Legal

Privacy Policy

Last updated 20 October 2026

This explains what we do with your information when you buy wine from us, book a tasting, join the Wine Club, enquire about an event, or simply read the site. We have tried to write it plainly. If anything here is unclear, please ask.

Who we are

The Hare Wine Co., 769 Niagara Stone Road, Niagara-on-the-Lake, Ontario L0S 1J0, Canada. You can reach us at [email protected] or (905) 684-4994. We are the ones responsible for the information described here.

Our Owner, John Hare, is responsible for protecting personal information at The Hare Wine Co. You can reach him at [email protected], (905) 684-4994 ext. 202, or 769 Niagara Stone Road, Niagara-on-the-Lake, Ontario L0S 1J0.

What we collect, and why

When you buy wine

Your name, email address, phone number, billing and delivery addresses, and what you ordered. We may also ask your date of birth, because we are only allowed to sell alcohol to people of legal drinking age, and someone of legal drinking age has to sign for the delivery.

Your card details go directly to our payment provider through our winery platform. We never see or store your full card number.

When you book a tasting

Your name, email address, phone number, the date and time you chose, the size of your party, and anything you tell us about allergies, accessibility or the occasion.

When you join the Wine Club

The same details as an order, plus your membership preferences and the card we charge for each release. You can change your preferences, skip a shipment or cancel at any time from your account.

When you enquire about a wedding, a corporate event or a private party

Whatever you put in the form or the email: your name, contact details, the date you have in mind, numbers, and what you are planning. We use it to reply and plan your event. If you tick “Keep me posted” on our private events form, we send you one email to confirm, and add you to our emails once you do. Wedding enquiries go to Vintage Hotels, who coordinate weddings at the winery with us, and are handled under their privacy policy as well as this one.

When you sign up for our emails

Your email address, your name if you give it, and which of our emails you opened or clicked. We use that to avoid sending you things you have already told us you are not interested in, and to see which emails lead to a visit or an order.

The sign-up box on this site asks you to confirm you are 19 or older. We then send you one email with a link to a page where you press a button to join, and you are only on our list once you do. We keep a record of your yes: the words you agreed to, the date and time, and the IP address and browser you used to sign up and to press the button. Canada's anti-spam law asks us to be able to show that you said yes. If you did not ask for that email, the link at its foot takes your address off our list for good.

Some of our emails may ask for your birthday (the month and day only) or where home is. If you answer, we keep it with your email address. Your answer about home is also saved on your Commerce7 account, and in Klaviyo while we still use it.

When you read the site

Like any website, ours receives your IP address, the page you asked for, the page you came from and your browser type. Our web server keeps these in a log for 14 days to keep the site secure and fix faults, then deletes them. What else we measure depends on your choices; see Measuring visits and advertising below.

Who else sees it

We do not sell your information. We use a small number of companies to run the winery and the site, and they only handle what they need to do their part:

• Commerce7 runs our shop, accounts, Wine Club and tasting bookings, and passes payments to our payment provider.
• Resend sends our emails, and receives your replies to them (United States).
• ZeroBounce checks that an email address is real before we email it, without sending anything to it (United States).
• Klaviyo holds our mailing list and sends some of our emails while we finish moving off it.
• Anthropic, whose Claude AI helps our team draft messages and sort the emails and enquiries we receive (United States).
• Google Analytics tells us how the site is used (see Measuring visits and advertising below).
• Microsoft Clarity shows us how people move around the site: where they click, how far they scroll, and where they get stuck, including short replays of visits. It doesn’t record anything you type into our forms. It runs when you have allowed Analytics. Whatever you chose for Advertising, we tell Microsoft that advertising use is not allowed. Microsoft may still use what it collects for its own purposes. It never runs on our basket, checkout, account and sign-in pages, or on the Wine Club sign-up and booking pages.
• Meta (Facebook and Instagram) receives a signal when you visit, so we can show our advertising to people who have shown an interest. See Your choices about measuring and advertising below if you would rather it did not.
• Google also provides the sign-in option on our account pages, the anti-spam check our shop platform loads on every page, and the fonts the site is set in.
• Showpass sells tickets to our Twilight Jazz and Blues evenings. When you buy a ticket you are buying it from them, under their terms.
• Our couriers get the name, address and phone number needed to deliver your wine.

