Privacy policy

Data Protection

We are committed to protecting your privacy and your personal data. Please read this Privacy Notice to understand how we use, share and store your personal information.

This Privacy Notice was last updated on 16th June 2025.

Who We Are

We are E Cigarette DirectLimited, a company registered in England and Wales and we trade under the name E-Cigarette Direct. E Cigarette Direct Limited is part of the RDN Group consisting of RDN Group Limited and its subsidiaries, Gower Enterprises Limited, Orderly Distribution Limited and Neruda Holdings Limited, Halo Vapour Co Limited and E Cigarette Direct Limited (“we” or “us”). We manufacture e-liquid and sell electronic cigarettes, e-liquids and vaping accessories via our website and our retail stores and to our wholesale customers. We are based in Swansea, in South Wales and you can find our contact details here.

We take your privacy seriously and safeguard your personal data to the best of our ability, using appropriate organisational and technical measures. Please see below for more detail on the personal data we collect, why we collect it and what we do with it. Personal data is defined as information that relates to an identified or identifiable individual. You can find out more about personal data and data protection from the Information Commissioner’s Office (ICO) website.

How We Use Your Information

This privacy notice tells you what to expect when we collect personal data. It applies to information we collect about:

In this Privacy Notice, you can also find out more about your rights as a Data Subject, how you can ask us about your personal data and what to do if you have a question or a complaint

 

Website Customers and Visitors to our Website and the Ashtray Blog

E-Cigarette Direct operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). E-Cigarette Direct is powered by Shopify, which enables us to provide the Services to you. This Privacy Notice describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Notice, this Privacy Notice controls with respect to the collection, processing, and disclosure of your personal information.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified, so that it cannot identify or be reasonably linked to you. We may collect or process the following categories of personal information, including inferences drawn from this personal information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:

  • Contact details including your name, address, billing address, shipping address, phone number, and email address.
  • Financial information including credit card, debit card, and financial account numbers, payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details.
  • Account information including your username, password, security questions, preferences and settings.
  • Transaction information including the items you view, put in your cart, add to your wishlist, or purchase, return, exchange or cancel and your past transactions.
  • Communications with us including the information you include in communications with us, for example, when sending a customer support inquiry.
  • Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers.
  • Usage information including information regarding your interaction with the Services, including how and when you interact with or navigate the Services.

Personal Information Sources

We may collect personal information from the following sources:

  • Directly from you including when you create an account, visit or use the Services, communicate with us, or otherwise provide us with your personal information;
  • Automatically through the Services including from your device when you use our products or services or visit our websites, and through the use of cookies and similar technologies;
  • From our service providers including when we engage them to enable certain technology and when they collect or process your personal information on our behalf;
  • From our partners or other third parties.

How We Use Your Personal Information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

  • Provide, Tailor, and Improve the Services. We use your personal information to provide you with the Services, including to perform our contract with you, to process your payments, to fulfill your orders, to remember your preferences and items you are interested in, to send notifications to you related to your account, to process purchases, returns, exchanges or other transactions, to create, maintain and otherwise manage your account, to arrange for shipping, to facilitate any returns and exchanges, to enable you to post reviews, and to create a customized shopping experience for you, such as recommending products related to your purchases. This may include using your personal information to better tailor and improve the Services.
  • Marketing and Advertising. We use your personal information for marketing and promotional purposes, such as to send marketing, advertising and promotional communications by email, text message or postal mail, and to show you online advertisements for products or services on the Services or other websites, including based on items you previously have purchased or added to your cart and other activity on the Services.
  • Security and Fraud Prevention. We use your personal information to authenticate your account, to provide a secure payment and shopping experience, detect, investigate or take action regarding possible fraudulent, illegal, unsafe, or malicious activity, protect public safety, and to secure our services. If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe. We highly recommend that you do not share your username, password or other access details with anyone else.
  • Communicating with You. We use your personal information to provide you with customer support, to be responsive to you, to provide effective services to you and to maintain our business relationship with you.
  • Legal Reasons. We use your personal information to comply with applicable law or respond to valid legal process, including requests from law enforcement or government agencies, to investigate or participate in civil discovery, potential or actual litigation, or other adversarial legal proceedings, and to enforce or investigate potential violations of our terms or policies.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Notice. Such circumstances may include:

