Summary

The short version

Privacy

The policy in full

1. 01Who we are

   HAMCL is the brand of Shenzhen Trumpro International E-Commerce Co., Ltd., 316, Chuangying Building, No. 68 South Ring Road, Shaqi Community, Xinqiao Street, Bao'an District, Shenzhen, China. We decide what this site collects and why, which makes us the controller of that data under the laws that use the word.

   This policy covers this website and the order process that runs on it. It does not cover a marketplace, social shop or physical store where you bought HAMCL product — that seller decides what it collects, and its own policy applies there.

2. 02What we collect

   Seven categories, listed with how long each is kept. Nothing outside this table is collected at checkout.

   Category	What it includes	Kept for
   Identity and contact	Name, email address, phone number, delivery and billing address	7 years after the order
   Age confirmation	Your confirmation that you are 21 or over, and a carrier's adult-signature record where one is required	7 years after the order
   Age evidence	Only if an age check is disputed: a photo of a government ID with the date of birth visible and everything else covered	30 days, then deleted
   Order content	Items, flavours, quantities, prices, discounts, order number and order history	7 years after the order
   Payment result	Authorisation outcome, amount, card brand and last four digits — never the full number, expiry or security code	7 years after the order
   Correspondence	Emails, form submissions, warranty and return claims, and any photo or video you attach to one	3 years after the case closes
   Technical	IP address, browser and device type, pages requested, and timestamps	12 months

   We do not collect precise location, your contacts, your photo library, or biometric data, and we do not run background or credit checks.

3. 03How we collect it

   • From you — at checkout, through the contact form, in a warranty or return claim, in a review, and in any email you send us.
   • From the order itself — what was bought, when it was dispatched, where it went, and whether it was delivered or returned.
   • From your browser — the technical record any web server receives when a page is requested, plus whether you confirmed the age gate in this session.
   • From providers — the payment authorisation result, carrier scans, and an address or fraud check when one is triggered.

   We do not buy contact lists, and we do not append data bought from brokers to your record.

4. 04Why we use it

   Every use below has a reason you could hold us to. If a use is not on this list, we do not do it without telling you first.

   • Take payment, pick, pack, ship and deliver your order.
   • Verify that you are 21 or over, and keep the record that shows we did.
   • Handle a return, a warranty claim or a support question.
   • Detect fraud and card testing, and keep the site and checkout working.
   • Send marketing — only where you asked for it, and only until you stop it.
   • Meet tax, customs and product record-keeping obligations.

5. 05Cookies and browser storage

   This site sets no advertising cookies, no analytics cookies and no third-party tracking scripts. As built, the only thing stored in your browser is a session flag (hamcl_age) recording that you confirmed you are 21. It is cleared when you close the tab, it never leaves your device, and refusing it only means the age gate appears again.

   The cart lives in the page for the length of your visit rather than in a persistent cookie. If we later add analytics or advertising, the tool will be named in this section, held back until you accept it, and this page will be updated before it is switched on.

6. 06Marketing and how to stop it

   We email or text you only if you asked at checkout or signed up in the footer. Every email carries a one-click unsubscribe, and replying STOP to a text ends it. Both take effect immediately; the only message you may still receive is one confirming the unsubscribe.

   We do not build an advertising profile from your order history, and we do not hand your email address to a lookalike-audience tool.

7. 07Who else touches it

   • Payment processor — the amount and the authorisation result. Card data stays with them; see the next section.
   • Carriers — name, address, phone, a generic description of the parcel for customs, and whether an adult signature is required.
   • Age and fraud checks — only when a check is triggered, and only the data needed for that check.
   • Email and support tools — the content of the messages you send us.
   • Hosting and infrastructure — the technical logs the site produces.
   • Advisers and authorities — where the law requires it, or to establish or defend a legal claim.

   Each provider is bound to use the data only for the task we gave it, and to delete it when that task ends.

   In plain terms: no data broker has received a list from us, and none will. We do not sell personal information for money, and we do not share it for cross-context behavioural advertising.

8. 08Payment data

   Card details are entered on the payment processor's page, inside its own frame. We never see or store the full card number, the expiry date or the security code — only an authorisation result, the amount, the card brand and the last four digits, so that a refund or a dispute can be matched to the right payment.