We will also share information where the law requires it, including the records the Liquor Control Board of Ontario and the Canada Revenue Agency require us to keep.

Measuring visits and advertising

We sort what runs on this site into three kinds.

Both Analytics and Advertising are run through Google Tag Manager, a program from Google that starts the tools you have allowed. So whenever either one is on, Google Tag Manager loads from Google to run the tools you chose, and Google receives your connection (your IP address and browser details), even if the only tool you allowed is not made by Google. When both are off, it does not load.

Necessary (always on)

These make the site work and keep it safe. The site cannot work properly without them.

• Commerce7 runs our shop, basket, Wine Club and bookings. It sets a cookie that lasts until you close your browser so it can keep your basket, and it counts which kind of device and which collection of wines is being viewed, without any identifier.
• Google reCAPTCHA, which our shop platform loads on every page, checks that forms and checkout are used by people rather than automated programs.
• Google Fonts supplies the typefaces, so Google receives your IP address when a page loads.
• Cloudflare delivers the site and handles your IP address to do so. As each page loads it tells our server roughly where you are (your country and, where it can tell, your province or region) so we can show the right privacy choices. We do not keep that.
• We remember your privacy choice in your browser (see Your choices about measuring and advertising below).
• Two more small notes stay in your browser, not in cookies, and are not sent to us. Our email sign-up box remembers for up to six months that you closed it or signed up, so it does not keep asking (it is kept under the name hare-signup). The site banner remembers, for this visit only, that you closed it (hare-banner-closed).

Analytics

These tell us how the site is used so we can improve it.

• Google Analytics records the pages you view, how you arrived, rough location (worked out from your IP address, which Google says it does not store) and your device, and some actions such as scrolling to the end of a page, viewing a wine, adding to your basket and completing an order or booking. It sets cookies named _ga and _ga_11VWW2B828 that last up to two years (some browsers shorten this to about 13 months). Google keeps our Analytics data for 14 months; for a browser’s random Analytics ID the 14 months start again each time that browser visits. Some of the data-sharing settings on our Google Analytics account are on, so Google may also use this data for its own purposes.
• Microsoft Clarity records how people use a page: clicks, scrolling and short replays of visits. What you type into form fields is hidden and not recorded. It runs when you have allowed Analytics, whatever you chose for Advertising. We tell Microsoft that advertising use is not allowed, so Clarity does not call Microsoft’s advertising cookie service and does not set Microsoft’s advertising cookies (such as MUID) from our site. It never runs on our basket, checkout, account and sign-in pages, or on the Wine Club sign-up and booking pages. On our site it sets cookies named _clck (one year) and _clsk (one day), and its records are linked to the Google Analytics visit. Microsoft keeps recordings for 30 days (a small sample for up to 9 months) and, under its own terms, may also use what it collects for its own purposes, including building profiles used for advertising.
• Our own visit count. On some pages we count, without cookies, when a marked section was on screen for a second and when a link or button in it was used. Your browser makes a random number for the visit, forgotten when you close the tab. We store the kind of event, the page, which version of the section it was, that random number and the time; no IP address and no browser details, and we do not share it. We delete the individual entries after 30 days and keep daily totals.

Advertising

• The Meta pixel tells Meta (Facebook and Instagram) which of our pages you visit and what you do on them, such as adding a wine to your basket, buying or booking. We use it to measure our advertising and to show our ads to people who have visited. Meta also uses it for its own purposes under its terms. It sets a cookie named _fbp that lasts 90 days (and _fbc if you arrive from one of our ads) and stores two small notes in your browser about the site that sent you here. Meta may keep this information for up to two years.

We do not buy advertising from Google or Microsoft. Microsoft Clarity runs with Analytics, not Advertising, and whatever you chose here we tell Microsoft that advertising use is not allowed.

