Privacy · UK GDPR · Updated September 2026
Privacy Policy
This Policy explains how Vapeloxa collects, uses, stores and shares personal data when you use our UK adult-only online shop and related support channels.
Clear data rules. Adult customers only. Your UK privacy rights respected.
On this page
Jump to the section you need. Related shop policies are linked at the end.
1. Who we are (data controller)
This Privacy Policy (“Policy”) applies to the website at vapeloxa.com and to orders and support requests handled through it.
The data controller is Vapeloxa (“we”, “us”, “our”). Vapeloxa is our trading name. We are a UK adult-only vape retailer based in Coventry, West Midlands, and we control personal data processed through this website and related order and support channels.
-
Trading name
Our trading name is Vapeloxa. That is the name we use on this website, in customer communications, and as the data controller named in this Policy.
-
How to contact us about privacy
Email support@vapeloxa.com, or use the routes on our Contact Us page (website ticket or WhatsApp). Please mark the message as a privacy request if you can.
-
Related policies
This Policy sits alongside our Terms & Conditions, Payment, Shipping, Return and Refund policies. It does not remove your statutory rights under UK consumer or data protection law.
-
Law that applies
We process personal data under the UK GDPR and the Data Protection Act 2018. Electronic marketing and some cookies are also covered by the Privacy and Electronic Communications Regulations (PECR).
2. Data we collect
Depending on how you use the shop, we may process the following categories of personal data:
- Identity and contact — name, email address, phone number, delivery and billing addresses.
- Account — login identifiers, account preferences, order history linked to your customer account.
- Order and fulfilment — products ordered, quantities, amounts paid, delivery notes, tracking references, refund or return records.
- Age-related checks — confirmation that you stated you are 18+, and any proof of age we reasonably request before despatch or on delivery.
- Authentication — one-time passcodes (OTP) sent for sign-in, and basic details needed if you sign in with Google where that option is available.
- Support — messages you send by email, ticket, WhatsApp or Instagram, including any order number you provide.
- Technical — IP address, browser type, device information, approximate location derived from IP, and similar logs needed for security and site performance.
- Marketing preferences — whether you asked to receive our newsletter or similar updates, and unsubscribe choices.
-
Information required to place an order
Certain information, including your name, delivery address, contact details and payment information, is required for us to process and fulfil an order. If you do not provide the required information, we may be unable to accept or complete your order. Newsletter sign-up and similar optional fields are not required to place an order.
Important. We do not store full payment card numbers in our website or shop database. Card and wallet details are handled by payment providers (see section 7).
3. How we collect it
We collect personal data when you:
- browse the catalogue, create or use an account, or complete age confirmation;
- place an order or request a cancel, change, return or refund;
- sign in with email OTP or Google (where offered);
- contact support or leave feedback;
- subscribe to marketing communications (if you choose to);
- interact with cookies or similar technologies that the site needs to run securely.
We may also receive limited personal data from other sources when it is needed to run the shop:
- Payment providers such as PayPal, Stripe Checkout and Worldpay (for example payment status or limited wallet/payment references);
- Delivery partners such as DHL, DPD, Evri, Parcelforce, Royal Mail or a dedicated courier (for example delivery events and failed-delivery notices);
- Social login providers such as Google, where you choose that sign-in option (basic profile details you authorise).
4. Why we use data (lawful bases)
We only use personal data where UK law allows. The main purposes and legal bases are set out below.
Contract
To take and fulfil orders, process payment confirmation, arrange delivery, handle cancellations before despatch, and provide account and order support.
Legal obligation
To keep records needed for tax, accounting and age-restricted product rules, and to respond to lawful requests from authorities where required.
-
Legitimate interests
To keep the shop secure, prevent fraud and misuse, improve site reliability, and communicate about an order you have placed (for example stock or delivery updates). We balance these interests against your rights.
-
Consent
Where required for optional marketing emails or non-essential cookies. You can withdraw consent at any time (unsubscribe link or Contact Us) without affecting processing that does not rely on consent.
United Kingdom · Age-restricted goods
5. Age and eligibility data
Vapeloxa sells nicotine and vaping products that are age-restricted under UK law. We process limited age-related information to help prevent under-18 sales.
Important. Do not order for anyone under 18. Misuse may lead to account restriction. See also our Terms & Conditions.
7. Payments and security
Checkout uses SSL/TLS encryption in transit. Full payment card details are handled by payment providers and are not stored as full card numbers in our shop database.
