Privacy Policy

ELF BAE LTD – Privacy Policy

Last updated: August 2026

Welcome to ElfBae.com.

This Privacy Policy explains how ELF BAE LTD collects, uses, stores, shares and protects your personal information when you visit or use ElfBae.com, create an account, make a purchase, apply for a wholesale account, contact us or otherwise interact with our business.

ELF BAE operates as both a retailer and wholesale supplier, so this Privacy Policy applies to:

  • retail customers;
  • wholesale and trade customers;
  • prospective customers;
  • website visitors;
  • individuals acting on behalf of businesses;
  • suppliers and business contacts; and
  • anyone who communicates with ELF BAE.

We take your privacy seriously and are committed to handling personal information fairly, lawfully and transparently.

For the purposes of applicable UK data-protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, ELF BAE LTD is the data controller of personal information covered by this Privacy Policy unless otherwise stated.

This means that we determine how and why your personal information is processed.

1. Who We Are

ELF BAE LTD
Company Number: 14468196

Registered Office:

44 Century Square
Peterborough
England
PE1 3FR

Website: ElfBae.com

If you have questions about this Privacy Policy or how we use your personal information, please contact us through the contact details provided on ElfBae.com.

2. The Personal Information We Collect

The personal information we collect depends on how you interact with ELF BAE.

We may collect information directly from you, automatically through our website or from trusted third parties involved in providing our services.

Information You Provide to Us

This may include:

  • your full name;
  • email address;
  • telephone number;
  • billing address;
  • delivery address;
  • date of birth or age-verification information;
  • account username and login information;
  • order information;
  • products purchased;
  • customer-service enquiries;
  • communications with us;
  • returns and refund information;
  • marketing preferences;
  • competition or promotional-entry information;
  • reviews or feedback;
  • loyalty or rewards information;
  • information you voluntarily provide when communicating with us; and
  • information required to establish or maintain a wholesale account.

3. Wholesale and Business Customer Information

If you apply for or use a wholesale or trade account, we may additionally collect information including:

  • business name;
  • company number;
  • trading name;
  • registered or trading address;
  • business email address;
  • business telephone number;
  • VAT number;
  • names and contact details of directors, owners, employees or authorised buyers;
  • delivery locations;
  • purchasing history;
  • trade-account status;
  • invoices and transaction records;
  • payment and account information;
  • information required to assess or manage a trade account; and
  • correspondence relating to your business relationship with ELF BAE.

Where a business provides us with information relating to its directors, employees or representatives, that information may constitute personal data and will be handled in accordance with this Privacy Policy.

4. Payment Information

When you make a purchase, payment information will be processed by us and/or our authorised payment providers.

Depending on the payment method used, this may include:

  • cardholder name;
  • billing address;
  • payment method;
  • payment transaction information; and
  • limited payment-card information.

Full card information may be processed directly by our payment provider rather than stored by ELF BAE.

Payment providers operate under their own security and privacy requirements.

We use payment information for purposes including:

  • processing transactions;
  • issuing refunds;
  • preventing fraud;
  • resolving payment disputes; and
  • maintaining financial and accounting records.

5. Information Collected Automatically

When you visit ElfBae.com, certain information may be collected automatically.

This may include:

  • Internet Protocol (IP) address;
  • browser type and version;
  • device type;
  • operating system;
  • time zone;
  • approximate location derived from technical information;
  • pages viewed;
  • products viewed;
  • links clicked;
  • referring website;
  • time spent on pages;
  • shopping-basket activity;
  • checkout activity;
  • website errors;
  • session information; and
  • information collected through cookies or similar technologies.

We use this information to operate the website, understand how customers use ElfBae.com, maintain security and improve our services.

Where cookies or similar technologies require your consent, they will only be used in accordance with the choices you make through our cookie-management system.

6. How We Collect Your Information

We may collect information when you:

  • visit ElfBae.com;
  • create an account;
  • place an order;
  • make a payment;
  • apply for a wholesale account;
  • communicate with our customer-service team;
  • contact us through email, telephone, social media or website messaging;
  • sign up for marketing;
  • participate in a promotion or competition;
  • leave a product review;
  • request a return or refund;
  • participate in a loyalty or rewards programme;
  • interact with our advertising;
  • complete age verification; or
  • otherwise interact with ELF BAE.

