sections and by the UK GDPR.

3.2. Informational Use of the Website

When you browse our website without actively providing us with information, we collect the personal data transmitted by your browser to our server in order to ensure the stability and security of our website. This is our legitimate interest, and the legal basis is therefore Article 6(1)(f) of the UK GDPR. These data are: IP address, Date and time of the request, Time zone difference from Greenwich Mean Time (GMT), Content of the request (specific page accessed), Access status / HTTP status code, Volume of data transferred, Website from which the request originates, Browser, Operating system and interface, Language and version of the browser software. This data is also stored in log files. It is deleted when it is no longer needed, at the latest after 14 days.

3.3. Web Hosting and Website Provision

GoDaddy

Our website is hosted by GoDaddy. The provider is GoDaddy Netherlands B.V., Schiedam, Netherlands. The provider processes personal data in the EU. Further information: https://www.godaddy.com/en-uk/legal/agreements/privacy-policy. Transfer to the EU is based on UK adequacy regulations. Legal basis: Article 6(1)(f) of the UK GDPR.

Shopify

Our website is hosted by Shopify. The provider is Shopify International Limited, Dublin, Ireland. The provider processes personal data in the EU. Further information: https://www.shopify.com/legal/privacy. Transfer to the EU is based on UK adequacy regulations. Legal basis: Article 6(1)(f) of the UK GDPR.

Shopify Content Delivery Network

We also use the Shopify Content Delivery Network. The provider is Shopify International Limited. The provider processes data in the USA. Transfer to the USA is based on the IDTA / UK Addendum to EU Standard Contractual Clauses. Further information: https://www.shopify.com/legal/privacy. Legal basis: Article 6(1)(f) of the UK GDPR.

3.4. Contact Form

When you contact us via our website contact form, we store the data requested in the form and the content of your message. The legal basis for processing is our legitimate interest pursuant to Article 6(1)(f) of the UK GDPR. Data is deleted once storage is no longer necessary.

3.5. Job Listings

Data provided in connection with an application is processed for recruitment purposes (Section 10(3) Data Protection Act 2018 / Schedule 2). Additional data is voluntary and based on consent (Article 6(1)(a) UK GDPR). Please do not include highly sensitive data (e.g. religion, political views). Data is deleted no later than six months after an unsuccessful application, or retained for one year if the applicant consented to future talent pools.

3.6. Customer Accounts

Visitors to our website may create a customer account on the basis of consent (UK GDPR Article 6(1)(a)). Consent may be withdrawn at any time, leading to deletion of the data unless statutory retention obligations prevent it.

3.7. Sale of Products

In processing your order, we process: name, address, telephone number (optional), email address. Processing is necessary for the performance of the contract concluded with you (UK GDPR Article 6(1)(b)). We share this data with our logistics provider Hive Technologies GmbH, Berlin, Germany (transfer based on UK adequacy regulations).

3.8. Rewards Programme

Where customers participate in our Rewards Programme, we process necessary master data, customer account data, transaction data, activity data and rewards metrics (coins, levels). The legal basis is Article 6(1)(b) of the UK GDPR. Where we process data to prevent and detect fraud, the legal basis is Article 6(1)(f) (legitimate interest).

3.9. Payment Service Providers

We use payment processors (independent controllers under Article 4(7) UK GDPR) to process payments under contract performance (Article 6(1)(b) UK GDPR): Amazon Payments Europe, American Express Europe, Apple Inc. (Apple Pay), Google Ireland Limited (Google Pay), Klarna Bank AB (Pay Later & Pay Now), Mastercard Europe, PayPal (Europe), Shopify Inc. (Shop Pay), Stripe Payments Europe, Visa Europe Services, Amazon Pay.

3.10. Strictly Necessary Cookies

Cookies help to make the website functional. Legal basis: Article 6(1)(f) of the UK GDPR. We use them for: language settings, shopping carts, storing session login data, payment processing operations, and playing Flash media content.

3.11. Third-Party Providers

3.11.1. Hive

Hive Technologies GmbH, Germany. Processes data in the EU. Legal basis: Article 6(1)(f) UK GDPR (adequacy regulations). Privacy policy: https://www.hive.app/legal/privacy-policy.

3.11.2. CookieFirst

Digital Data Solutions B.V., Netherlands. Consent management based on a legal obligation (Article 6(1)(c) UK GDPR). Privacy policy: https://cookiefirst.com/legal/privacy-policy/.

3.11.3. Klar

Klar Insights GmbH, Germany. Analytics based on consent (Article 6(1)(a) UK GDPR). Privacy policy: https://www.getklar.com/data-protection.

3.11.4. Google Web Fonts

Google Ireland Limited, Ireland. Local processing on our servers only. Legal basis: Article 6(1)(f) UK GDPR. Privacy policy: https://policies.google.com/privacy.

3.11.5. Shopify

Shopify International Limited, Ireland. Store infrastructure based on legitimate interests (Article 6(1)(f) UK GDPR). Privacy policy: https://www.shopify.com/legal/privacy.

