Data Controller

If you have any questions about our use of cookies or this policy, please contact us at:

VapeStation

Unit 16, The Gateway Estate, Birmingham Cargo Airport, Birmingham, B26 3QD

Information We Collect

We collect the following categories of personal information:

• Identity Data – such as business name, contact person, and VAT number.
• Contact Data – including business address, telephone number, and email address.
• Account Data – login credentials and order history associated with your business account.
• Technical Data – IP address, browser type, device identifiers, and cookies.
• Transaction Data – details of products purchased, payments, and deliveries.

How We Collect Information

We collect information directly from you when you register for a B2B account, place an order, or contact us.
We also collect limited technical data automatically through cookies and analytics tools such as Google Analytics.

How We Use Your Information

We process your personal data for the following purposes:

• To manage and fulfil your orders.
• To verify your business credentials and maintain your account.
• To provide customer support and respond to enquiries.
• To comply with legal, tax, and regulatory obligations.
• To improve the performance and functionality of our website.
• To ensure website security and fraud prevention.

Legal Basis for Processing

We rely on the following lawful bases for processing personal data:

• Contractual necessity – for processing orders and providing services.
• Legal obligation – for record-keeping and regulatory compliance.
• Legitimate interests – to improve business operations, website performance, and fraud prevention.
• Consent – where required, for non-essential cookies or analytics tracking.

Sharing Your Information

We do not sell or rent your information.
However, we may share limited information with trusted third parties who assist in fulfilling our services, such as:

• DPD and Royal Mail – for shipping and delivery of orders.
• IT service providers and website hosting companies.
• Payment processors and financial institutions (for transaction processing).

Each third party is required to process your information securely and only for the specific purposes defined by VapeStation.

Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements.
Typically, account and order data are retained for a minimum of six (6) years to comply with HMRC record-keeping obligations.

Cookies and Analytics

Our Site uses cookies and Google Analytics to improve functionality and analyse usage patterns.
Cookies are small text files stored on your device that help us remember your preferences and enhance your browsing experience.
You can manage or disable cookies through your browser settings; however, some features may not function properly if cookies are disabled.

Data Security

We implement appropriate technical and organisational measures to secure personal data against accidental loss, unauthorised access, alteration, or disclosure.
Access to your data is restricted to employees and partners who need it to perform legitimate business functions.

Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• The right to access and receive a copy of your personal data.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure (“right to be forgotten”) in certain circumstances.
• The right to restrict or object to processing.
• The right to data portability.
• The right to withdraw consent (where processing is based on consent).

To exercise any of these rights, please contact us at info@vapestation.com.

International Data Transfers

We primarily store and process your personal data within the United Kingdom.
If we transfer personal data outside the UK (for example, for cloud hosting services), such transfers will occur only where adequate safeguards (such as Standard Contractual Clauses) are in place.

Links to Other Websites

Our website may contain links to other third-party websites.
We are not responsible for the privacy practices or content of those sites.
We recommend reviewing their privacy policies before providing any personal information.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal obligations.
The revised version will be posted on our website with an updated “Last Updated” date.