  • With Shopify, vendors and other third parties who perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, fulfillment and shipping).
  • With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalized advertising with third-party services based on your online activity with different merchants and websites. Our business and marketing partners will use your information in accordance with their own privacy notices. Depending on where you reside, you may have a right to direct us not to share information about you to show you targeted advertisements and marketing based on your online activity with different merchants and websites. .
  • When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as to ship you products or through your use of social media widgets or login integrations.
  • With our affiliates or otherwise within our corporate group.
  • In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service or policies, and to protect or defend the Services, our rights, and the rights of our users or others.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you. In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our Store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Notice . Depending on where you live, you may exercise certain rights with respect to your personal information here Shopify Privacy Portal Link.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children's Data

The Services are not intended to be used by children, and we do not knowingly collect any personal information about children under the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.As of the Effective Date of this Privacy Notice, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

Security and Retention of Your Information

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide you with Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies.

 

Customers Who Purchase From Our Stores

CCTV

We use closed circuit television (CCTV) images to provide a safe and secure environment for employees and for visitors to our business premises, such as customers, contractors and suppliers, and to protect our property. We record images only. There is no audio recording i.e. conversations are not recorded on CCTV.

The purposes of installing and using CCTV systems include:

  1. To assist in the prevention or detection of crime or equivalent malpractice.
  2. To assist in the identification and prosecution of offenders.
  3. To monitor the security of our business premises.
  4. To ensure that health and safety rules and Company procedures are being complied with.
  5. To assist with the identification of unauthorised actions or unsafe working practices that might result in disciplinary proceedings being instituted against employees and to assist in providing relevant evidence.
  6. To promote productivity and efficiency.

Cameras are located at strategic points throughout our premises, principally at the entrance and exit points. We have positioned the cameras so that they only cover communal or public areas on our premises and they have been sited so that they provide clear images. All cameras are also clearly visible. Appropriate signs are prominently displayed so that employees, clients, customers and other visitors are aware they are entering an area covered by CCTV.

Images may be recorded either in constant real-time (24 hours a day throughout the year), or only at certain times, as the needs of the business dictate. As the recording system records digital images, any CCTV images that are held on the hard drive of a PC or server are deleted and overwritten on a recycling basis and, in any event, are not held for more than one month. Once a hard drive has reached the end of its use, it will be erased prior to disposal.

Images that are stored on, or transferred on to, removable media such as CDs are erased or destroyed once the purpose of the recording is no longer relevant. In normal circumstances, this will be a period of one month. However, where a law enforcement agency is investigating a crime, images may need to be retained for a longer period.

Access to, and disclosure of, images recorded on CCTV is restricted. This ensures that the rights of individuals are retained. Images can only be disclosed in accordance with the purposes for which they were originally collected.

The images that are filmed are recorded centrally and held in a secure location. Access to recorded images is restricted to the operators of the CCTV system and to those managers who are authorised to view them in accordance with the purposes of the system. Viewing of recorded images will take place in a restricted area to which other employees will not have access when viewing is occurring.

Card Payments

When you make a purchase using a payment card, certain information will be processed by our EPOS system, provided by Futura Retail Solutions Limited, and Worldpay, LLC, our card payment services providers in order to take payment and complete our contract with you. All card payment information is protected to Payment Card Industry Data Security Standards. We do not retain a copy of this on our systems. You can find Worldpay’s privacy policy here and Futura’s privacy policy here.

Loyalty Cards

We offer an in-store loyalty card scheme which allows you to earn points from your purchases which can be redeemed against future purchases (subject to terms and conditions). In order for you to join the scheme, we require your name and postcode. We also require your date of birth to confirm you are over the age of 18. By joining the scheme, you consent to us processing this personal data.

