Privacy Policy

This Privacy Policy explains what personal data we collect when you visit hazecartel.com, why we collect it, how we use it, who we share it with, and what rights you have over it. By using the site you agree to the practices described below.

1. Who we are

Haze Cartel is the "data controller" for the personal data we collect through this site. We're a UK-based online head shop selling smoking accessories to adults aged 18 and over. For any privacy queries, please contact us.

2. What data we collect

We only collect data we genuinely need. That includes:

• Account & order details — name, email address, phone number, billing and delivery addresses, order history.
• Payment information — handled directly by Shopify Payments and our card providers. We never see or store your full card number.
• Age verification data — confirmation that you are 18+ and, where required, the result of an electronic age check.
• Communications — emails, contact form submissions and customer service messages.
• Technical & usage data — IP address, device and browser type, pages viewed, referring URL and similar information collected via cookies (see our Cookie Policy).
• Marketing preferences — if you sign up to our newsletter, the email address you give us and whether you've opted in or out.

3. Why we collect it & our legal basis

• To fulfil your order — process payment, ship products and handle returns. Legal basis: performance of a contract.
• To verify your age and prevent sales to minors. Legal basis: legal obligation and our legitimate interest in complying with UK law. See Age Verification.
• To run and improve the site — security, analytics, fixing bugs, preventing fraud. Legal basis: our legitimate interests.
• To send marketing — only if you've opted in. Legal basis: your consent (which you can withdraw at any time).
• To meet our legal obligations — for example HMRC tax records and Trading Standards enquiries. Legal basis: legal obligation.

4. How we use your data

We use the data above to confirm and dispatch your orders, keep you updated on shipping, handle returns and refunds, answer your questions, run age checks, prevent fraud and abuse, personalise your experience on the site, and (with your consent) send you occasional emails about new arrivals and offers.

5. Who we share it with

We don't sell your data. We share it only with trusted partners who help us run the shop:

• Shopify — hosts the store and processes orders and payments.
• Payment providers — Shopify Payments, PayPal, Apple Pay and Google Pay.
• Couriers — Royal Mail, DPD and DHL, to deliver your order.
• Age-verification providers — to confirm eligibility where required.
• Email & analytics tools — for transactional emails and aggregated site analytics.
• Authorities & legal advisers — where we're legally required, for example HMRC or Trading Standards.

Every partner is bound by contract to handle your data securely and only for the purpose we've engaged them for. Where data is processed outside the UK, we use UK-approved safeguards such as the UK International Data Transfer Addendum.

6. How long we keep it

• Order & tax records — kept for at least 6 years to meet UK accounting law.
• Account data — kept for as long as your account is active, then deleted on request.
• Marketing data — kept until you unsubscribe, then removed from active mailing lists.
• Support emails — typically kept for 2 years for quality and dispute purposes.
• Analytics & cookie data — see our Cookie Policy.

7. How we protect your data

The site runs over HTTPS, payments are PCI-DSS compliant via Shopify, and access to customer data is restricted to staff who need it. No system is ever 100% secure, but we take reasonable steps to keep your data safe and to detect and respond to any incident.

8. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten") where we no longer need it;
• restrict or object to certain types of processing, including direct marketing;
• receive your data in a portable format;
• withdraw consent for marketing at any time;
• complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, just contact us — we'll respond within one calendar month.

9. Cookies

We use cookies and similar technologies to make the site work, remember your age verification, keep your cart between visits, and understand how visitors use the shop. Full details, including how to control them, are in our Cookie Policy.

10. Children's data

Haze Cartel is strictly 18+ and not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a child has provided us with personal data, please contact us and we'll delete it.

11. Changes to this policy

We may update this policy from time to time. The version on this page is the current one, with the date at the top. Material changes will be flagged on the site or by email if you have an account with us.

12. Contact us

Questions about this policy, your data or your rights? Head to Contact Us. For related documents, see our Terms & Conditions, Cookie Policy and Age Verification policy.