Privacy Policy

1. About this policy

This policy explains how we collect, use, store and share your personal data when you visit vapevapevape.co.uk, buy from us, create an account, sign up to our emails, or contact our customer service team.

Because we sell age-restricted vaping and nicotine products, we are legally required to check that our customers are 18 or over. This means we handle some information — including proof of age — that an ordinary online shop would not. Section 4 explains that in detail.

We are the data controller for the personal data described here. We handle it in line with the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and the Privacy and Electronic Communications Regulations 2003 ("PECR").

---

2. Who we are and how to contact us

This website is operated by Vape Supplier Ltd, trading as vapevapevape.co.uk.

• Registered in: England and Wales
• Company number: 10873335
• VAT number: GB272938666
• Registered office: 33 Bennetts Hill, Birmingham, West Midlands, England, B2 5SN

To contact us about your personal data or anything in this policy, use the contact form at vapevapevape.co.uk/pages/contact, selecting General as your enquiry category and marking your message "Data protection". You can also write to us at the registered office address above.

We are registered with the Information Commissioner's Office as a data controller.

---

3. Privacy at a glance

• We collect what we need to sell to you lawfully: your contact and delivery details, payment confirmation, order history and proof that you are over 18.
• We are legally required to verify your age before we despatch an order.
• Non-essential cookies are only set with your consent, which you can change at any time.
• We send marketing only where you have opted in, or where you have bought from us and not opted out. You can unsubscribe at any time.
• We never sell your personal data.
• Some of our suppliers are based outside the UK. Where that happens, we put approved safeguards in place.
• You have rights over your data, including the right to see it, correct it and ask us to delete it.
• This website and everything on it is strictly for adults aged 18 and over.

---

4. Age verification

You must be 18 or over to buy from this website. It is a criminal offence in the UK to sell vaping and nicotine products to anyone under 18. From 29 October 2026 it is also an offence for an adult to buy these products on behalf of someone under 18.

What we do

1. You confirm your age. When you enter the site and again at checkout, you confirm you are 18 or over. This alone is not enough, so we also carry out a check.
2. Electronic verification. Before we despatch your order, we pass your name, address and date of birth to a specialist third-party age verification provider. They check this against trusted data sources such as the electoral roll and credit reference data to confirm you are over 18. This is a soft check — it is not a credit application and does not affect your credit score.
3. Document check, only if needed. If the electronic check cannot confirm your age, we will ask you to upload a photo of a government-issued ID through a secure link provided by our verification partner. In some cases you may also be asked to take a selfie so it can be matched to the document. If this involves facial recognition or age-estimation technology, our provider will ask for your explicit consent first and will offer you an alternative way to prove your age.
4. Check on delivery. For some orders our courier will ask to see ID at the door and will record only that a check was carried out.

Why we are allowed to do this

• Legal obligation (Article 6(1)(c) UK GDPR) — we must not sell age-restricted products to minors under the Tobacco and Vapes Act 2026, the Nicotine Inhaling Products (Age of Sale and Proxy Purchasing) Regulations 2015 and related legislation.
• Legitimate interests (Article 6(1)(f)) — protecting children from harm, preventing underage sales, and keeping an auditable record to evidence our compliance to Trading Standards.

What we keep

We keep the outcome of the check — pass or fail, the date, the method used and our provider's reference number — with your order record. We do not retain copies of your ID documents or selfie images. Where a document check is needed, the images are held by our verification partner only for as long as it takes to complete the check, and are then deleted under their own retention policy.

If we believe you are under 18

We will cancel the order and refund any payment taken. We will keep a minimal record of the refused sale so we can evidence our compliance and prevent repeat attempts, and we will not use that record for anything else.

---

5. The personal data we collect

Information you give us

Information we collect automatically

Information we receive from others

We receive age verification results from our verification partner; payment authorisation, fraud and chargeback information from our payment providers; delivery status and proof of delivery from our couriers; email engagement data from our email platform; and reviews from review platforms.

Health information

We do not routinely collect health data. However, if you contact us to report an adverse reaction to a product, we will record what you tell us so we can respond, investigate and, where required, report it to the MHRA or another regulator. Our legal basis for this is Article 9(2)(i) UK GDPR (public interest in public health), alongside our obligations under product safety law.

---

6. How and why we use your data

Where we rely on legitimate interests, we have assessed whether our interests are outweighed by your rights. You can ask us for a summary of that assessment.

If we ever need to use your data for a purpose not listed above, we will tell you and explain the legal basis before we do so.

---

7. Marketing

We will send you marketing emails or texts where you have opted in, or where you have bought a similar product from us, we gave you a clear chance to opt out at that point, and you did not take it. This is the "soft opt-in" permitted under PECR.

To stop marketing at any time, click unsubscribe in any marketing email, reply STOP to any marketing text, change your preferences in your account, or contact us using the details in Section 2.

Opting out of marketing will not stop service messages such as order confirmations, despatch notices or product recall notices, which we must send you.

When you unsubscribe we add you to a suppression list and keep it indefinitely, so that we can honour your choice and do not contact you again by mistake. This is a legal requirement, not a way of keeping you on our marketing database.