If you join the loyalty scheme, your personal information will be held on our electronic till system database. We will process your information for the purpose of running the scheme. From time to time, we may also analyse data collated by the scheme in order to better understand our business and customers. This data will be anonymised where possible before collation.

You may also consent to give us your email address but this is optional. We will ask if you consent to receiving our newsletters but you do not need to agree to this in order to join the loyalty scheme. If you do consent, you can opt out of receiving newsletters at any time by using the “unsubscribe” link provided. You may also leave our loyalty card scheme and request your data to be deleted by contacting privacy@ecigarettedirect.co.uk. Please note that we will take reasonable steps to verify your identity before proceeding with your request.

People Who Call Our Customer Services Team, Use Live Chat On Our Website, Contact Us Via Social Media Or Email Us

Live Chat

We offer a ‘live chat’ service as an option to contact our Customer Services team. If you choose to use our Live Chat service, we will record information about your query including your name, email address and information you give us about your order (if relevant). Our Live Chat service is provided by LiveChat, Inc., a US based company. LiveChat, Inc. are committed to data protection and have undertaken a full programme of compliance with GDPR. LiveChat’s privacy policy is here. Your personal information will be stored in LiveChat’s data centres in Frankfurt, Germany. If you wish your information to be erased following your query, please let us know by emailing privacy@ecigarettedirect.co.uk. We also remove personal data from the LiveChat service every 12 months.

Phone calls

When you call our customer services team we may record information about your call including your name and telephone number and the reason for calling. If you place an order over the phone for the first time or if you are having difficulties ordering online, we may take information from you for the purpose of carrying an age verification check which we are required to do by law before you can purchase electronic cigarette items from us.

Age verification is provided by AgeChecked Limited who act as a data processor on our behalf. We record the result but not the detailed information in your customer account (unless the information is also required for the purpose of completing your order, e.g. your name and address).

Social media

We use a third party provider, Hootsuite, to manage our social media interactions.

If you send us a private or direct message via social media the message will be stored by Hootsuite for three months. It will not be shared with any other organisations.

Emails

We use Transport Layer Security (TLS) to protect email traffic. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

We use a third party provider, Google Inc., to provide our email server. Here is a link to Google’s privacy policy. We have also entered into an agreement with Google who have undertaken to keep your personal information secure in line with European Union data protection standards and requirements.

People Who Subscribe To Our Newsletters

We will only send you emails if you have demonstrated your consent by opting in (by ticking a box or clicking a button in an email). You may unsubscribe at any time by clicking the unsubscribe link in any of our emails.

We use a third party provider, Mailchimp to deliver our monthly e-newsletters. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter. We have entered into a data processing agreement with Mailchimp where they have undertaken to comply with the GDPR and data protection legislation. For more information, please see Mailchimp’s privacy notice.

People Who Enter Competitions And/Or Respond To Surveys

Any personal data collected will only be used for the purpose stated in the competition entry. For example, if you give us your name and email address for a prize draw, your personal information will only be used for the purpose of selecting a winner or winners and to contact you if you are a winner. We will not send you any marketing emails unless you have also chosen to subscribe to our email newsletters as part of your entry or otherwise.

If you respond to a survey or questionnaire and give us your personal information as part of your response, your personal information will be anonymised or pseudonymised before the remaining data is processed.

Job Applicants, Current And Former Employees

The company that you apply to is the data controller for the information you provide during the recruitment process unless otherwise stated. Personal data will be shared between the RDN Group companies for the purposes of managing the recruitment process and your employment lifecycle. If you have any queries about the process or how we handle your information please contact us at recruitment@ecigarettedirect.co.uk.

What will we do with the information you provide to us?

All of the information you provide during the process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.

We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.

We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.

What information do we ask for, and why?

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it might affect your application if you don’t.

