ZERO VAPE PRIVACY POLICY
Your privacy, clearly explained.
CONTENTS
- 01 Who we are
- 02 Scope
- 03 Personal information we collect
- 04 How we use personal information
- 05 Legal bases
- 06 Cookies and similar technologies
- 07 When we disclose personal information
- 08 Payment and blockchain privacy
- 09 International transfers
- 10 How long we retain information
- 11 Security
- 12 Your rights and choices
- 13 Adults only and children's information
- 14 Marketing communications
- 15 Automated decisions
- 16 Third-party links and services
- 17 Changes to this Policy
- 18 Contact and complaints
Who we are
This Privacy Policy explains how 北杭科技有限公司, trading as ZERO Vape ("ZERO Vape", "we", "us" or "our"), collects, uses, discloses and protects personal information when you visit https://zerovape.shop, create or use an account, place or enquire about an order, contact us, or otherwise use our website and related services (together, the "Services").
Controller details
- Legal name: 北杭科技有限公司
- Trading name: ZERO Vape
- Company/registration number: 92654023MAKB70A72T
- Registered country or region: China
- Registered address: Futian District, Shenzhen, Guangdong Province, China
- Privacy correspondence address: Futian District, Shenzhen, Guangdong Province, China
- Privacy contact: support@zerovape.shop
At the date of this Policy, we do not identify a separately appointed EU or UK data-protection representative on the website. You may contact us directly using the details above. If applicable law requires us to appoint a local representative for processing we undertake, we will publish that representative's contact details.
Scope
This Policy applies to personal information processed through the Services. It does not govern an independent third-party website, app or service merely because we link to it. Those third parties process information under their own privacy notices.
Our products and Services are intended only for adults who have reached the legal smoking or vaping age in their location. Section 13 explains our age-related practices.
Orders may currently be accepted for delivery to Germany, France, Italy, Spain, Portugal, the Netherlands, Poland, Sweden, the Czech Republic, Slovakia, Austria, Greece, Belgium, Finland, Denmark, Ireland, Luxembourg, Hungary, Romania, Slovenia, Croatia, Estonia, Lithuania, Latvia, Cyprus, Malta, Bulgaria, Canada, Australia, the United States and Vietnam. Availability remains subject to destination-specific product, age, carrier and legal restrictions.
Personal information we collect
The information we collect depends on how you interact with us.
3.1 Information you provide
You may provide:
- Account information: name, username, email address, password in hashed form, account preferences and communication settings. We do not have access to your plain-text password.
- Age and eligibility information: an age-gate response, date of birth, age-verification result or other eligibility information where a check is required. The information requested and the method used will be shown at the point of collection.
- Order and delivery information: products selected, billing and delivery names and addresses, telephone number, email address, delivery instructions, order history, returns and warranty communications.
- Payment-related information: the payment method selected and transaction, status, fraud-prevention or refund information needed to process an order. If cryptocurrency is offered, this may include the asset or currency, wallet address, payment network, transaction hash, full payment amount and confirmation status.
- Customer-service information: messages, attachments, complaint details, return requests, reviews or other information you choose to send us.
- Marketing preferences: whether you have asked to receive or stop receiving promotional communications.
Please do not send identity documents, health information or other sensitive information unless we specifically request it through an appropriate process and explain why it is needed.
Our voluntary return window, quality-claim period and device-warranty period are 180 days from delivery, subject to the eligibility rules in our Terms of Service. Opened e-liquids, opened pods, used mouthpieces and other hygiene-sealed goods are not returnable for a non-quality reason. Cryptocurrency purchases are not eligible for a voluntary non-quality refund. These commercial rules do not limit rights that mandatory consumer law gives you. If you make a return or quality-related claim, we may process the claim details and reasonable supporting information needed to assess and resolve it.
3.2 Sign in with Google
We may offer Sign in with Google through My Account. When it is enabled and you choose to use it, Google authenticates you and sends us information permitted by the scopes you approve. We limit the requested scopes to:
openid, which lets us associate the authentication response with a unique Google Account identifier;email, which may provide your primary Google Account email address and its verification status; andprofile, which may provide basic profile information such as your name, profile image and locale, depending on what Google returns and what you have made available.
We use this information to authenticate you, create or access your ZERO Vape account, protect the account and, where the email address and security checks match, link the sign-in method to an existing account. A first Google sign-in may create a WooCommerce account with the Customer role. If an email address is already associated with a ZERO Vape account, we may require confirmation or authentication to that account before linking it.
We do not request access through Google sign-in to your contacts, Gmail, Google Drive, calendar, Google payment data or Google password. We do not receive your Google password. Signing in with Google does not subscribe you to marketing.
