Privacy Policy
We take your privacy seriously. This policy explains exactly what data we collect, why we collect it, and what your rights are — in plain English.
Who We Are — Your Data Controller
VapourlyUnit 31 Longcroft Farm
Longcroft Lane
Yoxall
Staffordshire
DE13 8NT
Vapourly is the data controller responsible for your personal data collected through www.vapourly.co.uk. If you have any questions about this policy or how we handle your data, please contact us at hello@vapourly.co.uk
Identity & Contact Data
Your name, billing and delivery address, email address, and telephone number — provided when you place an order or create an account.
Payment Data
Payment card details and transaction information. We do not store full card details — all payment processing is handled securely by our payment provider.
Order & Transaction Data
Details of products purchased, order history, returns, and any communications related to your orders.
Age Verification Data
Date of birth or age confirmation data collected to verify that you are 18 or over, as required by law for the sale of nicotine products.
Technical & Usage Data
Your IP address, browser type, pages visited, time spent on pages, and referring URLs — collected automatically when you use our website.
Marketing Preferences
Your choices regarding whether to receive marketing communications from us, and any preferences you have shared with us.
Data We Do NOT Collect
We do not collect any special category data (such as health data, racial or ethnic origin, political opinions, or religious beliefs) unless strictly necessary and with your explicit consent. We do not knowingly collect data from children under the age of 18.
Direct Interactions
We collect data you provide directly when you:
- Place an order or create an account on our website
- Subscribe to our email newsletter or marketing communications
- Contact us by email or through our website
- Complete age verification as part of our checkout process
- Participate in any promotions, surveys, or competitions we run
Automated Technologies & Cookies
As you interact with our website, we automatically collect technical data about your device, browsing behaviour, and usage patterns. We collect this data using cookies and similar technologies. Please see our Cookie section below for more detail.
Third Parties
We may receive data about you from third parties including:
- Payment processors for fraud prevention and transaction verification
- Age verification service providers
- Delivery and fulfilment partners (e.g. Royal Mail) for order tracking purposes
- Analytics providers such as Google Analytics
Under UK GDPR, we must have a valid legal basis for processing your personal data. We rely on the following:
Contract Performance
Processing necessary to fulfil your order, process payment, arrange delivery, and manage your account.
Legal Obligation
Processing required to comply with the law — including age verification, fraud prevention, and financial record-keeping.
Legitimate Interests
Processing for our legitimate business interests such as improving our website and preventing fraud, where these don't override your rights.
- To process and fulfil your orders, including payment, packaging, and dispatch
- To verify your age in compliance with UK laws on the sale of nicotine products
- To communicate with you about your orders, returns, and queries
- To send you marketing emails and promotions — only if you have opted in
- To manage your customer account and preferences
- To improve our website, product range, and customer experience
- To detect and prevent fraud, abuse, or illegal activity
- To comply with our legal and regulatory obligations
- To respond to requests from law enforcement or regulatory bodies where required by law
We will never sell your personal data to third parties, and we will never use it for purposes incompatible with those described in this policy.
Delivery Partners
We share your name and delivery address with Royal Mail and other couriers to fulfil your order and provide tracking information.
Payment Processors
Payment data is handled by our secure payment provider. We do not store full card details. Our payment processor is bound by strict data security standards.
Age Verification Services
We use a third-party age verification service to confirm that customers are 18 or over, as required by UK law for the sale of nicotine products.
Analytics Providers
We use tools such as Google Analytics to understand how our website is used. This data is anonymised and does not identify you individually.
Important: We Never Sell Your Data
We do not sell, rent, or trade your personal data to any third parties for their own marketing purposes. Any third parties we work with are required to handle your data securely and in accordance with UK GDPR.
We may disclose your personal data to law enforcement, regulators, or courts if we are legally required to do so.
Retention Periods
- Order and transaction records: Retained for 7 years to comply with HMRC and financial record-keeping requirements
- Customer account data: Retained for as long as your account is active, plus 2 years after your last purchase
- Age verification records: Retained for as long as required by our legal obligations
- Marketing data: Retained until you unsubscribe or withdraw consent, or after 3 years of inactivity
- Technical and usage data: Typically retained for up to 26 months in line with analytics provider standards
When your data is no longer needed, we securely delete or anonymise it.
What Are Cookies?
Cookies are small text files placed on your device when you visit our website. They help us provide you with a better experience and allow us to understand how our site is used.
Essential Cookies
Required for the website to function — including your shopping basket, checkout process, and login session. These cannot be disabled.
Analytics Cookies
Help us understand how visitors use our site so we can improve it. Only placed with your consent.
Marketing Cookies
Used to show you relevant advertising on other websites. Only placed with your explicit consent and can be withdrawn at any time.
Preference Cookies
Remember your settings and preferences to improve your experience — such as remembering items in your basket between visits.
You can manage or withdraw your cookie consent at any time through your browser settings or our cookie preference tool. Disabling certain cookies may affect the functionality of our website.
As a UK resident, you have the following rights regarding your personal data. To exercise any of these rights, contact us at hello@vapourly.co.uk — we will respond within 30 days.
📂 Right of Access
You have the right to request a copy of the personal data we hold about you (a Subject Access Request). We will provide this free of charge within 30 days.
✏️ Right to Rectification
You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.
🗑️ Right to Erasure
Also known as the "right to be forgotten" — you can ask us to delete your personal data where there is no legitimate reason for us to continue holding it.
⏸️ Right to Restriction
You have the right to ask us to suspend processing of your data in certain circumstances — for example, if you contest its accuracy.
📤 Right to Data Portability
Where processing is based on consent or contract, you have the right to receive your data in a structured, machine-readable format and transfer it elsewhere.
🚫 Right to Object
You have the right to object to processing based on legitimate interests, and an absolute right to object to your data being used for direct marketing at any time.
🤖 Automated Decision-Making
You have the right not to be subject to decisions made solely by automated processing that have a significant effect on you.
↩️ Right to Withdraw Consent
Where we rely on consent to process data (e.g. for marketing), you can withdraw that consent at any time without affecting the lawfulness of prior processing.
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it. These include:
- SSL/TLS encryption for all data transmitted through our website
- Secure, encrypted storage for all personal data
- Access controls ensuring only authorised personnel can access your data
- Regular security reviews and updates to our systems
- Payment processing handled entirely by PCI-DSS compliant payment providers
In the unlikely event of a data breach that affects your rights or freedoms, we will notify you and the Information Commissioner's Office (ICO) as required by law.
Our website may contain links to third-party websites, plugins, and applications. We do not control these third-party websites and are not responsible for their privacy policies. We encourage you to read the privacy policy of every website you visit.
We may use your contact details to send you information about products, promotions, and news from Vapourly — but only if you have opted in to receive these communications.
You can unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by emailing us at hello@vapourly.co.uk. Opting out will not affect our ability to process your order or contact you about service matters.
We will never send you marketing emails on behalf of any third party without your explicit consent.
We may update this Privacy Policy from time to time to reflect changes in the law, our business, or the way we handle your data. Any changes will be posted on this page with an updated "last updated" date. Where changes are significant, we will make reasonable efforts to notify you directly — for example by email.
Questions, Complaints & the ICO
If you have any questions or concerns about how we handle your personal data, please contact us first at hello@vapourly.co.uk — we'd always rather resolve any issue directly and quickly.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's independent data protection authority.
📞 ICO Helpline: 0303 123 1113
🌐 Website: ico.org.uk
