Privacy policy

This policy explains how Vapeology collects, uses and protects your personal data when you use this website and buy from us. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

Who we are

The data controller for this website is Bronze Haze LTD, trading as Vapeology (company number 17346072, registered in England and Wales). If you have any question about this policy or your data, contact us at info@vapeology.co.uk.

Registered office: Unit 1 Holmewood Industrial Park, Holmewood, Chesterfield, S42 5UY
Trading address: Unit 1A Park Road, Holmewood, Chesterfield, S42 5UY

What we collect

• Order data: your name, delivery and billing address, email address, phone number and order history, collected when you place an order.
• Age verification data: the details submitted for the electronic age check (such as name, address and date of birth) and the pass/fail result. See our age verification policy.
• Payment data: payments are processed by our payment provider; we never see or store your full card details.
• Technical and analytics data: our own servers measure how the site is used — pages viewed, searches, and purchases. Your IP address and browser information are used transiently to derive an anonymous daily identifier (an irreversible hash whose key is deleted every day) and to determine your approximate location (city level); we don't store your IP address in our analytics, and we don't track you across other websites.

Why we process it (lawful bases)

• Performance of a contract: processing your order, taking payment, arranging delivery and handling returns.
• Legal obligation: verifying that customers are 18 or over, and keeping the records we're required to keep (for example for tax purposes).
• Legitimate interests: preventing fraud, securing the site and understanding how it's used, in ways you'd reasonably expect.
• Consent: marketing emails, if you opt in. You can withdraw consent at any time using the unsubscribe link in any message.

Age verification processing

Age checks are carried out by an independent verification provider acting on our instructions. The provider checks the details you give against independent data sources and returns a result to us. We store the result of the check against your order; we don't receive or store copies of the underlying records the provider checks against.

Who we share data with

We share personal data only where needed to run the business: with couriers (to deliver your order), our payment provider (to take payment), our age verification provider (to confirm you're 18 or over) and the providers who host this website and our systems. We never sell your personal data.

How long we keep it

• Order and transaction records: six years after the end of the relevant financial year.
• Age verification results: for as long as we hold the related order record.
• Marketing preferences: until you unsubscribe or ask us to remove them.
• Analytics data: retained in aggregate; identifiable data is minimised and time-limited.

Your rights

You have the right to access the personal data we hold about you, and to ask us to correct, erase, restrict or port it, or to object to our processing. To exercise any of these rights, contact us using the details above. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you're unhappy with how we've handled your data.

Cookies

We use strictly necessary cookies to run the shop (for example, to remember your basket). Our analytics does not use cookies and stores nothing on your device — measurement happens on our own servers, using the anonymous daily identifier described above. You can control cookies through your browser settings.