Privacy Policy

Last updated: 27 August 2026

1. Who we are

Clayton Leonard Enterprises Ltd of Unit 19, Seatown Business Campus, Swords, Co. Dublin, K67 Y673, Ireland (VAT IE3375507MH) is the data controller for personal data collected through www.ivapegreatshop.ie (the "Site").

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018 and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011).

Data protection contact: [INSERT CONTACT EMAIL], or write to us at the address above marked "Data Protection".

2. Adults only

This Site sells age-restricted products and is intended solely for persons aged 18 or over. We do not knowingly collect personal data from, market to, or provide services to anyone under 18. If we become aware that we hold data relating to a person under 18, we will close any associated account and delete the data without undue delay, except where we are required to retain a record of the incident. If you believe a person under 18 has provided us with personal data, please contact us.

3. What personal data we collect

• Identity and contact data: name, billing and delivery address, email address, phone number, date of birth.
• Age-verification data: information needed to confirm you are 18 or over, including date of birth and, where required, verification results returned by our age-verification provider.
• Order and transaction data: products purchased, order history, delivery details. Payment card details are collected and processed directly by our payment providers — we do not store full card numbers.
• Account data: username, password (hashed), preferences.
• Technical and usage data: IP address, device and browser information, and information about how you use the Site, collected via cookies and similar technologies (see our Cookie Policy).
• Marketing preferences: your subscription status and interaction with our emails.
• Correspondence: messages you send us via the contact form, email or phone.

We collect this data directly from you, from your use of the Site, and from our service providers (for example payment confirmation from our payment processor or delivery status from our courier).

4. Why we use your data and our legal bases

• To process and deliver your orders, manage payments and provide customer service — performance of a contract (Article 6(1)(b) GDPR).
• To verify that you are 18 or over before selling age-restricted products — compliance with a legal obligation (Article 6(1)(c) GDPR, Public Health (Tobacco Products and Nicotine Inhaling Products) Act 2023).
• To keep transaction and tax records — legal obligation (Irish tax and company law).
• To send you marketing emails where you have opted in, or where permitted for similar products following a purchase (with the right to opt out at any time) — consent and, where applicable, legitimate interests, in accordance with S.I. 336/2011. See our Direct Marketing Policy.
• To operate, secure and improve the Site, prevent fraud and abuse, and analyse Site performance — legitimate interests, and consent where cookies requiring consent are used.
• To establish, exercise or defend legal claims — legitimate interests.

5. Who we share data with

We share personal data only as needed with:

• Our e-commerce platform provider (Shopify), which hosts the Site and order data;
• Payment processors, to take payment securely;
• Age-verification providers, to confirm you are 18 or over;
• Delivery partners (DPD Ireland), to deliver your order;
• Email/marketing platforms, to send messages you have signed up for;
• Analytics providers, subject to your cookie choices;
• Professional advisers, and public authorities (including the HSE, Revenue or An Garda Síochána) where we are legally required to do so.

We do not sell your personal data.

6. International transfers

Some of our service providers (for example our e-commerce platform) may process data outside the European Economic Area. Where that happens, we ensure appropriate safeguards are in place, such as an EU adequacy decision or the European Commission's Standard Contractual Clauses.

7. How long we keep your data

• Order, invoice and transaction records: 6 years after the end of the relevant financial year, as required by Irish tax and company law.
• Account data: for as long as your account is active, then deleted or anonymised within 12 months of closure or prolonged inactivity.
• Age-verification records: for as long as necessary to demonstrate compliance with our legal obligations.
• Marketing data: until you unsubscribe or object, after which we retain only a suppression record.
• Correspondence: up to 2 years after the matter is resolved, unless needed for a legal claim.

8. Your rights

Under the GDPR you have the right to: access your personal data; have inaccurate data rectified; have data erased in certain circumstances; restrict processing; data portability; object to processing based on legitimate interests, including profiling; object at any time to direct marketing; and withdraw consent at any time where processing is based on consent, without affecting prior processing.

To exercise any right, contact us using the details in section 1. We will respond within one month. We may need to verify your identity before acting on a request.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Irish supervisory authority: the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — www.dataprotection.ie.

9. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (TLS), access controls and reputable hosting. Our Data Breach Response Plan describes how we handle any personal-data breach.

10. Cookies

See our Cookie Policy for details of the cookies used on the Site and how to manage your preferences.

11. Changes to this policy

We may update this policy from time to time. The current version, with its "last updated" date, will always be published on this page. Material changes will be highlighted on the Site or notified to account holders by email.