Advertising of vaping and nicotine products is tightly restricted in the UK. We only market in ways permitted by the Tobacco and Related Products Regulations 2016, the Tobacco and Vapes Act 2026 and the CAP Code, and we take steps to ensure our marketing is not directed at under-18s.

---

8. Cookies

Cookies are small files placed on your device. We also use similar technologies such as pixels, tags and local storage. Together we call these "cookies".

When you first visit, our cookie banner lets you accept or reject each non-essential category. You can change your choices at any time using the Cookie Settings link in the footer, or by clearing cookies in your browser. Rejecting non-essential cookies will not stop you shopping with us.

---

9. Who we share your data with

We share personal data only where we need to. We never sell your personal data, and we do not share it with third parties for their own marketing.

Every supplier acting as our processor is bound by a written contract requiring them to keep your data secure, use it only on our instructions, and return or delete it when the relationship ends.

Some recipients — including payment providers, couriers, review platforms and certain Shopify services such as Shop Pay — act as independent controllers for parts of what they do. Where that is the case their own privacy notices apply, and we recommend you read them.

---

10. Sending data outside the UK

Some of our suppliers, including Shopify, are based outside the UK or store data on servers outside the UK.

Where we transfer personal data outside the UK, we make sure your protection travels with it by relying on one of the following:

• the destination country has UK adequacy (for example the EEA, and Canada for commercial organisations);
• the recipient is certified under the UK Extension to the EU–US Data Privacy Framework; or
• we have the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in place, supported by a transfer risk assessment.

Under the Data (Use and Access) Act 2025, the test for these assessments is that protection in the destination country must not be materially lower than under UK law.

You can ask us for a copy of the safeguards we use.

---

11. How long we keep your data

We keep personal data only for as long as we need it. We may keep it longer where there is an ongoing dispute, investigation or legal claim.

When data reaches the end of its retention period we securely delete it or irreversibly anonymise it.

---

12. How we protect your data

We use appropriate technical and organisational measures, including encryption in transit across the whole site and at rest, role-based access controls, multi-factor authentication on our admin systems, supplier vetting and written data processing agreements, staff training, tested backups, access logging, and a documented procedure for detecting and reporting personal data breaches.

If a breach occurs that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you directly without undue delay where the risk to you is high.

No transmission over the internet can be completely secure. Please keep your account password confidential and tell us immediately if you suspect unauthorised access.

---

13. Automated decisions

We use automated processing in a few places:

• Age verification — an automated check confirms whether you are over 18. If it cannot, your order is held and you are offered a manual document check.
• Fraud screening — orders are automatically scored for fraud risk, and a high score may mean an order is held, cancelled or refunded.
• Personalisation — we may group customers by purchase history to decide which offers to show. This has no legal or similarly significant effect on you.

Where an automated decision has a legal or similarly significant effect, you have the right to ask for a human to review it, to give your point of view, and to challenge the outcome. Contact us using the details in Section 2.

---

14. Your rights

You have the right to:

To use any of these rights, contact us using the details in Section 2. Tell us which right you want to use and give us enough detail to find your records.

• We will respond within one month. If your request is complex or you have made several, we may extend this by up to two further months and will tell you within the first month.
• We may ask for proof of identity first, so that we do not disclose your data to the wrong person. The clock pauses while we wait.
• Using your rights is free. We may charge a reasonable fee, or refuse, only if a request is clearly unfounded or excessive — and we will explain why.

Some rights are not absolute. For example, we cannot delete records we are legally required to keep for tax or age-verification purposes.

---

15. How to complain

Tell us first

If you are unhappy with how we have handled your personal data, please tell us. Under section 164A of the Data Protection Act 2018 you have a statutory right to complain directly to us, and we are required to have a process for dealing with it.

How to complain: use the contact form at vapevapevape.co.uk/pages/contact, selecting General and marking your message "Data protection complaint", or write to us at our registered office.

What happens next:

1. We will acknowledge your complaint within 30 days of receiving it.
2. We will investigate without undue delay, make appropriate enquiries, and keep you updated.
3. We will tell you the outcome in plain language and explain what we have done. We aim to do this within three months unless the complaint is exceptionally complex.

Or complain to the regulator

You can complain to the Information Commissioner's Office at any time, though we would appreciate the chance to put things right first.

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk/make-a-complaint

---

16. Other websites

Our site contains links to other websites and may include third-party plug-ins. We do not control those sites and are not responsible for their privacy practices. We encourage you to read the privacy notice of every website you visit.

---

17. Under-18s

This website and everything we sell is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us their data, please contact us and we will delete it and take steps to prevent any sale.

---

18. Changes to this policy

We review this policy regularly and update it when our practices or the law change. The date at the top shows when it was last revised. Where a change is significant we will tell you by email or by a prominent notice on the site before it takes effect. We keep previous versions and can provide them on request.

---

Vape Supplier Ltd, trading as vapevapevape.co.uk. Registered in England and Wales, company number 10873335. Registered office: 33 Bennetts Hill, Birmingham, West Midlands, England, B2 5SN. VAT number GB272938666.