Privacy policy
Effective date: 24 February 2026
Last updated: 29 July 2026
Contents
- Scope
- Who We Are (Data Controller)
- Personal Data We Collect
- How We Use Personal Data
- Legal Bases for Processing
- Shopify Platform
- Payment Providers
- Marketing Communications (Klaviyo)
- Cookies, Analytics & Advertising
- AI Tools
- Data Sharing
- International Transfers
- Data Retention
- Security
- Automated Decision-Making
- Your Rights
- Children
- Mobile Application
- Changes to This Policy
Vintage Wholesale Supply Ltd (“we”, “us”, “our”) respects your privacy and is committed to protecting personal data collected through our website, mobile application, and services.
This Privacy Policy explains how we collect, use, share, store, and protect personal data when you visit our website, use our iOS or Android mobile application (“App”), register an account, place orders, interact with our marketing, or contact us.
B2B and B2C Scope
Our services are provided to both business customers (B2B) and individual customers (B2C), including sole traders, resellers, and individuals who have not yet registered a company. We may process personal data relating to individuals acting on behalf of a business as well as individuals acting in their personal capacity.
For the purposes of UK GDPR, personal data relating to sole traders and individuals acting on behalf of a business is treated as personal data.
1. Who We Are (Data Controller)
Vintage Wholesale Supply Ltd is the data controller for personal data processed under this policy.
| Company | Vintage Wholesale Supply Ltd |
|---|---|
| Company number | 14388171 |
| Registered office address | Osbaston House Farm, Lount Road, Nuneaton, England, CV13 0HR |
| support@vintagewholesalesupply.com |
2. Scope
This Privacy Policy applies to:
- Website visitors
- Users of our iOS and Android mobile application
- Registered account holders
- Customers who sign in to the App using Shopify Customer Accounts
- Buyers placing orders or enquiries
- Marketing subscribers
- Individuals who communicate with us
Where this policy refers to “services,” that includes both the website and the App unless otherwise stated.
It does not apply to third-party websites or services linked from our website or App.
3. Personal Data We Collect
We may collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity data | Name, company name, VAT number (where applicable) |
| Contact data | Billing address, shipping address, email address, phone number |
| Transaction data | Order details, order history, returns, refunds, delivery details |
| Financial data | Payment confirmations, transaction references (we do not store full card details) |
| Communications data | Messages sent to us, customer support requests, complaints, dispute communications |
| Technical data | IP address, device identifiers, browser type, operating system |
| Usage data | Pages viewed, interactions, time spent on pages, referral sources |
| Marketing & preference data | Email preferences, consent status, campaign interactions |
Additional App-specific data is described in Mobile Application.
4. How We Use Personal Data
We use personal data to:
- Manage accounts and provide access to our services
- Process and fulfil orders, including delivery and returns
- Provide customer support and respond to enquiries
- Manage payments, refunds, disputes, chargebacks and claims
- Prevent fraud, protect website and App security, and reduce abuse
- Comply with legal and regulatory obligations
- Protect and enforce our legal rights
- Improve our website, App, services, and customer experience
- Send marketing communications where permitted
- Send App push notifications where you have enabled them and, for marketing messages, where permitted
5. Legal Bases for Processing
We rely on the following legal bases under UK GDPR:
| Purpose | Legal basis |
|---|---|
| Order fulfilment, delivery, returns, refunds | Contract |
| Account management and customer service | Contract / Legitimate interests |
| Accounting, tax, statutory record-keeping | Legal obligation |
| Fraud prevention, security, dispute/chargeback handling | Legitimate interests / Legal obligation (where applicable) |
| Marketing emails (existing customers) | Legitimate interests (soft opt-in under PECR) |
| Marketing emails (new subscribers) | Consent |
| Website analytics and advertising measurement | Legitimate interests / Consent where required (via cookie banner/settings) |
| App analytics, crash diagnostics, and push delivery | Contract / Legitimate interests / Consent where required |
6. Shopify Platform
Our store is hosted on Shopify Inc., which provides the e-commerce platform that allows us to sell our products and services. Your data may be stored through Shopify’s data storage, databases and general Shopify applications. Shopify stores data on secure servers behind a firewall. Account sign-in in the App uses Shopify Customer Accounts, as described in Mobile Application.
7. Payment Providers
Payments are processed by third-party providers (for example, Shopify Payments and its supported processors, Stripe, PayPal, or Klarna where available). We do not store full card details. Payment providers process personal data in accordance with their own privacy policies.
8. Marketing Communications (Klaviyo)
We use Klaviyo to manage email marketing communications. We may send marketing communications to customers who have purchased from us (where permitted under PECR) and to individuals who have opted in to receive marketing. You can unsubscribe at any time using the unsubscribe link in our emails or by contacting us.