We may also receive personal information from third parties such as payment providers, delivery companies, fraud-prevention services and age-verification providers where necessary.

7. How We Use Your Personal Information

We only process personal information where we have a lawful basis for doing so.

Depending on the circumstances, we may rely on:

  • performance of a contract;
  • legal obligation;
  • legitimate interests;
  • consent; or
  • vital interests where appropriate.

8. Where Processing Is Necessary for a Contract

We may process your personal information where it is necessary to enter into or perform a contract with you.

Examples include using your information to:

  • create and administer your account;
  • process an order;
  • process payment;
  • deliver your products;
  • communicate about your order;
  • process returns;
  • provide refunds;
  • respond to warranty enquiries;
  • administer wholesale accounts;
  • manage trade orders;
  • provide customer support; and
  • provide services you have requested from us.

Without certain information, we may be unable to fulfil an order or provide a requested service.

9. Where We Have a Legal Obligation

We may process personal information where necessary to comply with legal or regulatory obligations.

This may include:

  • age verification;
  • financial and tax record keeping;
  • responding to lawful requests from regulators;
  • assisting law-enforcement agencies where legally required;
  • complying with court orders;
  • complying with product-safety obligations;
  • maintaining appropriate transaction records;
  • handling data-protection requests;
  • complying with consumer-protection requirements; and
  • maintaining records required by applicable legislation.

10. Where We Rely on Legitimate Interests

We may process your information where doing so is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

These purposes may include:

Operating and Improving ELF BAE

We may use information to:

  • manage and improve ElfBae.com;
  • analyse website performance;
  • understand customer behaviour;
  • understand product demand;
  • improve our product range;
  • improve customer service;
  • develop new products or services;
  • maintain accurate records; and
  • improve our retail and wholesale operations.

Customer Service

We may process information to:

  • respond to enquiries;
  • investigate complaints;
  • manage disputes;
  • assist customers with orders;
  • maintain records of communications; and
  • provide after-sales support.

Security and Fraud Prevention

We may process information to:

  • protect customer accounts;
  • detect suspicious transactions;
  • prevent fraud;
  • investigate misuse of ElfBae.com;
  • protect our systems;
  • protect our legal rights; and
  • prevent criminal activity.

Business Administration

We may process information for:

  • accounting;
  • record keeping;
  • business analysis;
  • stock planning;
  • internal reporting;
  • legal claims;
  • corporate restructuring;
  • potential sale or acquisition of a business or assets; and
  • protecting or enforcing our contractual rights.

11. Consent

We may rely on your consent where required by law.

Examples may include:

  • certain email or SMS marketing;
  • non-essential cookies;
  • personalised advertising technologies; and
  • particular promotional activities.

Where we rely on consent, you can withdraw that consent at any time.

Withdrawing consent will not affect the lawfulness of processing carried out before your consent was withdrawn.

12. Age Verification

Because ELF BAE sells age-restricted vaping and nicotine products, we may need to verify that retail customers meet the applicable legal age requirement before completing a purchase.

We may use information including:

  • your name;
  • date of birth;
  • address;
  • contact information; and
  • other information reasonably required to verify your age or identity.

We may use an independent age-verification provider to conduct these checks.

Where necessary, information you provide may be checked against reliable independent data sources.

In some circumstances, additional verification may be required.

If we are unable to verify that you satisfy the applicable age requirement, we may prevent or cancel the purchase of age-restricted products.

We aim to collect only the information reasonably necessary to complete age verification.

13. Automated Decision-Making

Certain systems used by ELF BAE or our service providers may automatically assess information for purposes such as:

  • age verification;
  • fraud detection;
  • transaction security; and
  • payment authorisation.

For example, an automated age-verification service may determine whether the information provided is sufficient to confirm that a customer meets the legal minimum age.

Where applicable law gives you rights in relation to a decision based solely on automated processing that produces legal or similarly significant effects, those rights will apply.

You may contact us if you have questions about an automated decision concerning you.