You can manage third-party connections in your Google Account. Removing the connection stops that sign-in method but does not automatically cancel orders, delete your ZERO Vape account or erase records we must retain. To request account deletion, email support@zerovape.shop with the subject Privacy Request.
ZERO Vape's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including applicable Limited Use requirements.
3.3 Information collected automatically
When you use the Services, our systems and service providers may collect:
- IP address, browser type, operating system, device type, language and approximate location derived from IP;
- pages viewed, referring page, timestamps, clicks, cart and checkout events, and diagnostic information;
- authentication, security, fraud-prevention and server-log information;
- cookie and similar-technology identifiers; and
- consent choices and, where an age-gate feature is enabled, its status stored in a cookie or local storage.
3.4 Information from other sources
We may receive relevant information from identity, payment, delivery, fulfilment, security, fraud-prevention, age-verification and customer-support services, as well as public authorities, but only as needed for the purposes described in this Policy.
How we use personal information
We may use personal information to:
- provide, maintain and secure the website, cart, checkout and customer account;
- authenticate users, including through Google when enabled, and prevent unauthorised access;
- verify full payment, process and fulfil orders, arrange Delivered Duty Paid (DDP) delivery, and administer eligible returns, quality claims, warranties and refunds;
- verify eligibility, legal age or destination restrictions where required;
- communicate about an account, order, delivery, support request, safety notice or policy change;
- maintain transaction, tax, accounting, warranty and compliance records;
- detect, investigate and prevent fraud, abuse, chargebacks, security incidents and unlawful purchases;
- respond to lawful requests and enforce our Terms of Service;
- improve usability, performance, product presentation and customer support using aggregated or appropriately minimised information; and
- send marketing only where permitted and in accordance with your choices.
We do not use Google sign-in data for advertising, sell it, or use it for a purpose unrelated to authentication and account administration without clear notice and any consent required by law.
Legal bases
Where UK or EEA data-protection law applies, we rely on one or more of the following legal bases:
- Contract: to create and administer an account, take steps at your request, process an order, arrange delivery, handle returns and provide customer support.
- Legal obligation: to keep required tax and accounting records, respond to valid legal requests, and comply with product, consumer and age-restriction rules.
- Legitimate interests: to secure the Services, prevent fraud, understand basic site performance, defend legal claims and operate an efficient retail business, where those interests are not overridden by your rights.
- Consent: for optional cookies, certain marketing and other processing for which applicable law requires consent. You may withdraw consent at any time without affecting processing already carried out lawfully.
Where another privacy law applies, we process information under the authority or conditions permitted by that law.
Cookies and similar technologies
We use cookies and similar technologies for the following purposes:
- Strictly necessary: security, network operation, account login, cart contents, checkout, fraud prevention, consent records and, where enabled, age-gate state.
- Preferences: remembering language, region and interface choices.
- Analytics: understanding how the Services perform and are used, where such tools are enabled and, when required, only after consent.
- Advertising or social media: measuring or personalising campaigns only if such tools are enabled and any legally required consent has been obtained.
Some cookies last only for the browser session; others remain for the period reasonably required for their stated purpose or until you remove them. Where applicable law requires consent for a non-essential cookie, we will seek that consent before using it. You can also manage cookies through your browser. Blocking necessary cookies may prevent login, cart or checkout functions from working.
When we disclose personal information
We may disclose the minimum information reasonably necessary to:
- Hosting, website and account service providers that support our website, commerce functions, security, backups, email or customer service;
- Identity providers, including Google when you choose Google sign-in;
- Payment providers and financial institutions to authorise, settle, refund and investigate transactions;
- Age-verification and fraud-prevention services, where used;
- Warehouses, carriers, customs agents and fulfilment partners to deliver orders under DDP terms and resolve delivery issues;
- Professional advisers such as lawyers, accountants, insurers and auditors;
- Government bodies, regulators, courts or law enforcement where disclosure is legally required or necessary to protect rights, safety and the integrity of the Services; and
- A successor organisation in connection with a genuine merger, financing, reorganisation or sale, subject to appropriate confidentiality and legal safeguards.
We do not sell personal information for money. If our future use of analytics or advertising technology constitutes a "sale", "sharing" or targeted advertising under applicable law, we will provide the required notice and opt-out choice before or when that practice begins.
Payment and blockchain privacy
We require orders to be paid in full before acceptance. Payment services offered at checkout may independently process identity, device, transaction and fraud-prevention information under their own privacy notices. We receive or retain only the information reasonably necessary to confirm, fulfil, record, investigate or refund a transaction.
Where cryptocurrency is offered, we may receive or record the wallet address, network, asset or currency, full payment amount, transaction hash, status and verification information needed to confirm the order. Information recorded on a public blockchain may be visible worldwide, permanently retained by the network and outside our ability to alter or delete.
