General Data Protection Regulation (GDPR)

PRIVACY POLICY & GDPR

Transparency, security and protection of your personal data

At VapVip, we respect your privacy and are committed to protecting your personal data. This policy explains what information we may collect, how we use it and what rights you have.

We only process personal data necessary for the purposes described in this policy and implement security measures to protect it against unauthorised access, use or disclosure.

What information do we collect and how do we use it?

Depending on your relationship with VapVip, we may process the following information:

• Registration and customer accounts: identification and contact details required to create and manage your account. Processing is based on the performance of our contractual relationship or steps requested before entering into a contract.
• Orders, payments and deliveries: billing, shipping and transaction information needed to process purchases, resolve incidents and comply with legal obligations. The legal bases are the performance of a contract and compliance with legal obligations.
• Customer service: information included in enquiries, requests and communications so that we can respond and resolve issues. Depending on the circumstances, processing is based on contractual obligations, pre-contractual steps or our legitimate interest in responding to enquiries.
• Newsletters and commercial communications: your email address and preferences when you subscribe to receive our updates. These communications are sent with your consent, which you may withdraw at any time.
• Website security and operation: technical information, connection logs and data necessary to prevent abuse, maintain security and ensure that our services operate correctly. Processing is based, as applicable, on our legitimate interests or legal obligations.
• Website analytics: information about how visitors use our store through Google Analytics 4, only when you have consented to analytics cookies. The legal basis is your consent.

Who do we share your information with?

VapVip does not sell customers' personal data or disclose it to third parties for personalised advertising campaigns.

In order to provide our services, certain information may be disclosed to or accessed by service providers, where necessary:

• Delivery companies: to deliver orders and manage shipping-related issues.
• Financial institutions and payment providers: to process payments and refunds.
• Technology providers: for web hosting, maintenance, security and website protection, including services such as Cloudflare.
• Google Analytics: only for analytics processing authorised through user consent.
• Professional advisers and public authorities: where necessary to comply with accounting, tax or other legal obligations.

Some technology providers may process information outside the European Economic Area. Where applicable, such transfers must be covered by the safeguards required under the GDPR, including adequacy decisions or Standard Contractual Clauses.

How long do we retain your personal data?

We retain your personal data for as long as necessary to fulfil the purpose for which it was collected and, where applicable, for the periods required by law.

• Customer accounts: while your account remains active or until you request its deletion, without prejudice to information that we must retain for legal reasons.
• Orders and business records: for the applicable commercial, tax and statutory retention periods.
• Customer enquiries: for the time necessary to respond and, where appropriate, manage potential liabilities.
• Marketing subscriptions: until you withdraw your consent.
• Analytics information: according to the retention periods configured in the relevant tools and your authorised cookie preferences.

Where information must be retained to comply with legal obligations or address potential liabilities, its processing will be restricted to those purposes.

Your data protection rights

Under the GDPR, you may exercise the following rights:

You may also withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact us at [email protected], describing your request. Where necessary, we may ask for additional information to verify your identity.

If you believe your data protection rights have not been properly respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).

Protection of Minors

VapVip is an online store intended for adults. The sale of vaping products to anyone under 18 years of age is prohibited. We do not knowingly collect personal data from minors for registration or purchases of these products. If we identify an account that does not comply with age restrictions, we will take appropriate action.

Have questions about your privacy?

We are here to answer any questions you may have about the protection of your personal data.