Privacy Policy

The Vape Shed™ - Ecigdis Limited
NZBN: 9429042534419
Effective date: 23 June 2026
Last reviewed: 23 June 2026

1. About this Privacy Policy

This Privacy Policy explains how Ecigdis Limited, trading as The Vape Shed™ (“The Vape Shed”, “we”, “us” or “our”), collects, uses, stores and shares personal information.

This policy applies when you use our website, create an account, place an order, visit our stores, contact us, submit information to us, or otherwise use our services.

We are committed to handling personal information in accordance with the Privacy Act 2020 and other laws that apply to our business, including laws relating to the sale of age-restricted vaping products.

This policy is written for customers and website users. It does not cover internal employee, contractor or staff privacy matters.

2. Who we are

Legal entity: Ecigdis Limited
Trading name: The Vape Shed™
NZBN: 9429042534419
Address: 419 Grey Street, Hamilton East, Hamilton 3216, New Zealand
Website: www.vapeshed.co.nz
Privacy contact: support@vapeshed.co.nz
Phone: 07 859 2199

For privacy questions, access or correction requests, or complaints, please contact our Privacy Officer using the details above.

3. Personal information we collect

The personal information we collect depends on how you interact with us.

We may collect:

• your name, email address, phone number and account details;
• billing, delivery and store-pickup details;
• order history, purchase records, refund records and customer-service records;
• information needed to verify that you are 18 years or older;
• optional refund details, such as a bank account number if you choose to provide one for a bank refund;
• product reviews, feedback, enquiries or other information you submit to us;
• payment status and limited payment information returned by our payment providers;
• website and technical information, such as IP address, browser type, device type, pages viewed, session information, login activity and security logs;
• information needed to prevent fraud, misuse, underage purchasing, security incidents or unlawful activity.

We collect information directly from you, automatically when you use our website, from payment and delivery providers, and from systems we use to operate our business.

We collect only information that is reasonably necessary for our business, legal, compliance, safety and customer-service purposes.

4. Why we use your information

We use personal information to:

• create and manage customer accounts;
• process, fulfil, deliver, refund and support orders;
• verify that customers are 18 years or older;
• comply with laws that apply to age-restricted vaping products;
• take payments and confirm payment status;
• arrange shipping, delivery and store pickup;
• respond to enquiries, complaints, reviews and support requests;
• send service messages about orders, accounts, payments, delivery, refunds, age verification, password resets or important service matters;
• protect our website, systems, customers and business from fraud, misuse, security threats, underage purchasing or unlawful activity;
• maintain business, accounting, tax and compliance records;
• improve the security, reliability and usability of our website and services;
• establish, exercise or defend legal rights.

We do not use your personal information for unrelated purposes unless you have authorised us to do so, the use is directly related to the reason we collected it, or the law allows it.

5. Age verification and R18 products

Our products are age restricted. We must take steps to verify that customers are 18 years or older before selling regulated vaping products.

When age verification is required, we may ask you to upload a photo of a government-issued identity document, such as a driver licence, passport or other accepted ID. This is used to confirm your age, prevent underage purchasing, protect against misuse, and meet our legal obligations.

We use a secure automated service to help confirm the age shown on your ID. This check may take place outside New Zealand. The automated check can assist with approval, but if it cannot confirm your age, our staff will review it manually.

We delete the uploaded ID image within 14 days. After the image is deleted, we retain a verification record so we can confirm that verification occurred, avoid asking you to verify repeatedly, meet our compliance obligations, detect underage attempts, and investigate misuse.

We do not use age-verification information for marketing.

If you believe an age-verification decision is wrong, contact us at support@vapeshed.co.nz and we will review it.

6. Underage attempts and legal compliance

We do not knowingly sell regulated products to anyone under 18.

If we believe an order or attempted order involves a person under 18, we may keep a record of the attempt so we can comply with the law, prevent repeat attempts, protect our business, and respond to regulators or law enforcement where required or authorised.

7. Payments and refunds

Card payments are processed through secure third-party payment providers. When you pay by card, your card details are entered into the payment provider’s secure payment form. We do not store your full card number or CVV.

We may receive and retain limited payment information, such as payment method, payment status, transaction reference, amount, billing details and limited card information, where this is needed for order processing, refunds, accounting, dispute handling and fraud prevention.

Current payment and payment-related methods may include:

• Till Payments;
• Windcave;
• POLi;
• bank transfer;
• in-store EFTPOS or payment.

If you choose to provide a bank account number for a refund, we use it for refund processing. You do not have to provide a bank account number unless it is needed for the refund method you request.

8. Delivery and couriers

We share the information needed to deliver your order with delivery, courier, address-validation and logistics providers.

This may include your name, delivery address, phone number, email address, delivery instructions, order reference and parcel information.