Your choices about measuring and advertising

• If your connection looks like it is in Quebec or outside Canada, or we cannot tell where it is, or your browser is set to French and your connection looks like it is in another Canadian province, Analytics and Advertising are off until you switch them on. On your first visit you will see three buttons: Accept all, Reject optional and Manage preferences. Nothing in Analytics or Advertising runs until you choose, and saying no is as easy as saying yes.
• Elsewhere in Canada, Analytics and Advertising are on when you arrive, and a notice tells you so on your first visit. You can switch either off at any time.
• Wherever you are, “Privacy / Cookie Preferences” at the foot of every page lets you change your mind. As soon as you save, we stop the tools you switched off and remove the cookies they set on our site, and the page reloads. A last moment of activity that was already recorded just before you saved may still be on its way to the company that runs the tool. Cookies that Microsoft or Meta (or Google) set on their own web addresses, rather than on ours, are not ours to remove and stay until they expire; you can clear them in your browser’s settings.
• We remember your choice in your browser (not in a cookie): just the choice and the date. If we showed you the three-button notice, we ask again after 6 months. That depends on where your connection appears to be, not on where you live. If you clear your browser’s stored data, or your browser blocks it, we cannot remember your choice. Some browsers, Safari for example, may forget what a site has saved if you have not visited for about a week; if that happens the notice may show again, or the usual setting for where you are will apply.
• If your browser sends a Global Privacy Control signal, we treat it as a no to Advertising.
• You can also block cookies in your browser and turn off ads based on your activity in your Facebook and Instagram settings. Blocking the Necessary ones will stop the shop working.

Our emails

The links in our emails are personal to you, so we can see which emails lead to a visit or an order.

We send marketing email to these groups of people:

• people who said yes to our emails: on this site (we send a link to confirm), in our shop, or through our earlier sign-up forms;
• customers, for two years after their last paid order;
• Wine Club members, and for two years after they leave;
• people who asked us about a private or corporate event and heard back from us, for six months after they asked.

Every marketing email has a one-click unsubscribe link at the bottom, and it works straight away. If you would rather not use it, email us, call, tell us at the counter, or reply to one of our emails asking us to stop, and we will take you off the list ourselves.

If you reply to one of our emails, your reply comes to our replies address. We keep it with your guest record so the team can answer you, and John gets a copy. If you ask us to stop, we pause our emails to you as soon as your reply arrives.

Unsubscribing from marketing does not stop the emails we have to send about something you bought, such as an order confirmation, a shipping notice or a Wine Club release.

Age

We sell alcohol, so this site is intended for people of legal drinking age in their province. We do not knowingly collect information from anyone under that age. The sign-up box asks you to confirm you are 19 or older, and we do not email anyone whose birth date on file says they are under 19. Deliveries are handed only to someone of legal drinking age who can show identification.

How long we keep it

Order and tax records are kept for seven years, which is what Canadian tax and liquor rules require. Your account and Wine Club details are kept while your account is open. If you unsubscribe, we keep a note of your email address so that we do not accidentally add you again.

A sign-up that nobody confirmed is deleted about two months after its link runs out. Replies you send to our emails are kept for two years (anything the team filed on your guest record stays with that record).

Everything else we clear out on this schedule:

• Our check that your email address works: deleted 12 months after the check.
• An event or party enquiry that didn’t go ahead: what you wrote, and your name, email and phone on it, are removed after 3 years.
• If we can no longer email you (no order in two years, no yes to our emails and no recent enquiry): after 2 years with nothing happening, we keep only your email address and a do-not-email note.
• The record of your yes to our emails: kept while we email you, and for 3 years after you unsubscribe or it stops counting; then the IP address and browser on it are removed.
• Unsubscribes, spam reports and addresses that bounce: kept for good, so we never email you again by mistake.

Where it is held

Our suppliers store information in Canada and the United States, and Google, Microsoft and Meta may also process it in other countries where they operate. Where it is held outside Canada it may be accessible to the authorities there under their laws.

Your choices

You can ask us to show you what we hold about you, correct anything that is wrong, or delete it. You can also ask us to stop using it for marketing. Email [email protected] and our team will get back to you within thirty days.

When we delete your details, we clear your name, birthday, where home is, and the words of anything you sent us. We keep your email address on our do-not-email list so that we never add you again, along with a dated record of what you agreed to, which of our emails were sent to you, and when you asked us to stop.

We may need to keep some records even after a deletion request, where the law requires it, such as the record of a sale.

If you are not happy with how we have handled it, you can complain to the Office of the Privacy Commissioner of Canada. If you live in Quebec, you can also complain to the Commission d’accès à l’information du Québec.

Changes

If we change this policy we will change the date at the top. If the change is a significant one, we will say so.