Privacy policy

01Who we are

VapePuffs Retail Ltd. (company number 11482093), Subunit 5, 10-16 Harris St, Manchester M8 8EG, is the data controller for personal data collected through vapepuffs.co.uk. You can reach our data protection contact at vapesquadebay@gmail.com.

02What we collect

• Account data: name, email address, password hash, and marketing preferences.
• Order data: delivery address, phone number, items purchased, and payment method type — never the full card number, which never touches our servers.
• Age verification data: a pass or fail result, the date of the check, and the last four characters of any document reference.
• Technical data: IP address, browser and device type, and pages viewed, used for security and for understanding what is broken.
• Support data: the contents of chats, emails and call notes.

03Age verification specifically

We are legally obliged to confirm that customers are 18 or over. At checkout we submit your name, address and date of birth to a third-party verification provider, which checks it against electoral roll and credit reference data. This is not a credit check and has no effect on your credit score or file.

If the automatic check does not pass, we ask for a photograph of a passport, driving licence or PASS-accredited card. That image is reviewed by a person, and it is deleted from our systems within 72 hours of the check completing. We retain only the result, the date and the last four characters of the reference.

04Why we are allowed to hold it

• To perform our contract with you: order processing, delivery, returns and support.
• To meet a legal obligation: age verification, tax records, and product traceability.
• For our legitimate interests: fraud prevention, site security, and improving the shop — balanced against your rights, and never in a way we would be embarrassed to explain.
• With your consent: marketing emails, which you can withdraw at any time in one click.

05How long we keep it

06Who else sees it

We share the minimum necessary with: our couriers (name, address, phone for delivery), our payment processor, our age verification provider, our email platform, and our hosting and analytics providers. All are bound by contract to process data only on our instructions.

We do not sell personal data. We do not share it with data brokers. We do not run advertising pixels that build cross-site profiles — partly on principle, and partly because nicotine advertising restrictions make most of that pointless for us anyway.

07Cookies

• Strictly necessary: session, basket contents, age gate acknowledgement, security tokens. These cannot be switched off.
• Analytics: first-party, aggregated, and only set if you accept. We use them to find broken pages, not to follow you.
• We set no third-party advertising cookies at all.

08Your rights

You have the right to access, correct, delete, restrict or port your data, and to object to processing based on legitimate interests. Email us and we will respond within 30 days, usually within seven.

If you are unhappy with how we have handled a request, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, but it is your call.