Delivery providers may use this information to deliver your order, provide tracking updates, confirm delivery, handle delivery problems, and meet legal or operational requirements.

9. Service messages

We use your email address and phone number to send service messages that are necessary to provide our services.

These may include:

• order confirmations;
• payment messages;
• pickup-ready notices;
• delivery or tracking updates;
• age-verification messages;
• account and password messages;
• refund or customer-support messages;
• important service, safety or compliance notices.

We do not send newsletters, promotional campaigns or discount marketing emails for vaping products.

10. Reviews, feedback and public content

If you submit a review, rating, feedback or other content, we may use it to operate the website, respond to you, improve our services, and display customer feedback.

Reviews and other submitted content may be checked, edited, declined or removed where necessary to prevent unlawful, misleading, offensive, irrelevant, abusive or inappropriate content, or to protect privacy and comply with our website rules.

Do not include private information in a review or public submission that you do not want made public.

11. Cookies and website technology

We use cookies and similar technologies to operate and secure our website, keep you logged in, remember your cart, process orders, prevent fraud and understand website performance.

Some cookies are necessary for the website to work. You can control cookies through your browser settings, but some parts of the website may not work properly if essential cookies are blocked.

We may also use website performance, security, live-chat, anti-spam, address-validation, analytics and similar tools. These tools may receive technical information such as your IP address, browser type, device type, page viewed, and interaction information.

We do not use advertising pixels for vaping-product marketing.

12. Who we share information with

We do not sell your personal information.

We share personal information only where needed for the purposes described in this policy, including with:

• payment providers;
• banks and refund processors;
• courier, delivery and logistics providers;
• website hosting, security and performance providers;
• email, SMS and customer-service providers;
• age-verification and compliance service providers;
• address-validation and mapping providers;
• point-of-sale, order-management and business systems;
• professional advisers, insurers, accountants or legal advisers;
• regulators, law enforcement, courts or government agencies where required or authorised by law.

We require service providers to use personal information only for the services they provide to us, unless the law allows otherwise.

13. Overseas processing

Some of our service providers are located outside New Zealand or may process information outside New Zealand. This may include providers in countries such as Australia, the United States and Europe.

Where personal information is disclosed to an overseas provider, we take reasonable steps to ensure the information is protected by privacy safeguards that are comparable to those required under the New Zealand Privacy Act 2020, unless another exception under the law applies.

Overseas providers may include payment, age-verification, website infrastructure, security, communication, analytics, support and business-service providers.

14. How long we keep information

We keep personal information only for as long as we reasonably need it for the purposes described in this policy, or for as long as required or permitted by law.

In general:

• uploaded age-verification ID images are deleted within 14 days;
• age-verification records are retained for compliance, fraud prevention, underage-purchasing prevention and to avoid repeated verification;
• order, payment, refund and accounting records are kept for business, tax, warranty, dispute and legal reasons;
• account records are kept while your account remains active and for a reasonable period afterwards;
• website security and activity logs are kept for security, troubleshooting and fraud-prevention purposes;
• customer-service records are kept for support, dispute resolution and legal purposes.

When information is no longer needed, we delete it, de-identify it, or securely archive it where appropriate.

15. Security

We take reasonable steps to protect personal information from loss, misuse, unauthorised access, disclosure, alteration or destruction.

These steps may include access controls, secure payment processing, password protection, encryption where appropriate, audit logging, system monitoring, staff access restrictions, and secure website connections.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If we become aware of a privacy breach that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals where required by the Privacy Act 2020.

16. Your privacy rights

You have the right to ask whether we hold personal information about you, to request access to that information, and to ask us to correct it if you believe it is wrong.

To make a privacy request, contact us at:

Email: support@vapeshed.co.nz
Post: Privacy Officer, Ecigdis Limited, 419 Grey Street, Hamilton East, Hamilton 3216, New Zealand

We may need to verify your identity before providing information or making changes.

We will respond to privacy requests as soon as reasonably practicable and within 20 working days, unless the law allows or requires a different timeframe.

You can also update some account information by logging into your account.

You may ask us to delete or de-identify information we no longer need to keep. In some cases, we may need to retain information for legal, tax, accounting, compliance, fraud-prevention, dispute-resolution or age-verification reasons.

17. Complaints

If you have a privacy concern or complaint, please contact us first so we can try to resolve it.

Email: support@vapeshed.co.nz
Post: Privacy Officer, Ecigdis Limited, 419 Grey Street, Hamilton East, Hamilton 3216, New Zealand

If you are not satisfied with our response, you can contact the New Zealand Office of the Privacy Commissioner.

Website: www.privacy.org.nz
Phone: 0800 803 909

18. Links to other websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites.

We recommend you read the privacy policies of third-party websites before providing personal information to them.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

The current version will be published on our website with the effective date and last reviewed date.

If we make material changes, we will take reasonable steps to let customers know.