Privacy Notice

Who we are Vape Hero is the data controller for the personal data described here. We are Vault Hero Ltd, 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE. Company registration number: 17107393. Contact us about privacy using the form on our Help & Contact page. What we collect - Account details: name, email address, password (stored only as a secure hash). - Order details: billing and delivery address, phone number, items ordered, order value, order history. - Age verification data: the details you give us for the age check and the result of that check. - Payment data: a payment reference and the outcome from our payment provider. We never receive or store your full card number. - Contact data: messages you send us through the contact form or by email. - Technical data: IP address, device and browser information, and essential cookie data needed to keep you signed in and your basket working. - Optional analytics data, only if you accept non-essential cookies. Why we use it and our lawful basis - To take and fulfil your order and provide customer service — performance of our contract with you. - To verify that you are 18 or over and keep a record of that check — compliance with our legal obligations as a nicotine retailer. - To take payment and prevent fraud — contract and legitimate interests. - To keep accounting, tax and product compliance records — legal obligation. - To improve the website using analytics — consent. - To send marketing emails, if you have asked for them — consent, which you can withdraw at any time. Who we share it with Only the organisations we need to run the shop: our hosting and database provider, our payment provider, our age verification provider, our delivery carriers and our email provider. They act on our instructions and are not permitted to use your data for their own purposes. We may disclose data where the law requires it, for example to Trading Standards or HMRC. We do not sell your personal data. How long we keep it - Order and transaction records: 6 years plus the current tax year, as required for accounting. - Age verification records: 4 years, so we can show we met our legal duties. - Account data: while your account is open, then deleted or anonymised within 12 months of closure, other than the records above. - Contact messages: 2 years. - Analytics data: 14 months. Your rights You can ask us to give you a copy of your data, correct it, delete it, restrict or object to our use of it, or transfer it to another provider. You can withdraw consent for marketing or analytics at any time. Message us through the contact form on our Help & Contact page and we will respond within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. Security Access to customer data is restricted to staff who need it, protected by authentication and database access rules, and transmitted over encrypted connections. Cookies See our Cookies page for detail on cookies and how to control them. Changes We will update this notice when our processing changes. The date shown on this page tells you when it was last revised.