3.11.6. Lifetimely

Lifetimely Oy, Finland. Analytics in the EU based on consent (Article 6(1)(a) UK GDPR). Privacy policy: https://www.lifetimely.io/policies/privacy-policy.

3.11.7. Hotjar

Hotjar Ltd., Malta. Analytics based on consent (Article 6(1)(a) UK GDPR). Privacy policy: https://www.hotjar.com/legal/policies/privacy/.

3.11.8. Google Analytics

Google LLC, USA. Analytics based on consent (Article 6(1)(a) UK GDPR). Data transfer to the USA covered by the UK-US Data Bridge framework. Privacy policy: https://policies.google.com/privacy.

3.11.9. Google Web Fonts (hosted externally)

Google Ireland Limited. External processing in the USA based on consent. Transfer via UK-US Data Bridge. Privacy policy: https://policies.google.com/privacy.

3.11.10. Meta Pixel

Meta Platforms Ireland Ltd. Conversion tracking based on consent. Transfer to the USA covered by the UK-US Data Bridge framework. Privacy policy: https://www.facebook.com/policy.php.

3.11.11. Google Conversion Tag

Google Ireland Limited. Tracking based on consent (transfer to USA via UK-US Data Bridge). Privacy policy: https://policies.google.com/privacy.

3.11.12. TikTok Pixel

TikTok Technology Limited, Ireland. Ad optimization based on consent. Transfer to the USA covered by IDTA / UK Addendum. Privacy policy: https://www.tiktok.com/legal/privacy-policy.

3.11.13. Facebook Conversion API

Meta Platforms Ireland Ltd. Analytics based on consent (transfer via UK-US Data Bridge framework). Privacy policy: https://www.facebook.com/policy.php.

3.11.14. Google Marketing Platform

Google Ireland Limited. Advertising scripts based on consent (transfer via UK-US Data Bridge). Privacy policy: https://policies.google.com/privacy.

3.11.15. Google Tag Manager

Google Ireland Limited. Tag management based on consent (transfer via UK-US Data Bridge). Privacy policy: https://policies.google.com/privacy.

3.11.16. Reviews.io

Liquid New Media Limited, UK. Local UK hosting, no international transfer. Processing based on consent (Article 6(1)(a) UK GDPR). Privacy policy: https://www.reviews.io/front/user-privacy-policy.

3.11.17. Klaviyo

Klaviyo, Inc., USA. Email marketing tools based on consent. Transfer via UK-US Data Bridge framework. Privacy policy: https://www.klaviyo.com/privacy/policy.

3.11.18. Google Merchant Center

Google Ireland Limited. Shop performance tracking based on consent (transfer via UK-US Data Bridge). Privacy policy: https://policies.google.com/privacy.

3.11.19. Facebook Custom Audiences

Meta Platforms Ireland Ltd. Advertising match lists based on consent (transfer via UK-US Data Bridge). Privacy policy: https://www.facebook.com/policy.php.

3.11.20. Shoplift.ai

Plurality Web Technologies, LLC, USA. CRO platform tracking based on consent. Transfer via IDTA / UK Addendum. Privacy policy: https://www.shoplift.ai/privacy-policy.

4. Data Processing on Social Media Platforms

We maintain profiles on social media networks. Platform operators use tracking mechanisms and cookies to build profiles for targeted advertising. When you interact with our profiles, our processing is based on our legitimate interest (UK GDPR Article 6(1)(f)).

4.1. Facebook

Meta Platforms Ireland Ltd., Dublin, Ireland. Privacy policy: https://www.facebook.com/policy.php. Ad preferences: https://www.facebook.com/settings?tab=ads. We are joint controllers under Article 26 UK GDPR for Page Insights metrics: https://www.facebook.com/legal/terms/information_about_page_insights_data.

4.2. Instagram

Meta Platforms Ireland Ltd. Privacy policy: https://help.instagram.com/519522125107875.

4.3. Snapchat

Snap Inc., Santa Monica, CA 90405, USA. Privacy policy: https://snap.com/en-GB/privacy/privacy-policy.

4.4. TikTok

TikTok Technology Limited, Dublin, Ireland. Privacy policy: https://www.tiktok.com/legal/privacy-policy.

4.5. YouTube

Google Ireland Limited, Dublin, Ireland. Privacy policy: https://policies.google.com/privacy.

4.6. X (formerly Twitter)

X Corp., San Francisco, CA 94103, USA. Privacy policy: https://twitter.com/en/privacy. Personalization settings: https://twitter.com/personalization.

4.7. LinkedIn

LinkedIn Ireland Unlimited Company, Dublin, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy. Ad controls: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

5. Changes to this Privacy Policy

We reserve the right to amend this privacy policy with future effect. The current version is always available here.

6. Questions and Comments

For questions or comments about this privacy policy, please contact us using the details provided above.