Application stage

We use a third party Applicant Tracking System (ATS) provided by People Apps Limited to record and advertise our vacancies and applications. Here is a link to their Privacy Notice. We have a data processing agreement in place with People Apps Limited.

We ask you for your personal details including name and contact details. We will also ask you about your previous experience, education, referees and for answers to questions relevant to the role you have applied for. Your information will be stored on our ATS and our recruitment team will have access to all of this information. The information on our ATS will be stored at a destination within the European Economic Area (“EEA”).

You may also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside of our recruitment team, including hiring managers, in a way which can identify you. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.

Information that you provide on a questionnaire, test or survey may be held temporarily on our Google Drive system before being transferred to our ATS or HR system. We use Google Forms and other services provided by Google Inc as part of the GSuite applications. In this case, your information may be transferred outside of the EEA to the United States. Google Inc. are registered under the EU/US Privacy Shield mechanism and we have entered into a data processing agreement with Google Inc., who undertake to comply with the GDPR using the EU Model Clauses.

Interviews and Assessments

We will ask you to attend telephone, video and/or face to face interviews to order to assess your suitability for the role. We might also ask you to participate in assessment days; complete tests and/or occupational personality profile questionnaires – or a combination of these. Information will be generated by you and by us. For example, you might complete a written test or we might take interview notes. This information is held by ECD.

If you are unsuccessful following assessment for the position you have applied for, we may ask if you would like your details to be retained in our talent pool for a period of six months. If you say yes, we would proactively contact you should any further suitable vacancies arise. After six months, we would contact you to find out if you would like us to continue to keep your details in our talent pool. If not, or if we do not get a reply from you, your details will be deleted.

Conditional offer

If we make a conditional offer of employment we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer. We are required to confirm the identity of our staff and their right to work in the United Kingdom. We will also seek assurance as to their trustworthiness, integrity and reliability.

You will therefore be required to provide:

  • Proof of your identity – you will be asked to attend our office with original documents, we will take copies.
  • We will contact your referees, using the details you provide in your application, directly to obtain references.
  • We will also ask you to complete a questionnaire about your health. This is to establish your fitness to work and whether you require any reasonable adjustments to assist in your work.

If we make a final offer, we will also ask you for the following:

  • Bank details – to process salary payments
  • Details of other personal information required to comply with our legal requirements, e.g. your national insurance number, date of birth and marital status which we are required to submit to HMRC as part of our payroll process
  • Emergency contact details – so we know who to contact in case you have an emergency at work
  • Proof of your right to work in the UK, for example we may ask to see and take a copy of your passport.

Use of data processors

Data processors are third parties who provide elements of our recruitment and human resources service for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Vacancies and applications

Job board websites

Our vacancies are advertised on the following websites (as well as our own website). If you create a job seeker account and or apply for a vacancy via one of these websites, they will be the data controller in respect of any information you input into their website (including your name, address, work history and so on). Please read their privacy notices as to how they will store and use your data:

Indeed Ireland Operations Limited

A company based in Ireland as part of a US and international group of companies: https://www.indeed.co.uk/legal#privacy

Glassdoor Inc.

A US based company who are signed up to the EU/US Privacy Shield: https://www.indeed.co.uk/legal#privacy

Reed Online Limited:

A UK company as part of an international group of companies: https://www.reed.co.uk/policies#privacyPolicy

Recruitment Agencies

For certain vacancies, we sometimes use the services of a recruitment agency to advertise the role, review applications and carry out assessments including questionnaires and telephone and/or video interviews. Use of a recruitment agency in any relation to any vacancy will always be made clear.

Information collected by a recruitment agency will be retained for 12 months following the end of our agreement.

Working for us

PeopleHR

If you accept an offer of employment from us, your personnel records will be held on PeopleHR which is an internally used HR records system. You will be given your own log in to this system which will allow you to view the majority of the information we hold about you. You will also be able to amend certain information if it is incorrect or becomes out of date (for example if you move house).

