Last updated: 27 September 2026
This policy explains what personal information White Vape Co Ltd ("White Vape Co", "we", "us") collects when you shop with us online, in our app or in our shops, what we use it for, who we share it with, how long we keep it, and your rights.
Who we are
We are the controller of your personal information. White Vape Co Ltd is registered in England and Wales, company number 11469015, registered office 39 Hollybank Crescent, Hythe, Southampton SO45 5FZ.
For anything about your personal information, email info (at) whitevapeco (dot) uk, phone 0330 380 0657, or write to White Vape Co, 81 Long Lane, Holbury, Southampton SO45 2ND.
What we collect
- Account and order details: your name, email address, phone number, billing and delivery addresses, what you buy and your order history, in our shops as well as online if you have an account.
- Age verification: the name and address you give at checkout, the result of the check, the type of check, the date and a reference number. If you upload a photo ID, we also briefly hold the image. See "How we check your age" below.
- Payment: card payments go straight to our payment provider, Worldpay. We see only the last digits of your card and the payment result. We never see or store your full card number.
- Vape Club: your points balance, how you earned and spent points, and referrals.
- Reviews: product reviews you write and the name you post them under.
- Emails from us: whether our marketing emails are opened and which links are clicked.
- Checkout you haven’t finished: if you enter your email address at checkout and leave without ordering, we save it with your basket.
- Using the website and app: your IP address, browser and device information, security logs, and, if you allow them, analytics cookies. Our Cookie Policy has the details.
- Contacting us: what you tell us by email, phone or in person.
- Our chat assistant: the messages you type to Alan, the virtual assistant on our website, and his replies, the page you were on, and a scrambled form of your IP address that we use only to stop misuse. If you report a problem with our website through the chat, we also keep your email address, what you tell us, any error shown on the page, what was in your basket and your browser type, so we can fix it and let you know when it is sorted. Please don’t type personal details such as your address or payment details into the chat.
How we check your age
We must not sell age-restricted products to anyone under 18, so we check the age of online customers before we send an order.
- First, we check your name and address against the UK electoral roll through our age verification provider, AgeVerifyUK.
- If that doesn’t confirm you are 18 or over, we ask you to upload a photo of an in-date photo ID. Our verification service, provided by WooYoo, analyses the image automatically.
- If the automated check confirms your age, the image is not saved. If it can’t confirm your age, it tells you, and you can ask a member of our team to look at it. You always have the right to a human review.
- An image is kept only while a member of our team needs to look at it. It is encrypted, only authorised staff can view it, and it is permanently deleted as soon as they make a decision, or after 7 days at most.
- We keep a record that you were checked: the result, the type of document, the date and a reference number. We keep it so we can show we checked your age.
Why we use it, and our legal basis
- To take, deliver and support your orders, and to run your account and Vape Club: to perform our contract with you.
- To check your age: to meet our legal obligations under age-of-sale laws.
- To keep order, VAT and accounting records: legal obligation.
- To prevent fraud, abuse of the loyalty scheme and attacks on the site: our legitimate interest in protecting our business and customers.
- To answer your questions in our website chat: our legitimate interest in helping you find the right products and answering questions about our shops.
- To send marketing emails to customers about similar products, deals and your points: our legitimate interest. We only do this where you have bought from us or created an account, and we gave you the chance to opt out when we collected your details. Every email has an unsubscribe link.
- To email you about a basket you didn’t finish: our legitimate interest in helping you complete a purchase you started. You can unsubscribe from these emails at any time.
- To see whether our marketing emails are opened and which links are clicked: your consent, which you give when you tick the box to receive our marketing emails. You can withdraw it at any time by unsubscribing.
- To ask you to review your purchase: our legitimate interest. You can unsubscribe at any time.
- Analytics cookies and push notifications: your consent, which you can withdraw at any time.
Who we share it with
We don’t sell your personal information. We share it only with companies that help us run the business, under contracts that require them to protect it:
- Worldpay: card payments and fraud checks.
- Royal Mail: delivering your parcels.
- AgeVerifyUK: electoral roll age checks.
- WooYoo: the photo ID check, and the software that runs our website and shops.
- Anthropic (USA): the AI that writes Alan’s answers in our website chat. Your chat messages, and the product and shop information needed to answer them, are sent to Anthropic through WooYoo.
- Our email providers: StackMail for order emails, and Resend (USA) for account, marketing and reminder emails.
- OneSignal (USA): push notifications, if you allow them.
- Google (USA): Google Analytics, if you allow it.
- Cloudflare (USA): checking that forms are used by people, not bots.
- Our hosting provider: the servers that run our website.
- Our accountants and professional advisers, and the police, Trading Standards, HMRC or courts where the law requires it.
Information sent outside the UK
Some of these providers are based in, or use servers in, the USA. When your information goes outside the UK, it is protected by the UK–US Data Bridge or by the ICO’s International Data Transfer Agreement or Addendum.
How long we keep it
- Uploaded ID images: not saved if the automated check passes. Otherwise deleted as soon as our team decides, or after 7 days at most.
- Order and VAT records: 6 years after the end of the financial year the order falls in, as required by law.
- Age check records: for as long as you have an account, and for 6 years after your last order.
- Your account and Vape Club points: until you close your account.
- Baskets you didn’t finish: the restore link expires after 14 days.
- Analytics data: up to 14 months in Google Analytics.
- Emails you send us: as long as we need them to deal with your query, and then for up to 2 years.
- Chat conversations: 90 days, then deleted.
- Problem reports: until the problem is fixed and we have let you know, then for up to 12 months.
Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct anything that is wrong;
- ask us to delete your information, where we don’t need to keep it by law;
- object to, or ask us to restrict, how we use it;
- ask for your information in a format you can take elsewhere;
- stop marketing at any time, using the unsubscribe link or by contacting us; and
- withdraw your consent to cookies or notifications at any time.
To use any of these rights, or to close your account, contact us at info (at) whitevapeco (dot) uk. We’ll reply within one month.
Complaints
If you’re unhappy with how we’ve handled your information, please tell us first. We’ll acknowledge your complaint within 30 days and tell you what we’re doing about it. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
We’ll update this page if the way we use your information changes, and change the date at the top.
