Privacy policy

Last updated 15 September 2026.

1. Who we are and how to contact us

Pouch Haus Ltd is the controller of personal information collected through pouchhaus.co.uk, our customer accounts, checkout, Pouch Pay, subscriptions and customer support services.
For privacy questions, requests or complaints, email support@pouchhaus.co.uk. Please write “Privacy request” in the subject line so we can direct it promptly.

2. Personal information we collect

Identity and account data: your name, email address, mobile number, account identifier, sign-in provider and encrypted authentication records.
Contact and delivery data: billing and delivery addresses, postcode, telephone number and delivery instructions you provide.
Order and subscription data: products, quantities, discounts, delivery method, order history, returns, refunds, recurring-order preferences and customer-service correspondence.
Payment data: payment status, amount, currency, transaction reference, payment method and limited card details such as card type and last four digits when supplied by our payment provider. We do not receive or store your full card number or security code.
Pouch Pay and rewards data: balance, top-ups, credits, redemptions, loyalty activity and the related transaction history.
Age-assurance data: your confirmation that you are 18 or over, verification result, method, reference and audit information. We do not intentionally collect more identity data than is needed for the check.
Device and usage data: IP address, browser and device information, cookie identifiers, pages viewed, searches, basket activity, referral source and approximate location derived from IP address.
Marketing and preference data: consent choices, communication preferences, campaign engagement and records of when consent was given or withdrawn.
Support and security data: messages, call or live-chat content, fraud indicators, login activity and records needed to investigate misuse or protect the service.

3. How we obtain your information

We receive information directly from you when you create an account, verify your phone, place or amend an order, use Pouch Pay, subscribe, contact us, enter a promotion or set communication preferences.
We also receive limited information from payment, identity, delivery, warehouse, authentication, analytics and marketing providers when they perform services for us.
We collect technical and usage information automatically through necessary technologies and, where you consent, analytics or advertising cookies. See our Cookie Policy for more detail.

4. Why we use it and our lawful bases

Contract: to create and manage your account, process payment, fulfil and deliver orders, administer subscriptions, Pouch Pay, returns and refunds, and provide customer support.
Legal obligation: to enforce age restrictions, keep tax and accounting records, respond to lawful requests, protect consumer rights and meet other duties that apply to us.
Legitimate interests: to keep our service secure, prevent fraud, recover sums owed, manage stock and fulfilment, improve our shop, understand performance and defend legal claims. We balance these interests against your rights.
Consent: to send electronic marketing where consent is required and to use non-essential analytics or advertising cookies. You can withdraw consent at any time without affecting earlier lawful use.
Where permitted by UK privacy law, we may market similar Pouch Haus products to existing customers using the soft opt-in. Every marketing message includes a simple way to opt out.

5. Who we share information with

We share only the information needed with payment processors, wallet providers, fraud-prevention and age-assurance services; they may act as independent controllers for parts of their service.
We use warehouse, stock-management, packaging, courier and delivery partners to fulfil orders and handle returns.
We use vetted providers for hosting, authentication, customer support, live chat, email, SMS, analytics, advertising, subscriptions, accounting and professional advice.
We may disclose information to regulators, law enforcement, courts, insurers, advisers or another business involved in a sale, merger or restructuring where the law permits or requires it.
We do not sell your personal information. We require service providers acting for us to use it only on our instructions, keep it secure and delete or return it when their work ends.

6. Payments and card security

Card fields displayed within Pouch Haus are securely hosted by our payment provider. Card numbers and security codes go directly to that provider and do not pass through or remain on our systems.
We retain the payment confirmation, transaction reference, amount, status and limited method details needed to reconcile orders, issue refunds, prevent duplicate charges and investigate disputes.
Apple Pay, Google Pay and other wallet services process information under their own privacy notices as well as the terms of our payment provider.

7. Cookies, analytics and marketing

Necessary cookies keep the basket, sign-in, security, consent and checkout working. They cannot be switched off through our cookie controls because the service cannot operate correctly without them.
We use analytics and advertising technologies only according to the choices available in our cookie banner. You can change or withdraw those choices through the Cookie Policy controls.
You can stop email or SMS marketing by using the unsubscribe option in the message or contacting us. Service messages about your account, payment, delivery, safety or subscription are not marketing and may still be sent.

8. International transfers

Some providers may process information outside the United Kingdom. Where the destination is not covered by UK adequacy regulations, we use an approved safeguard such as the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful transfer mechanism.
You may contact us for more information about the safeguard used for a particular transfer.

9. How long we keep information

Orders, payments, refunds, invoices and related tax records are normally kept for six years after the relevant financial year, unless a longer period is required for a dispute, investigation or legal claim.
Account information is kept while your account is active and then for a limited period needed to close it, handle queries, prevent fraud and meet legal obligations. Deleting an account does not require us to erase records we must legally retain.
Unsuccessful baskets and checkout records are kept only as long as reasonably needed for security, troubleshooting and service improvement, then deleted or anonymised.
Marketing consent and suppression records are retained as necessary to prove your choice and ensure we continue to respect an opt-out. Support and security records are retained according to their purpose and risk.
When a retention period ends, we delete, anonymise or securely restrict the information.

10. Security and automated checks

We use access controls, encryption in transit, secure hosted payment fields, activity logging, restricted staff permissions, backups and monitoring designed to protect information against loss, misuse or unauthorised access.
No online service is completely risk-free. If a personal-data breach is likely to create a risk to you, we will notify the Information Commissioner's Office and affected people where UK law requires it.
We may use automated signals to identify suspected fraud, unusual payment activity or failed age checks. A transaction may be paused or refused, but you can contact us to ask for a human review of a decision that significantly affects you.

11. Your UK data-protection rights

Depending on the circumstances, you may ask us for access to your information, correction, deletion, restriction, portability, or to object to processing based on legitimate interests or direct marketing.
Where processing relies on consent, you may withdraw it at any time. You may also ask for a human review of certain solely automated decisions.
To exercise a right, email support@pouchhaus.co.uk. We may ask for reasonable proof of identity and clarification of your request. We normally respond within one month; complex or multiple requests may lawfully take longer, and we will explain if that applies.
These rights are not absolute. We may retain or continue using information where the law requires or permits it, including for tax, fraud prevention and legal claims.
You may complain to the UK Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. We would appreciate the opportunity to address your concern first.

12. Children and age-restricted products

Our products and services are intended only for people aged 18 or over. We do not knowingly sell to, create accounts for or market nicotine products to children.
If you believe a child has provided personal information to us, contact us so we can investigate and delete it where appropriate.

13. Changes to this notice

We may update this notice when our services, providers or legal obligations change. We will publish the revised version here, change the date above and provide a prominent notice where a change materially affects your rights.