- Payment options shown at checkout may include PayPal, Stripe Checkout and Worldpay, depending on the order and gateway availability.
- We may store payment status, last-four digits or wallet references returned by a provider where the shop needs them for order records and support.
- Access to customer and order data inside our systems is limited to people who need it for fulfilment, support or administration.
- No method of transmission or storage is completely risk-free. Please keep your account credentials confidential and tell us promptly if you suspect misuse.
Payment Policy
For how checkout methods work day to day, see our Payment Policy. For order rules, see our Terms & Conditions.
8. Cookies and similar technologies
We use cookies and similar technologies (including local storage for age confirmation) so the site can function securely and remember limited choices.
Essential
Session, security, shopping basket, checkout and login cookies that are required for the shop to work. These are usually set on the basis of legitimate interests or as strictly necessary under PECR.
Optional
Analytics or marketing technologies, if enabled, are used only where allowed under UK rules. Where consent is required, we will ask before setting non-essential cookies.
You can control cookies through your browser settings. Blocking essential cookies may stop parts of the shop (for example the basket or login) from working correctly.
Practical note. This Policy describes our approach. Non-essential analytics or marketing tools should not run before any consent they need under PECR. If you believe a tracking tool is loading without consent, tell us at support@vapeloxa.com so we can check and fix it.
9. How long we keep data
We keep personal data only as long as needed for the purposes in this Policy. Where we cannot fix one calendar date in advance, we use the criteria below.
- Orders and invoices — generally retained for up to 6 years where required for tax, accounting and legal record-keeping.
- Customer accounts — while the account remains active. If you ask us to close an account, we delete or anonymise account data that is no longer needed, except records we must keep for tax, fraud prevention or legal claims.
- Support messages — retained for as long as reasonably necessary to resolve the enquiry, deal with related disputes and maintain appropriate customer-service records (normally up to 24 months after the last message on that enquiry, unless a longer period is needed for an open dispute, refund, fault claim or legal issue).
- OTP / security logs — for short periods needed to complete sign-in and investigate abuse (usually days or a small number of weeks, not years).
- Marketing lists — until you unsubscribe or we stop using that list.
- Age confirmation in the browser — for a limited time according to the age-gate settings, after which you may be asked again.
If a retention period above needs to change because of a legal requirement or a change in how we run the shop, we will update this section.
10. Your rights
Under UK data protection law you may have the right to:
- access your personal data;
- ask us to correct inaccurate data;
- ask us to erase data in certain circumstances;
- restrict certain processing;
- receive a copy of data you provided in a portable form (where applicable);
- withdraw consent where processing is based on consent;
- complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we handled your data.
Your right to object
You have the right to object at any time to the use of your personal data for direct marketing. You may also have the right to object to processing based on our legitimate interests, depending on the circumstances. If you object to direct marketing, we will stop using your data for that purpose.
To exercise these rights, contact us via Contact Us or support@vapeloxa.com and include enough detail for us to identify your request. We may need to verify your identity before acting.
ICO. You can find out more about your rights and how to complain at ico.org.uk.
11. Automated decision-making
We do not currently use solely automated decision-making or profiling that produces legal or similarly significant effects on customers.
Day-to-day shop tools (for example payment-provider fraud checks, or showing products and prices) may use automated systems as part of running the website and checkout. Those tools do not, on their own, produce a legal or similarly significant effect under UK GDPR. If that ever changes, we will update this Policy and explain what rights apply.
12. International transfers
Some service providers (for example certain payment, hosting, email or messaging tools) may process data outside the United Kingdom. Where that happens, we take steps so that appropriate safeguards are in place. Depending on the provider and destination, that may include:
- a UK adequacy decision covering the destination country or territory; or
- standard contractual clauses (or an equivalent transfer tool recognised under UK law) between us and the provider.
You can contact us at support@vapeloxa.com if you would like further information about the safeguards used for international transfers of your personal data.
13. Children
Vapeloxa is an adult-only retailer. Our products and services are not directed at anyone under 18. We do not knowingly collect personal data from children for the purpose of selling age-restricted goods. If you believe a minor has provided data or tried to order, contact us so we can take appropriate action.
14. Changes and contact
We may update this Policy from time to time. The version on this page when you use the site or place an order usually applies to that use or order. Material updates will be reflected by changing the date at the top of this page.
- Privacy questions: support@vapeloxa.com or Contact Us.
- Include your order number where relevant so we can find the right records quickly.
- For account security concerns, tell us as soon as you can.
Related policies
Questions about your data or an order? Contact support with your order number where you have one.