Privacy policy
Last updated: 9 October 2026
This policy explains what personal data we collect when you visit moreishpuff.com or buy from us, why we collect it, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
1. Who we are
The data controller is Cherish Vapor Ltd, trading as Moreish Puff, registered in England & Wales (company no. 11655772, VAT GB321665810). Our registered office and trading address is 91 Redfern Road, Tyseley, Birmingham, B11 2BH. Email sales@moreishpuff.com, phone 0121 706 6841.
2. What we collect
- Identity and contact details: name, billing and delivery address, email address and phone number.
- Order details: products bought, order value, delivery or click & collect choice, returns and refunds.
- Payment details: payments are handled by our payment providers. We don’t see or store your full card number.
- Age verification: our products are for adults only. We may verify age using third-party checks, which can use your name, address and date of birth, and we keep the result of any check.
- Account details: if you create an account, your login details and order history.
- Communications: emails, messages, reviews, competition entries, forms and phone calls with us.
- Marketing preferences: whether you’ve agreed to receive marketing emails from us, and how you interact with them.
- Technical and usage data: IP address, device and browser type, pages viewed and how you found us, collected through cookies and similar technologies (see section 7).
3. Why we use your data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Processing and delivering your order, taking payment, handling returns, refunds and customer service | Performance of a contract |
| Checking you are 18 or over before we sell nicotine and other age-restricted products | Legal obligation |
| Keeping accounting and tax records required by HMRC | Legal obligation |
| Preventing fraud and keeping our website secure | Legitimate interests |
| Improving our website, products and service, and basic analytics | Legitimate interests, or consent where cookies are not strictly necessary |
| Sending marketing emails | Consent, or for existing customers, marketing of similar products with an easy opt-out (PECR “soft opt-in”) |
| Analytics, affiliate and advertising cookies | Consent |
| Running competitions and publishing reviews you choose to leave | Consent |
You can unsubscribe from marketing at any time using the link in any email, or by contacting us.
4. Who we share it with
We only share your data with service providers who help us run the shop. They act on our instructions and must keep it secure:
- Shopify: our e-commerce platform, which hosts the website, orders and customer accounts.
- Shopify Email: sending our marketing and service emails.
- Payment providers (Worldpay and PayPal): processing payments.
- Royal Mail and our delivery carriers (including through Royal Mail Click & Drop and Veeqo): delivering your order.
- Age verification providers: where we use a third-party check to confirm you are 18 or over.
- Google (Analytics): website analytics, only if you accept these cookies.
- Affiliate Future: tracking sales referred by affiliate websites, only if you accept these cookies.
- Form and competition tools: when you use our returns form or enter a competition.
- Our accountants: bookkeeping and tax.
We may also share data if the law requires it (for example, with HMRC, Trading Standards or the police), or to protect our legal rights. We never sell your personal data.
5. International transfers
Some of these providers (for example, Shopify and Google) may process data outside the UK. When they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep it
- Orders, invoices and payment records: 6 years from the end of the financial year they relate to (HMRC requirement).
- Age verification records: for as long as we need them to show we complied with the law, up to 6 years.
- Customer accounts: until you close your account, or after 3 years of inactivity.
- Customer service emails and messages: up to 2 years after the matter is resolved.
- Marketing data: until you unsubscribe, after which we keep a suppression record so we don’t contact you again.
- Cookies: from the end of your session up to 2 years, depending on the cookie.
7. Cookies
We use cookies that are strictly necessary to run the website (for example, your basket, checkout and remembering that you have confirmed you are 18 or over). With your consent, we also use analytics and marketing cookies (for example, Google Analytics and Affiliate Future). You can accept or reject non-essential cookies in our cookie banner and change your choice at any time here: Cookie preferences. You can also block or delete cookies in your browser settings. If you don’t allow cookies, some parts of our website may not work as intended.
8. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in some circumstances;
- restrict or object to how we use your data, including objecting to direct marketing at any time;
- data portability (receive your data in a commonly used format);
- withdraw your consent at any time, where we rely on consent.
To use any of these rights, email sales@moreishpuff.com or write to us at the address above. We’ll respond within one month and normally won’t charge a fee.
9. Complaints
If you’re unhappy with how we’ve handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
10. Under-18s
Our website and products are for adults only. Under-18s are not allowed to use this website or buy from us, and we don’t knowingly collect data from anyone under 18. Any order placed by someone under 18 will be cancelled.
11. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