14. Marketing

Where permitted by law, we may use your information to tell you about:

  • new products;
  • promotions;
  • special offers;
  • product launches;
  • loyalty rewards;
  • ELF BAE news; and
  • other relevant products or services.

Marketing may be sent by methods including:

  • email;
  • SMS;
  • social media; and
  • other permitted electronic communications.

We will only send electronic marketing where we have an appropriate lawful basis.

Where consent is required, we will ask you to opt in.

15. Wholesale Marketing

Different rules may apply to business-to-business communications depending on the recipient and method of communication.

We may contact existing or prospective trade customers about ELF BAE wholesale products, pricing, promotions or services where permitted by law.

Individuals always retain applicable rights under data-protection and electronic-marketing legislation.

16. Opting Out of Marketing

You can stop receiving marketing communications at any time.

You can normally do this by:

  • clicking the unsubscribe link contained in an email;
  • using an available preference centre;
  • following opt-out instructions included with the communication; or
  • contacting ELF BAE.

We may retain limited information on a suppression list after you unsubscribe.

This allows us to remember that you do not want to receive marketing rather than accidentally adding you back to a marketing list.

Opting out of marketing does not prevent us from sending necessary service communications relating to an existing order, account, payment, delivery, product recall or legal matter.

17. Abandoned Basket Communications

If you place products in your basket but do not complete your purchase, we may send you a reminder where legally permitted.

Where consent is legally required for this type of communication, we will only send it where the necessary consent or other lawful basis exists.

You can opt out of marketing communications at any time.

18. Cookies and Similar Technologies

ElfBae.com may use cookies, pixels and similar technologies.

Cookies are small files or pieces of information stored on your device when you use a website.

We may use cookies for purposes including:

Strictly Necessary Cookies

These help operate essential website functions such as:

  • maintaining your shopping basket;
  • processing checkout;
  • maintaining account sessions;
  • security;
  • fraud prevention; and
  • remembering privacy choices.

These cookies may not require consent where they are strictly necessary to provide the service requested.

Analytics Cookies

These help us understand:

  • how visitors use our website;
  • which pages are most popular;
  • how visitors navigate through the website; and
  • how we can improve the customer experience.

Marketing Cookies

Where permitted and where you have provided the necessary consent, cookies or similar technologies may be used to:

  • measure advertising;
  • understand campaign performance;
  • provide personalised advertising; and
  • understand engagement with marketing.

You can manage available cookie choices through our cookie-management system.

Please see our separate Cookie Policy for further information.

19. Sharing Your Personal Information

We do not sell your personal information.

We may share your personal information with trusted organisations where necessary to operate our business and provide our services.

These may include:

  • payment processors;
  • banks and financial institutions;
  • delivery and courier companies;
  • warehousing and fulfilment providers;
  • age-verification providers;
  • fraud-prevention providers;
  • website and e-commerce providers;
  • hosting providers;
  • IT and cybersecurity providers;
  • customer-service platforms;
  • marketing providers;
  • analytics providers;
  • accountants;
  • auditors;
  • insurers;
  • legal advisers;
  • professional advisers; and
  • regulators, courts or law-enforcement agencies where required.

We only provide third parties with information reasonably necessary for the relevant purpose.

Where required, organisations processing information on our behalf are subject to contractual data-protection obligations.

20. Delivery Providers

To deliver your order, we may provide relevant personal information to our delivery partners.

This may include:

  • your name;
  • delivery address;
  • telephone number;
  • email address;
  • delivery instructions; and
  • information necessary for age-restricted delivery where applicable.

Delivery companies may process certain information as independent data controllers under their own privacy policies.

21. Payment Providers

Payment transactions may be processed by third-party payment providers.

These providers may receive information necessary to:

  • authorise payment;
  • verify transactions;
  • prevent fraud;
  • issue refunds; and
  • resolve disputes.

Payment providers may operate as independent data controllers for some aspects of their processing.

You should review the privacy information provided by the relevant payment provider where appropriate.

22. Fraud Prevention

We have a legitimate interest in protecting ELF BAE, our customers and payment systems from fraud and misuse.

We may share relevant information with fraud-prevention and payment-security services.

Information considered may include:

  • account information;
  • payment information;
  • delivery address;
  • billing address;
  • IP address;
  • order history;
  • device information; and
  • indicators of potentially suspicious activity.

