Privacy Policy
What we collect, why we collect it, and how you stay in control. No sneaky small print.
01What We Collect
- Identity & contact data: name, delivery/billing address, email, phone number.
- Order data: what you bought, order value, order history.
- Age-verification data: confirmation of age eligibility (and ID checks where required by law).
- Payment data: processed directly by our payment provider — we do not see or store your full card number.
- Technical data: IP address, browser type, device info, collected automatically via strictly necessary cookies.
02Why We Use It
| Purpose | Legal basis |
|---|---|
| Taking and fulfilling your order | Performance of a contract |
| Verifying you’re old enough to buy | Legal obligation |
| Customer support & resolving issues | Contract / legitimate interest |
| Fraud prevention & site security | Legitimate interest |
| Accounting, tax & duty records | Legal obligation |
03Who We Share It With
We don’t sell your data. We share the minimum necessary with:
- Our payment processor, for secure checkout and fraud checks.
- Our delivery couriers — including Evri, Royal Mail, and other courier partners used for longer-distance orders — to get orders to your door and confirm age on delivery.
- Our website and IT providers (WooCommerce/WordPress hosting, email tools) who process data on our behalf under contract.
- HMRC and other authorities, where the law requires it (e.g. Vaping Products Duty records).
04Cookies
The Website only uses strictly necessary cookies — the kind that keep your basket working, remember your age-verification, and keep the site secure. We don’t use tracking, advertising, or analytics cookies that require consent. Because only essential cookies are used, no cookie-consent banner is required under the Privacy and Electronic Communications Regulations (PECR) — but you can still block or delete cookies through your browser settings; doing so may stop parts of the site (like the basket) from working properly.
05How Long We Keep It
We keep order and transaction records for as long as required for tax, accounting, and duty compliance (generally 6 years). Marketing data is kept until you unsubscribe or ask us to delete it. Age-verification and ID-check records are kept only as long as legally required.
06Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Ask us to delete your data (“right to be forgotten”), subject to legal retention requirements.
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Complain to the Information Commissioner’s Office (ICO) if you’re unhappy with how we’ve handled your data.
To exercise any of these rights, contact us using the details below.
07Security
We use industry-standard technical and organisational measures — including secure checkout and access controls — to protect your data from unauthorised access, loss, or misuse.
08Children
Our products and Website are not intended for anyone under 18. We do not knowingly collect data from minors.
09Changes To This Policy
We may update this policy as our business or the law changes. The current version is always live on this page.