   Refunds go back to the method that paid. We cannot send a refund to a different card, and we will never ask you for card details by email.

9. 09Age, and anyone under 21

   This site sells nicotine products and is for adults aged 21 and over. Age is confirmed at the gate and again at checkout, and a carrier may require an adult signature on delivery. We keep the record that a check happened, not a copy of your identity, unless a check is disputed.

   If you are under 21, do not send us personal information. If we learn that we hold data belonging to someone under 21, we delete it and cancel any related order.

10. 10Your rights

    Depending on where you live, you may have some or all of the rights below. We apply them to every customer who asks, not only where a statute compels us.

    • Know what we hold about you, and receive a copy of it.
    • Correct anything that is wrong, including an address on an open order.
    • Delete it, except where tax, consumer-protection or fraud records require us to keep it.
    • Portability — a machine-readable copy of what you gave us.
    • Opt out of sale or sharing — we do neither, so there is nothing to switch off, but you can ask us to confirm that in writing.
    • Limit sensitive personal information — the only sensitive item we touch is age evidence, and only to complete an order.
    • Non-discrimination — exercising a right never changes your price, your delivery options or the support you get.

    In the EU and UK you can also object to processing based on legitimate interests and complain to your local supervisory authority. The lawful bases we rely on are the purposes listed in §04.

11. 11How to exercise them

    Email info@hamclvape.com with the subject Privacy request, the email address used on the order, and what you want us to do. If you are asking for a copy or a deletion, tell us whether you want the retail record, the marketing record, or both.

    We verify identity by matching the request to an order or an account, and we may ask one confirming question rather than for documents. An authorised agent can submit on your behalf with written permission. We answer within 45 days; if a request is complex we tell you why and when to expect the rest.

12. 12Do Not Track and Global Privacy Control

    Browsers can send a Do Not Track or Global Privacy Control signal. Because we do not sell or share personal information for cross-context behavioural advertising, there is nothing on this site for the signal to switch off.

    We still read GPC as a formal opt-out request, record that we received it, and treat it as applying to the browser that sent it. If we ever add advertising technology, GPC will be honoured automatically rather than by request.

13. 13How long we keep it

    The table in §02 gives the period for each category. The rule behind it is simple: we keep data while the reason for holding it exists, then delete or anonymise it.

    • Order and payment records stay for seven years because tax and consumer-protection rules require it, not because we want them.
    • Marketing records are deleted 30 days after you unsubscribe.
    • Backups roll off within 35 days, so a deletion reaches the last copy inside that window.
    • Aggregated figures — units sold, return rate — carry no identifier and are kept indefinitely.

14. 14Security

    Traffic to this site is encrypted in transit. Access to order data is limited to the staff who need it for the task in front of them, and card data is held by a PCI-DSS compliant processor rather than by us.

    No system is perfect. If a breach affects your data, we notify you and the relevant regulator where the law requires it, and we tell you what changed as a result.

15. 15Where your data is processed

    We operate from China and fulfil retail orders from the United States, so your data may be processed in either country, and by providers in the EU and the US. Where personal data leaves the EEA or the UK, we rely on the European Commission's standard contractual clauses or an equivalent mechanism, and we will send you the relevant terms on request.

16. 16Links and social pages

    This site links to carriers, payment brands and our social pages. Once you follow one of those links you are on someone else's site, and their policy governs what happens there. We do not embed social plugins that track you before you click.

17. 17Changes to this policy

    A new version gets a new date at the top of this page. A material change — a new category of data, a new recipient, a longer retention period — is announced on the site for 30 days before it takes effect, and the version in force when you ordered governs the data from that order.

18. 18Contact and complaints

    Privacy questions and requests: info@hamclvape.com, subject Privacy. Postal address: 316, Chuangying Building, No. 68 South Ring Road, Shaqi Community, Xinqiao Street, Bao'an District, Shenzhen, China.

    If we do not resolve a complaint, you can take it to your state attorney general in the United States, the Information Commissioner's Office in the UK, or your local supervisory authority in the EU. You do not need our permission to do that, and it does not affect your order.