Privacy policy
Privacy Policy
IVAPE.DELIVERY LIMITED Last updated: 19 April 2026
1. About this policy
This privacy notice explains how IVAPE.DELIVERY LIMITED ("we", "us", "our") collects, uses, and protects personal data in connection with the ivape.delivery website and our trade wholesale operations. ivape.delivery is a trade-only website — account access is restricted to verified businesses.
We are the data controller for the personal data described below.
- Company: IVAPE.DELIVERY LIMITED (Companies House 14748961)
- Registered office: Unit 2 Peacock View, Fenton Industrial Estate, Stoke on Trent, ST4 2XJ
- Email: accounts@ivape.direct
2. The personal data we collect
Because ivape.delivery serves trade customers only, the personal data we collect relates to the individual business contacts and representatives at our customer businesses. We collect:
Trade account data
- Contact name, role, email address, telephone number
- Trading/legal business name, business address, Companies House number (where applicable), VAT registration number
- Evidence provided to verify trade status — e.g. photograph of premises, trade licence, retail registration
- Age confirmation (18+ required)
Order and transaction data
- Orders placed, invoices issued, delivery addresses, delivery instructions
- Payment confirmation details (we do not see or store full card numbers — payment is handled by our processor)
- Correspondence about orders and returns
Website usage data
- IP address, device type, browser, pages viewed, referring URL, date and time of visit
- Session identifiers for logged-in accounts
- Cookie data — see Section 10
Communications data
- Email, telephone and contact-form submissions
- Marketing preferences
We do not seek to collect special category data (e.g. health, biometric). If you volunteer it we will delete it unless we have a specific lawful basis to retain it.
3. How we obtain your data
Most data is provided directly by you when you register, place orders, or contact us. Some is generated automatically when you use the site (cookies, server logs). A small amount may come from third parties — for example, Companies House when we verify trade status, or couriers confirming delivery.
4. Lawful bases and purposes
We process personal data on the following UK GDPR lawful bases:
| Purpose | Lawful basis |
|---|---|
| Verifying an applicant is a legitimate trade business aged 18+ (TRPR 2016 and NIPR 2015 compliance) | Legitimate interests; Legal obligation |
| Creating and administering your trade account | Contract performance |
| Processing orders, payments, invoicing, delivery and returns | Contract performance |
| Keeping VAT, accounting and trade records | Legal obligation (HMRC) |
| Fraud and credit-risk checks | Legitimate interests |
| Operational emails (order confirmations, dispatch notices, account notices) | Contract performance |
| Direct marketing to corporate subscribers (limited companies, LLPs) about related trade offers | Legitimate interests (B2B marketing under PECR) |
| Direct marketing where the corporate-subscriber rule does not apply | Consent |
| Non-essential cookies | Consent |
| Responding to enquiries and complaints | Legitimate interests |
| Enforcing our Terms of Service and defending legal claims | Legitimate interests |
| Complying with regulators (HMRC, MHRA, Trading Standards, ICO, DAERA) | Legal obligation |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights. A copy of the assessment is available on request.
5. Who we share your data with
We share personal data only with organisations that need it to support the purposes above.
- Shopify, Inc. — e-commerce platform (website hosting, account and order data, payment processing via Shopify Payments). Shopify is headquartered in Canada and operates globally.
- Payment processors — Shopify Payments and any alternative processor offered at checkout. Full card numbers are handled by the processor and not by us.
- Couriers and fulfilment partners — name, address and phone number required for delivery.
- Email service provider — Omnisend Ltd (UK/EU based) for marketing and transactional email campaigns.
- Website analytics — Shopify Analytics (part of the Shopify platform; no separate third-party analytics provider).
- Professional advisers — accountants, auditors, solicitors, on a need-to-know basis.
- Regulators and law enforcement — where legally required (HMRC, MHRA, Trading Standards, ICO, DAERA, police, courts).
- Acquirers — if we sell or restructure the business, personal data may be transferred to the successor, subject to equivalent protection.
We do not sell personal data and we do not share it with third parties for their own marketing.
6. International transfers
Some of our processors (for example, Shopify) operate outside the United Kingdom. When personal data leaves the UK, we rely on UK-approved safeguards — adequacy regulations where available (including the UK-US Data Bridge extension to the EU-US Data Privacy Framework), or the UK International Data Transfer Agreement and the UK Addendum to the EU Standard Contractual Clauses, supplemented by technical measures.
Contact us for details of the safeguards applying to a specific transfer.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Trade account records | Duration of trading relationship + 6 years |
| Invoices, VAT and accounting records | 6 years from end of accounting period (Companies Act 2006; VAT Act 1994) |
| Orders and delivery records | 6 years from order date |
| Trade-status verification evidence | Duration of trading relationship + 2 years |
| Marketing preferences and opt-outs | Until updated by you, or 3 years of inactivity |
| Server logs and analytics cookie data | Up to 14 months |
| Complaints and enquiries | 3 years from closure |
Where a longer retention is required by law (for example, evidence for an ongoing regulatory investigation), we will retain only the minimum necessary.
8. Your rights
Under the UK GDPR you have the right to:
- Access — a copy of the personal data we hold about you
- Rectification — correction of inaccurate data
- Erasure — deletion where a statutory ground applies
- Restriction — suspension of processing while a dispute is resolved
- Data portability — your data in a portable format, where processing is by consent or contract
- Object — to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent — for anything we process on consent (effective going forward)
- Not be subject to solely automated decisions with legal effect — we do not carry out such profiling
Email accounts@ivape.direct to exercise any right. We aim to respond within one calendar month.
If you believe we have mishandled your personal data, please tell us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office — ico.org.uk or 0303 123 1113.
9. Security
We follow Shopify's platform security model, enforce role-based access to trade accounts, use HTTPS site-wide, and restrict administrative access to authorised staff. Card data is handled by PCI-DSS-compliant processors; we do not see or store it.
Report a suspected security issue to accounts@ivape.direct.
10. Cookies
A cookie is a small text file placed on your device when you visit a website.
Strictly necessary — required for the site to work (logged-in session, cart, security tokens, load balancing). These cannot be turned off.
Analytics — help us understand how the site is used, in aggregate. Provided by Shopify Analytics as part of the Shopify platform. Some analytics cookies are set only with your consent via the cookie banner.
Preferences — remember your settings (e.g. currency, display choices). Set with your consent.
Marketing — measure email and advertising effectiveness. Set with your consent.
Manage your choices via the cookie banner or your browser settings. Blocking strictly-necessary cookies may stop parts of the site working.
11. Changes to this policy
We review this policy at least annually. Material changes will be notified to account holders by email and posted here at least 14 days before they take effect.
Version: 2026-04-19
12. Contact
- Email: accounts@ivape.direct
- Phone: 07566 874 571 (trading hours Mon–Fri 09:00–17:30, Sat 09:00–17:00, Sun 10:00–16:00)
- Post: IVAPE.DELIVERY LIMITED, Unit 2 Peacock View, Fenton Industrial Estate, Stoke on Trent, ST4 2XJ