Our commercial policy does not provide a voluntary cryptocurrency refund for a non-quality reason. Where a verified quality issue qualifies for a remedy, we process the information reasonably needed to provide repair, replacement or a full refund, subject to our Terms of Service and rights that cannot lawfully be excluded.
International transfers
We are established in China and serve customers in multiple countries. We and our service providers may therefore process personal information outside the country where you live. Privacy laws in those countries may differ.
Where applicable law restricts an international transfer, we will take the steps required for that transfer. Depending on the countries and services involved, those steps may include using an applicable adequacy decision, approved contractual clauses or another recognised safeguard, together with supplementary measures where required. You may contact us for information about the safeguards relevant to your personal information.
How long we retain information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including contract performance, account administration, security, fraud prevention, dispute resolution, warranties and legal, tax, accounting or reporting obligations. We then delete or anonymise it unless continued retention is required or permitted by law.
In particular:
- account and Google-linking data is retained while the account is active and afterwards only as necessary for security, legal obligations or dispute resolution;
- order, payment-reference, tax and invoice records are retained for the period required by applicable law;
- incomplete-checkout data is retained only as long as needed to operate the checkout, prevent fraud or provide a service you requested;
- customer-support, return, warranty and complaint records are retained through the applicable 180-day claim period and afterwards only as reasonably necessary for legal, accounting, fraud-prevention or dispute-resolution purposes;
- security and consent records, where generated, are retained only for the limited period reasonably required for their purpose; and
- marketing-suppression information may be retained to ensure that an opt-out continues to be respected.
Google profile information is not retained merely because it is available. It is kept only to the extent necessary for the account and the purposes stated in this Policy.
Security
We use reasonable administrative, technical and organisational measures designed to protect personal information. These include HTTPS encrypted transport for the website and access controls for administrative functions.
No internet transmission or storage system is completely secure. You are responsible for protecting access to your email and Google Account, using a unique password where a password is available, and signing out on shared devices. Contact us promptly if you believe your ZERO Vape account has been compromised.
Your rights and choices
Depending on where you live, you may have rights to:
- access or obtain a copy of personal information;
- correct inaccurate information;
- delete information;
- restrict or object to certain processing;
- receive portable information;
- withdraw consent;
- opt out of marketing, targeted advertising, sale or sharing where applicable;
- appeal a refusal of a privacy request where applicable; and
- complain to a competent data-protection authority.
You may update certain details through My Account. To exercise another right, email support@zerovape.shop with the subject Privacy Request and describe the request. We may need to verify your identity without asking for more information than reasonably necessary. An authorised representative may submit a request where applicable law permits it and may be asked to provide evidence of authority. We will respond within the period required by applicable law and will not discriminate against you for exercising a legal privacy right.
Removing Google access does not, by itself, erase records held by ZERO Vape. To request deletion of your ZERO Vape account and eligible Google-derived account data, contact us as described above. We may retain information that applicable law requires or permits us to keep and will explain any relevant exception.
Adults only and children's information
The Services and products are not directed to children or to anyone below the legal smoking or vaping age in their location. We do not knowingly sell regulated products to, or intentionally collect account information from, such individuals. A parent or guardian who believes an ineligible minor has provided information should contact support@zerovape.shop so we can investigate and take appropriate action.
Google sign-in confirms control of a Google Account; it is not proof that a person has reached the legal age to purchase vaping products. Any required age or delivery check remains separate.
Marketing communications
We send promotional communications only where permitted. You can unsubscribe through the link in a marketing email or by contacting us. We may still send non-marketing messages about an account, order, security event or legal notice.
We do not add a person to marketing merely because that person signs in with Google.
Automated decisions
We may use automated signals to identify fraud, payment or account-security risk. These signals may cause a transaction or account to be held for review. We do not use solely automated decision-making that produces legal or similarly significant effects unless we first provide the notice, explanation and safeguards required by applicable law.
Third-party links and services
The Services may link to Google, payment providers, delivery providers, social platforms or other third parties. Their handling of personal information is governed by their own notices. A link does not make us responsible for an independent third party's privacy or security practices.
Changes to this Policy
We may update this Policy to reflect changes in law, providers or our practices. We will post the updated version and change the "Last updated" date. If a change materially expands how we use personal information, especially Google user data, we will provide additional notice and obtain consent where required before using the information for the new purpose.
Contact and complaints
Questions, complaints and privacy requests can be sent to:
ZERO Vape / 北杭科技有限公司 Company/registration number: 92654023MAKB70A72T Email: support@zerovape.shop Postal address: Futian District, Shenzhen, Guangdong Province, China
You may also have the right to complain to the privacy regulator in the country or region where you live, work or believe an infringement occurred.