Privacy Policy
Last updated 24 September 2026.
This policy explains what personal data we collect when you visit www.nicotinebuzz.co.uk or buy from us, why we collect it, who we share it with and what rights you have. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who is responsible for your data
The data controller is Wholesaling Ltd, trading as NicotineBuzz, company number 15403542, 48 Mitcham Road, London, SW17 9NA, United Kingdom. Questions about this policy or your data go to info@nicotinebuzz.co.uk.
2. What we collect and why
| What | When | Why, and our lawful basis |
|---|---|---|
| Name, email address, phone number, delivery and billing address | When you order, create an account or contact us | To take and deliver your order, send order emails and answer you. Performance of a contract. |
| Date of birth | At checkout | To confirm you are 18 or over. It is checked automatically and stored with your order as our record of the age check. Legal obligation and legitimate interest in selling nicotine products responsibly. |
| Order history, items bought, amounts paid, subscription settings | Each order | To fulfil orders, handle returns and claims, run subscriptions and keep accounting records. Contract and legal obligation. |
| Payment details | At checkout | Collected directly by Stripe on our checkout page. We receive a payment reference, the card type and last four digits, never the full number. Contract. |
| Delivery tracking events and claim correspondence, including photos you send us | If there is a delivery or damage issue | To resolve claims, pursue courier claims and prevent fraud. Contract and legitimate interest. |
| Device and usage data: IP address, browser, pages viewed, referring site | Automatically while browsing | To keep the site secure and working, and (only with your consent) to measure how the site and our ads are used. Legitimate interest for security; consent for analytics and advertising cookies. |
| Reviews you write | When you submit one | To publish it with your first name or initial. Consent. |
| Login codes and account data | If you create an account | We email one-time codes to sign you in; no passwords are stored. Contract. |
3. Marketing emails
If you have bought from us we may email you about similar products, restock reminders and offers, as PECR allows for existing customers. Every such email has an unsubscribe link, and you can also opt out by replying "unsubscribe" or emailing us. We do not send marketing to anyone who has not bought from us or asked for it, and we do not sell or rent your details to anyone.
4. Who we share it with
We share personal data only with the service providers we need to run the shop, each under a contract that limits what they can do with it:
| Provider | What they do with your data | Purpose |
|---|---|---|
| Stripe Payments UK Ltd / Stripe Inc. | Takes your card payment, screens it for fraud, and (if you choose Stripe Link) saves your details for faster checkout. We never see your full card number. | Payment |
| Vercel Inc. | Hosts this website and its checkout, and provides cookieless traffic analytics. | Hosting |
| SiteGround | Hosts our order-management database (customer accounts, orders, subscriptions). | Order system |
| Resend Inc. | Sends our order confirmations, dispatch notices, login codes and subscription emails. | |
| Royal Mail and other couriers | Receive your name, delivery address and, where you give one, phone number and email so they can deliver and send tracking updates. | Delivery |
| Google LLC (Analytics, Ads, Shopping) | With your consent: analytics on how the site is used, and measurement and remarketing for our Google Shopping and Search ads. | Analytics and ads (consent) |
We may also disclose data where the law requires it, to enforce our terms, or to protect our rights, for example giving proof of delivery to a card issuer in a payment dispute, or information about a suspected fraudulent claim to the police. If the business is sold, customer records would pass to the buyer under the same protections.
5. International transfers
We are based in the UK and your order data is held in the UK or the European Economic Area. Some of our providers (Stripe, Vercel, Google, Resend) are US companies and may process data outside the UK. Where they do, the transfer is covered by the UK International Data Transfer Agreement or Addendum, or by the UK adequacy regulations for the country concerned.
6. Automated decisions and fraud screening
Stripe automatically screens every payment for fraud and may decline a transaction. Our checkout automatically rejects a date of birth under 18. Neither decision profiles you beyond that, and you can contact us if you think a payment or order was declined in error.
7. How long we keep it
- Orders and invoices: 6 years after the end of the financial year, as HMRC requires.
- Age-check record (date of birth): kept with the order for the same period, as evidence that the age check was done.
- Accounts: until you ask us to delete the account, or after 3 years without an order.
- Claim records: 6 years, so we can respond to card disputes and repeat claims.
- Analytics data: Google Analytics retains user-level data for 14 months.
- Marketing consent and opt-outs: we keep a record of opt-outs indefinitely so we do not email you again.
8. Cookies and similar technologies
We use as few cookies as we can. Essential ones make the shop work and need no consent. Analytics and advertising cookies are only set if you press Accept on the cookie bar; if you press Reject, or ignore it, they are never set. You can change your mind by clearing this site's data in your browser, which brings the bar back.
| Name | What it does | Type | How long |
|---|---|---|---|
nb_cookie_consent | Remembers whether you accepted or rejected optional cookies. | Essential | Browser storage, until cleared |
cart, checkoutData, and similar | Your basket, delivery choice, date-of-birth check and checkout progress. | Essential | Browser storage, until cleared |
__stripe_mid, __stripe_sid | Set by Stripe on the checkout page for fraud prevention. | Essential | 1 year / 30 minutes |
_ga, _ga_* | Google Analytics 4: distinguishes visitors and sessions. | Analytics (consent) | Up to 2 years |
Google Ads conversion and remarketing cookies | Measure which ads lead to orders and allow us to show ads to previous visitors. | Advertising (consent) | Up to 90 days |
Vercel Analytics and our SEO tools measure traffic without cookies or personal identifiers. You can also opt out of Google Analytics across all sites with Google's browser add-on, and control ad personalisation at adssettings.google.com.
9. Your rights
Under UK GDPR you can ask us to:
- Access the personal data we hold about you, and get a copy;
- Correct anything that is wrong;
- Erase your data, where we no longer need it (we must keep order records for tax law, but we can anonymise the account);
- Restrict or object to how we use it, including objecting to marketing at any time;
- Port the data you gave us to another provider in a machine-readable format;
- Withdraw consent for cookies or reviews at any time.
Email info@nicotinebuzz.co.uk from the address on your account and we will respond within one month. There is no charge. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Under-18s
This site sells age-restricted products and is for adults only. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, email us and we will delete it.
11. Security
The whole site is served over HTTPS. Payments are handled by Stripe, which is PCI DSS Level 1 certified. Access to order data is limited to the people who need it to pack orders and answer customers, and is protected by login.
12. Changes
We update this policy when our practices or providers change, and show the date at the top. Significant changes are announced on the site. See also our Terms and Conditions.