Where we suspect fraudulent or unlawful activity, we may refuse an order, restrict an account or share relevant information with appropriate authorities where legally permitted.

23. Product Safety and Recalls

If a product you have purchased becomes subject to an important safety notice or recall, we may use your order and contact information to notify you.

Where necessary to protect an individual’s health or safety, this processing may be carried out on the basis of our legal obligations, legitimate interests or vital interests, depending on the circumstances.

24. International Data Transfers

Some of the organisations that provide technology, payment, analytics, marketing, hosting or other services to ELF BAE may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with applicable UK data-protection law.

Depending on the destination and circumstances, these safeguards may include:

  • UK adequacy regulations;
  • approved contractual safeguards;
  • the UK International Data Transfer Agreement;
  • the UK Addendum to approved Standard Contractual Clauses;
  • another legally recognised international transfer mechanism; or
  • an applicable legal exception.

Where necessary, additional safeguards may also be implemented.

25. How We Protect Your Personal Information

We take appropriate technical and organisational measures designed to protect personal information against:

  • unauthorised access;
  • accidental loss;
  • misuse;
  • unauthorised alteration;
  • disclosure;
  • destruction; and
  • other unlawful processing.

Depending on the systems involved, measures may include:

  • access controls;
  • password protection;
  • encryption;
  • secure payment systems;
  • network-security measures;
  • backups;
  • staff access restrictions; and
  • security monitoring.

No method of transmitting information over the internet is completely secure.

While we take reasonable measures to protect personal information, we cannot guarantee absolute security.

26. How Long We Keep Your Information

We only retain personal information for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, accounting, tax and regulatory obligations.

Retention periods depend on the type of information and why we hold it.

For example:

Order and Transaction Records

Information relating to purchases, invoices, payments and financial transactions may be retained for the period required under tax, accounting and other applicable laws.

Customer Accounts

We may retain information while your account remains active and for an appropriate period afterwards where necessary for legal, security, fraud-prevention or record-keeping purposes.

Wholesale Accounts

Trade-account information may be retained throughout our business relationship and afterwards where necessary for accounting, contractual, regulatory or legal purposes.

Marketing Information

We may retain marketing information while you remain subscribed.

If you unsubscribe, we may keep limited details on a suppression list so that we can respect your request not to receive further marketing.

Customer-Service Enquiries

Information relating to enquiries, complaints, returns and disputes may be retained for an appropriate period after the matter has been resolved.

Legal Matters

Information may be retained for longer where reasonably required to establish, exercise or defend legal claims, comply with a regulatory requirement or respond to legal proceedings.

When personal information is no longer required, we will securely delete or anonymise it where appropriate.

We may retain anonymous or aggregated information that no longer identifies an individual for statistical or analytical purposes.

27. Your Data-Protection Rights

Depending on the circumstances, UK data-protection law gives you various rights concerning your personal information.

These may include:

Right of Access

You can ask us whether we process personal information about you and request a copy of that information.

This is commonly known as a Subject Access Request.

Right to Rectification

You can ask us to correct personal information that is inaccurate or complete information that is incomplete.

Right to Erasure

In certain circumstances, you can ask us to delete your personal information.

This right is not absolute and may not apply where we need to retain information to comply with a legal obligation or establish, exercise or defend legal claims.

Right to Restrict Processing

In certain circumstances, you can ask us to restrict how we use your personal information.

Right to Object

You may have the right to object to processing based on our legitimate interests.

You have an absolute right to object to personal information being used for direct marketing.

Right to Data Portability

Where applicable, you may have the right to receive certain information you provided to us in a structured, commonly used and machine-readable format and to request its transfer to another organisation.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights concerning decisions made solely using automated processing that produce legal or similarly significant effects.

Right to Withdraw Consent

Where we rely on your consent, you can withdraw it at any time.

28. Exercising Your Rights

If you would like to exercise a data-protection right, please contact ELF BAE using the contact information available on ElfBae.com.

Please clearly explain:

  • who you are;
  • what right you wish to exercise; and
  • any information that will help us locate the relevant records.

