1. Who controls your data
Vape Today is the data controller for personal data we collect on this site. We are registered with the UK Information Commissioner's Office (ICO).
2. What we collect
When you place an order we collect: your name, delivery address, email, phone number, payment details (processed by our payment provider — we never store card numbers), and a date-of-birth check for age verification.
3. Why we collect it
We use this data to: fulfil orders, verify you are 18+, send shipping updates, respond to customer service requests, comply with HMRC record-keeping requirements (we must keep transaction records for 6 years), and prevent fraud.
4. Who we share it with
We share data only with: payment processors (Stripe), shipping carriers (Royal Mail, DPD, etc.), age-verification providers, and HMRC where legally required. We do not sell your data, ever.
5. How long we keep it
Order records: 6 years (HMRC requirement). Marketing email signups: until you unsubscribe. Account data: deleted on request unless we must retain for legal reasons.
6. Your rights
You have the right to: access the data we hold on you, correct inaccurate data, delete your data (subject to legal retention), object to marketing, and complain to the ICO. To exercise any of these rights, contact us.
7. Cookies
We use essential cookies (cart, age-verification, session) and optional analytics cookies (Cloudflare Web Analytics — privacy-friendly, no personal data). You can decline non-essential cookies in your browser.
Contact us
Questions about this policy? Email us via our contact page. We aim to respond within 2 working days.