🔒 Privacy Policy
Last updated: July 2025
At The Cana Vape, we take your privacy and data protection seriously. This Privacy Policy explains how we collect, use, store, and safeguard your personal information when you visit our website, make a purchase, or interact with us.
1. Who We Are
The Cana Vape is a UK-based online retailer of vaping products. Our website is thecanavape.co.uk. We are the data controller for the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018).
If you have any questions about this policy or how we handle your data, please contact our Data Protection Officer at privacy@thecanavape.co.uk.
2. Information We Collect
2.1 Personal Information You Provide
When you use our website or place an order, we may collect the following personal information:
- Identity Information: Full name, title, date of birth
- Contact Information: Billing address, shipping address, email address, phone number
- Payment Information: Credit/debit card details (processed securely by our payment processor — we do not store full card numbers)
- Account Information: Username, password, order history, wishlist items
- Communication: Records of your correspondence with us, including emails and live chat transcripts
- Age Verification Data: Date of birth and age verification results as required by UK law
2.2 Information Collected Automatically
When you visit our website, we automatically collect:
- Technical Data: IP address, browser type and version, operating system, device type
- Usage Data: Pages visited, time spent on pages, click patterns, referral source, browsing behaviour
- Cookie Data: Information stored via cookies (see our Cookie Policy section below)
2.3 Information from Third Parties
We may receive information about you from third-party service providers, including:
- Payment processors (for payment confirmation and fraud screening)
- Age verification services (to confirm you are 18+ as required by UK law)
- Shipping carriers (for delivery status updates)
- Fraud prevention agencies (to prevent fraudulent transactions)
3. How We Use Your Information
We use your personal information for the following purposes:
| Purpose | Legal Basis | Data Categories |
|---|---|---|
| To process and fulfil your orders | Performance of a contract | Identity, Contact, Payment |
| To verify your age (legal requirement) | Legal obligation | Identity, Age verification |
| To communicate about your account and orders | Performance of a contract | Identity, Contact |
| To send marketing communications (with consent) | Consent | Identity, Contact |
| To improve our website and customer experience | Legitimate interests | Technical, Usage |
| To prevent fraud and ensure security | Legal obligation / Legitimate interests | Identity, Technical, Transactional |
| To comply with tax, accounting, and legal requirements | Legal obligation | Identity, Transactional |
4. Payment Processing
We use Stripe and PayPal as our payment processors. When you make a payment on our website:
- Your payment details are transmitted directly to the payment processor using bank-level encryption (SSL/TLS)
- We do not store your full credit or debit card numbers, CVV codes, or PIN numbers on our servers
- We receive only a payment confirmation token and the last four digits of your card for reference
- All payment processing is fully PCI DSS compliant
5. Data Sharing & Third Parties
We do not sell, trade, or rent your personal information to third parties for their marketing purposes. We may share your information with trusted service providers who help us operate our business, including:
| Third Party | Purpose | Data Shared |
|---|---|---|
| Stripe / PayPal | Payment processing | Payment details, order total, billing address |
| Royal Mail / DPD | Shipping and delivery | Name, shipping address, phone number |
| Age Checker | Age verification (legal requirement) | Name, date of birth, address |
| Google Analytics | Website analytics and performance | Anonymised usage data, IP address (anonymised) |
All third-party service providers are contractually obligated to keep your personal information confidential, secure, and to use it only for the specific purpose for which it was shared.
6. Data Retention
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements:
- Order information: Retained for 7 years to comply with UK tax and accounting law (HMRC requirements)
- Account information: Retained for as long as your account is active, plus 2 years after account closure
- Marketing preferences: Retained until you withdraw consent or unsubscribe
- Age verification data: Retained for 3 years following your last order
- Website analytics data: Retained for 26 months (Google Analytics standard)
7. Your Rights Under UK GDPR
Under UK data protection law, you have the following rights regarding your personal information:
Your Rights at a Glance
- Right to be informed — You have the right to be told how your data is used (this policy)
- Right of access — You can request a copy of the personal data we hold about you (Subject Access Request)
- Right to rectification — You can ask us to correct any inaccurate or incomplete data
- Right to erasure — You can request deletion of your data where there is no compelling reason to keep it (subject to legal obligations)
- Right to restrict processing — You can ask us to limit how we use your data in certain circumstances
- Right to data portability — You can request a machine-readable copy of your data to transfer to another service
- Right to object — You can object to processing based on legitimate interests or direct marketing
- Rights related to automated decision-making — You can contest certain automated decisions, including fraud screening
To exercise any of these rights, please contact us at privacy@thecanavape.co.uk. We will respond to your request within 30 days (as required by UK GDPR).
8. Cookies
Our website uses cookies to enhance your browsing experience, analyse site traffic, and support our marketing efforts. Cookies are small text files stored on your device by your web browser.
Types of Cookies We Use
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential/Strictly Necessary | Shopping cart, checkout, account login, security. These cookies are required for the website to function. | Session / Persistent |
| Functional | Remembering your preferences, settings, and previously viewed products | Up to 1 year |
| Analytics/Performance | Google Analytics — understanding how visitors interact with our website to improve performance | Up to 2 years |
| Marketing/Targeting | Delivering relevant advertisements and measuring campaign effectiveness | Up to 90 days |
You can control cookie preferences through your browser settings at any time. Most browsers allow you to block or delete cookies. Please note that disabling essential cookies may affect the functionality of our website, particularly the shopping cart and checkout process.
9. Age Restriction & Challenge 25 Policy
This website is intended for individuals aged 18 years and over. We operate a strict Challenge 25 policy:
- All customers must confirm they are 18 or over before completing a purchase
- We use a third-party age verification service to check your details against public records
- If we cannot verify your age electronically, we may request photo ID (passport or driving licence) before processing your order
- If you appear to be under 25, you may be asked for ID at the point of delivery
- We reserve the right to cancel any order if we cannot satisfactorily verify your age
- We do not knowingly collect or process data from anyone under 18
10. Data Security
We implement appropriate technical and organisational measures to protect your personal information, including:
- SSL/TLS encryption (256-bit) for all data transmitted between your browser and our server
- Firewall and malware protection on all our systems
- Secure password hashing for user accounts
- Regular security audits and vulnerability scanning
- Limited access controls — only authorised personnel can access personal data
- PCI DSS compliance for all payment processing
While we take every reasonable precaution to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but will notify you and any relevant regulator (ICO) in the event of a data breach as required by law.
11. Marketing Communications
With your consent, we may send you marketing emails about new products, special offers, and news. You can withdraw your consent at any time by:
- Clicking the “unsubscribe” link in any marketing email
- Updating your email preferences in your account settings
- Contacting us at privacy@thecanavape.co.uk
We will never send you marketing communications without your explicit consent, and we will never share your data with third parties for their marketing purposes.
12. Complaints
If you have a complaint about how we handle your personal information, please contact us at privacy@thecanavape.co.uk. We will investigate and respond to your complaint within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK data protection regulator:
- Website: ico.org.uk
- Phone: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
13. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Where changes are significant, we will notify you by email or through a notice on our website.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:
- 📧 Data Protection Officer: privacy@thecanavape.co.uk
- 📧 General Inquiries: support@thecanavape.co.uk
- 📞 Phone: 0800 123 4567
- 🏢 Registered Address: The Cana Vape, Unit 4, Vape Business Park, London, EC1A 1BB, United Kingdom
- 🕐 Hours: Monday–Friday, 9:00 AM – 5:30 PM