We may need to request reasonable information to confirm your identity before providing personal information or actioning certain requests.

Data-protection requests are normally free of charge.

However, applicable law may allow us to charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

We normally aim to respond within one month, although the law may allow additional time in certain circumstances, such as particularly complex requests.

29. Complaining to the Information Commissioner’s Office

If you have concerns about how ELF BAE processes your personal information, we would appreciate the opportunity to address them first.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator.

You can obtain current contact information and guidance directly from the ICO website.

Making a complaint to ELF BAE first does not affect your right to approach the ICO.

30. Children

ElfBae.com is not intended to facilitate the purchase of age-restricted vaping or nicotine products by children.

We do not knowingly sell age-restricted vaping or nicotine products to anyone below the applicable legal minimum age.

If we reasonably believe that personal information has been provided in connection with an attempted underage purchase, we may process that information where necessary for fraud prevention, regulatory compliance and enforcement of our Terms and Conditions.

31. Social Media

If you interact with ELF BAE through social-media platforms, we may receive information such as:

  • your profile name;
  • social-media handle;
  • comments;
  • messages;
  • reactions; and
  • information you choose to share with us.

The social-media platform itself may separately process information about your activity under its own privacy policy.

We are not responsible for how independent social-media platforms process your information.

32. Reviews and User Content

If you submit a review, testimonial, photograph or other content to ELF BAE, we may use that information for the purpose for which it was submitted.

Where reviews are intended to be displayed publicly, information such as your first name, initials or chosen display name may be visible to other users.

We will obtain consent where legally required for additional promotional uses of identifiable photographs, testimonials or similar material.

33. Competitions and Promotions

If you participate in a competition, giveaway, prize draw or promotion, we may process information necessary to:

  • administer the promotion;
  • verify eligibility;
  • select or contact winners;
  • deliver prizes;
  • prevent misuse; and
  • comply with legal requirements.

Additional privacy terms may be provided for individual promotions where necessary.

34. Wholesale Contacts and Employees

Where our wholesale customer is a company or other organisation, we may hold personal information relating to the people who interact with us on its behalf.

For example, this may include:

  • buyers;
  • directors;
  • store managers;
  • accounts staff;
  • employees; and
  • delivery contacts.

We generally process this information to manage our legitimate business relationship with the organisation concerned.

35. Suppliers and Business Partners

We may process personal information relating to representatives of suppliers, manufacturers, professional advisers and other business partners.

This may include:

  • names;
  • job titles;
  • business contact details;
  • correspondence; and
  • transaction information.

We generally process this information where necessary to manage our commercial relationships and operate ELF BAE.

36. Links to Other Websites

ElfBae.com may contain links to websites operated by third parties.

Once you leave ElfBae.com, those organisations may collect and process information under their own privacy policies.

ELF BAE is not responsible for the privacy practices, security or content of independent third-party websites.

We recommend reviewing their privacy notices before providing personal information.

37. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be required because of:

  • changes to applicable law;
  • changes to regulatory guidance;
  • new products or services;
  • changes to ElfBae.com;
  • new technology;
  • changes to our suppliers or service providers; or
  • changes to the way we process personal information.

The latest version will be published on ElfBae.com and the Last Updated date will be amended accordingly.

Where a material change significantly affects how we use your personal information, we may provide additional notice where appropriate.

38. Contact ELF BAE

If you have questions about:

  • this Privacy Policy;
  • information we hold about you;
  • how your personal information is used;
  • your marketing preferences; or
  • exercising your data-protection rights,

please contact us through ElfBae.com.

For data-protection correspondence by post, you can write to:

Data Protection Enquiries
ELF BAE LTD
44 Century Square
Peterborough
England
PE1 3FR

Company Number: 14468196

Website: ElfBae.com

When contacting us about your personal information, using the subject “Data Protection Enquiry” may help us direct your request appropriately.

Our Commitment to Your Privacy

Whether you are shopping with ELF BAE as an individual customer or purchasing products through a wholesale account, we are committed to treating your personal information responsibly.

We aim to collect only the information we need, use it for clear and legitimate purposes, protect it appropriately and respect your rights under UK data-protection law.

ELF BAE – Retail & Wholesale, with your privacy protected.