Smart Pension

When you start working for us, if you meet the auto-enrolment criteria, we are legally obliged to enrol you into our Workplace Pension Scheme. You will subsequently have the right to opt-out of the scheme if you wish.

In order to meet our obligations, your details will be provided to Smart Pension an auto-enrolment platform who provide our Workplace Pension Scheme. If Smart Pension confirm you are eligible or if you are not eligible but are entitled to join the scheme and have opted to do so, you will be auto-enrolled into the pension scheme. Details provided to Smart Pension will be your name, date of birth, National Insurance number and salary.

Once you join us, you will be given a copy of our Employee Privacy Notice which will set out more information about the personal data process and why.

How long is the information retained for?

If you are successful, the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus 6 years following the end of your employment. This includes your criminal records declaration, fitness to work, records of any security checks and references. We will usually retain information about your name, job title and the dates that you were employed by us for a longer period of time but please refer to our Data Retention Policy for more information.

If you are unsuccessful at any stage of the process, the information you have provided until that point will be retained for 6 months from the closure of the campaign.

Information generated throughout the assessment process, for example interview notes, is retained by us for 6 months following the closure of the campaign.

Equal opportunities information is retained for 6 months following the closure of the campaign whether you are successful or not.

How we make decisions about recruitment

Final recruitment decisions are made by hiring managers and members of our recruitment team. All of the information gathered during the application process is taken into account.

You are able to ask about decisions made about your application by speaking to your contact within our recruitment team or by emailing recruitment@ecigarettedirect.co.uk

Your Rights As A Data Subject

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

  • Right of access – you have the right to request a copy of the information that we hold about you.
  • Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
  • Right to be forgotten (also known as the Right to Erasure – in certain circumstances you can ask for the data we hold about you to be erased from our records.
  • Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
  • Right of portability – you have the right to have the data we hold about you transferred to another organisation.
  • Right to object – you have the right to object to certain types of processing such as direct marketing.
  • Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
  • Right to judicial review: in the event that refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in clause 3.6 below.

All of the above requests will be forwarded on should there be a third party involved in the processing of your personal data.

If you need any more information or guidance about your rights, you can find this here on the ICO’s website: https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

Access To Personal Information

We try to be as open as we can be in terms of giving people access to their personal information. Web customers can view much of the information we hold about you in your online account. Individuals can find out if we hold any personal information by making a ‘data subject access request’ under the Data Protection Act 2018. If we do hold information about you we will:

  • Give you a description of it;
  • Tell you why we are holding it;
  • Tell you who it could be disclosed to; and
  • Let you have a copy of the information in an intelligible form.

To make a request for any personal information we may hold about you, you need to put the request in writing addressing it to our Data Protection team, or writing to the address provided below. Before complying with your request, we will need to confirm your identity as far as reasonably possible. For example, we may ask you to confirm details so we can check it against the data we hold.

If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

If we do hold information about you, you can ask us to correct any mistakes by, once again, contacting our Data Protection team.

Right To Be Forgotten/Right To Erasure

If you wish to exercise your right to have your personal data deleted from our records (subject to certain restrictions as set out in the Data Protection Act 2018), please refer to our Right to Erasure Policy here and complete this form.

We have one calendar month from your request (or receipt of further information if required). Completing this form will help us locate and remove your data as quickly as possible.

Complaints Or Queries

We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of ECD’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

If you want to make a complaint about the way we have processed your personal information or if we have not been able to assist with your queries, you can contact the Information Commissioner’s Office which is the statutory body which oversees data protection law – www.ico.org.uk/concerns.

Links To Other Websites

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

Changes To This Privacy Notice

We keep our privacy notice under regular review. This privacy notice was last updated on the date shown at the top of this page

How To Contact Us

If you want to request information about our privacy Notice you can email us at privacy@ecigarettedirect.co.uk or write to:

Data Protection Team
RDN Group Limited
Units 4-5 Bell Court
Felinfach
Fforestfach
Swansea
SA5 4HP