9. Analytics & Advertising Technologies
We use cookies, pixels and similar technologies for analytics and advertising measurement, including:
- Google Analytics
- Meta Pixel
- TikTok Pixel
- Shopify Analytics
These technologies may be used to measure and improve website performance, understand user interactions, and measure advertising effectiveness. Where required, we only enable non-essential cookies and pixels if you give opt-in consent via our cookie banner/settings.
The App may use separate analytics and crash-reporting tools, as described in Mobile Application.
10. AI Tools
We may use automated tools to help manage customer enquiries and operational workflows (for example, an AI support agent). Where used, these tools are intended to assist our team and improve response times. We apply appropriate safeguards and access controls.
11. Data Sharing
We may share personal data with trusted third parties, including:
- Payment processors and checkout providers
- Delivery, courier and logistics partners
- IT and hosting providers (including Shopify and related apps, and our App backend hosting providers)
- Email marketing platforms (including Klaviyo)
- Analytics and advertising partners (where enabled and consented)
- App analytics and crash-reporting providers
- Apple and/or Google (app distribution and push notification delivery)
- Customer support tools
- Professional advisers (e.g. accountants, solicitors, insurers)
- Authorities or regulators where required by law
We do not sell personal data.
12. International Transfers
Some service providers may process data outside the UK. Where data is transferred internationally, we apply appropriate safeguards in accordance with UK GDPR, such as standard contractual clauses or other lawful mechanisms.
13. Data Retention
We retain personal data only for as long as necessary for contractual, legal and business purposes, including statutory retention requirements.
14. Security
We apply appropriate technical and organisational security measures to protect personal data. However, no system can be guaranteed to be completely secure.
15. Automated Decision-Making
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.
16. Your Rights
You may have rights to:
- Access your personal data
- Correct inaccurate personal data
- Request deletion (in certain circumstances)
- Restrict processing (in certain circumstances)
- Object to processing (in certain circumstances)
- Withdraw consent (where processing is based on consent)
Requests can be made by contacting us using the details above. We may need to verify your identity before responding. We will respond within one month in accordance with UK GDPR.
App users can also start an account deletion request in the App under Account → Settings → Delete account, as described in Mobile Application.
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).
17. Children
Our services are not intended for children and we do not knowingly collect personal data from children.
18. Mobile Application
This section applies specifically to our iOS and Android App.
What we collect through the App
In addition to the categories described above, when you use the App we may process:
- Account and profile data associated with your Shopify customer account (such as name, email, company details, addresses, and order history), accessed via Shopify’s Customer Account / storefront systems after you sign in
- Authentication tokens needed to keep you signed in
- Device and app identifiers used for security, diagnostics, and (where enabled) push notifications (including Apple Push Notification service and Firebase Cloud Messaging tokens)
- App usage and performance data through analytics and crash-reporting tools we use in the App (for example product analytics and crash diagnostics providers)
- Information you choose to provide in support requests (including optional photo attachments)
We do not ask the App to access your contacts, precise location, or photo library except where you explicitly grant access for a feature (for example attaching an image to a support message).
Sign-in
Account sign-in in the App uses Shopify New Customer Accounts (hosted login). You may sign in with an email one-time code and, where offered by Shopify, Shop login. Authentication is handled by Shopify; we receive the account information needed to operate your shopping account in the App (for example identity, orders, and addresses).
Push notifications
If you enable notifications, we store a device push token and may associate it with your customer account while you are signed in so we can send order, stock, and (where you have opted in) marketing messages. You can change notification preferences in the App or in your device settings. Signing out or deleting your account unlinks your account from that device’s token for account-related messaging.
Analytics and crash reporting in the App
The App may use third-party analytics and crash-reporting SDKs to understand stability and how features are used. These providers process device and usage information on our behalf. Details of categories collected are also reflected in our App Store / Google Play privacy disclosures.
Account deletion
If you have created or signed in to an account in the App, you can request deletion of your account from within the App:
Account → Settings → Delete account
You will be asked to confirm (including typing DELETE) before the request is submitted. We will sign you out of the App and submit a personal-data erasure / account deletion request through Shopify’s systems. Personal data is not erased immediately. Shopify typically processes erasure ~10 days after the request is submitted. Shopify redacts personal information such as name and address; certain commerce records (for example what was sold and when) may remain in redacted form where required for legal, accounting, or fraud-prevention purposes. Once processing completes, erasure cannot be undone. If you submitted a request by mistake, contact us within that 10-day window so we can attempt to cancel the pending request.
You may also request deletion by emailing support@vintagewholesalesupply.com. We will verify your identity before acting on email requests.
Third parties relevant to the App
In addition to parties listed elsewhere in this policy, App-related processing may involve:
- Shopify Inc. (store platform, customer accounts, checkout)
- Apple and/or Google (app distribution, push delivery, device services)
- Payment and checkout providers configured on our Shopify store
- Analytics and crash-reporting providers used in the App
- Customer support tools
- Our application hosting / backend providers
We do not sell your personal data.
19. Changes to This Policy
We may update this Privacy Policy from time to time. The latest version will always be available on our website.