Privacy Policy

Effective date: 2 November 2026

This policy explains how SMOKE CALI LTD (“Smoke Cali”, “we”, “us”) collects and uses personal data when you use smokecali.co.uk, buy from us, order on WhatsApp, email us or visit our shop. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

The data controller is SMOKE CALI LTD, a company registered in England and Wales (Company No. 16543027), trading as Smoke Cali, of 5 Sagar Street, M8 8EU, Manchester, United Kingdom.

For any privacy question or to exercise your rights, contact our director, Kuldeep Singh, at smokecaliltd@gmail.com, by phone or WhatsApp on 07473 108067, or by post to the address above. We are not required to appoint a Data Protection Officer.

2. Personal data we collect

When you check out online:

• Identity and contact details: full name, email address and phone number.
• Delivery details: address, town/city and postcode, and any order notes you add.
• Order details: the products, quantities and totals in your order.
• Payment and billing details: you enter your card details directly on the secure payment page of our payment provider, Viva.com. We do not see or store your card number, expiry date or security code; Viva.com confirms to us whether your payment succeeded, the amount, and a payment reference.

When you order or message us on WhatsApp: your name, phone number, WhatsApp profile and the contents of your messages (for example the items you want and your delivery address).

When you use our contact or custom-order forms or email us: these forms do not send data to our servers — they open your own email app with a pre-filled message to us. We receive what you choose to send, such as your name, email, phone number, message and any artwork files.

When you browse the website: our hosting and checkout providers automatically process technical data such as your IP address, browser type and the pages requested, to deliver and secure the site. We do not use analytics, advertising or tracking tools.

Accounts: we do not offer customer accounts. You check out as a guest, so we hold no passwords.

3. How we use your data and our lawful bases

You must give us your name, contact details and delivery address for us to fulfil an order. We do not make decisions about you based solely on automated processing, and we do not profile you.

4. Who we share your data with

We never sell your personal data. We share it only with these service providers, who act on our instructions, and as required by law:

• Viva.com (our payment service provider): processes your card payment, carries out fraud prevention and security checks, and confirms payment to us. Viva.com receives your name, email address, order amount and payment details, and is an independent controller for the data it uses to run the payment and meet its own legal duties, under its own privacy policy.
• Cloudflare, Inc.: runs the secure checkout service that creates your payment with Viva.com and notifies us of paid orders.
• Resend (email delivery) and Zapier (workflow automation): where enabled, used to send us notifications of new paid orders, including your name, contact details, address and order.
• Google (Gmail): our business email account, where your emails and order notifications are stored.
• WhatsApp / Meta: if you choose to contact or order via WhatsApp.
• GitHub, Inc.: hosts the website and processes technical request data such as IP addresses.
• Couriers: your name, address and phone number, to deliver your parcel.
• Our accountants, professional advisers, HMRC, the police or other authorities where required by law or to protect our rights.

5. International transfers

Several of our providers (Cloudflare, Resend, Zapier, Google, Meta and GitHub) are based in, or may process data in, the United States or other countries outside the UK. Viva.com is based in the European Economic Area, which the UK recognises as providing adequate data protection, and may use service providers in other countries under its own safeguards. Where this happens, we rely on UK adequacy regulations (including the UK–US “data bridge” for certified companies) or the ICO’s International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses included in the providers’ data processing terms. Contact us for more information.

6. How long we keep your data

• Order, payment and invoice records: 6 years from the end of the financial year of the order, to meet UK tax and company law.
• Enquiries, emails and WhatsApp chats not leading to an order: up to 2 years, then deleted.
• Browser storage (basket, age confirmation): stays on your device until you clear it; we cannot access it.
• Hosting and security logs: kept by our providers for their standard, short periods.

7. Your rights

Under UK data protection law you have the right to:

• Access: get a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted where there is no good reason for us to keep it (we must keep some order records by law).
• Restriction: ask us to limit how we use your data, for example while a correction is checked.
• Portability: receive data you gave us under contract in a structured, machine-readable format, or have it sent to another organisation.
• Objection: object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent: where we rely on consent, at any time, without affecting earlier processing.

To exercise any right, email smokecaliltd@gmail.com. We will respond within one month (extendable by two months for complex requests). It is normally free. We may need to confirm your identity first.

8. Cookies and similar technologies

We do not use analytics, advertising or tracking cookies. We use your browser’s storage only for things that are strictly necessary for the service you request, which PECR allows without consent:

When you pay, the Viva.com payment page sets its own cookies for security and fraud prevention under Viva.com’s cookie policy. Links to WhatsApp, Google Maps, Facebook, Instagram, TikTok and YouTube take you to third-party sites with their own privacy and cookie policies. You can clear site storage at any time in your browser settings.

9. Marketing

We do not send marketing emails or messages. If we start, we will only do so in line with PECR — with your consent, or to existing customers about similar products with a simple way to opt out in every message — and we will update this policy first.

10. Age restriction and children

Our website and products are for adults aged 18 or over only. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

11. Security

The website and checkout use HTTPS encryption. Card payments are handled by Viva.com, a regulated payment provider that must meet card industry security standards (PCI DSS), so card details never reach us. We restrict access to order records and our email account. No online system is completely secure; if a breach occurs that is likely to put you at risk, we will tell you and the ICO as the law requires.

12. Complaints

Please contact us first at smokecaliltd@gmail.com so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk, helpline 0303 123 1113, or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13. Changes to this policy

We may update this policy when our services or the law change. The latest version is always on this page with its effective date. Significant changes will be highlighted on the website. See also our Terms & Conditions.