Privacy

Who controls this data

The data controller for this shop is Pouch Empire.

For anything on this page — including a request to see, correct or delete your data —use the contact form.

What we collect

When you browse: An age-confirmation cookie and, if you add something to your basket, an opaque basket token. Neither identifies you.
When you order: Your email address, the items and prices at the time of purchase, and the delivery details you give when you pay.
When you pay: Card details are entered on the payment provider's own hosted page. They never reach this site's servers. We store only the provider's reference identifiers so an order can be matched to a payment.
When you contact us: Your name, email address and message, the order number if you give one, and a hashed form of your network address that is used only to limit automated abuse of the form.
When you look up an order: The order number and email address you enter are checked against the order, and nothing else is recorded.
When you apply to the creator programme: Your name, username, email address and the code you ask for, plus a password, which is stored only as a one-way hash by our authentication provider and is never readable by us. If you are approved and ask to be paid, the payment details you enter — a PayPal address, or a bank account number and the name on it. These are kept for as long as your creator account exists and for as long afterwards as tax and accounting law requires us to keep a record of what we paid you. Ask us and we will close the account.
When someone uses a creator's code: The order is linked to that code so the commission can be calculated. The creator is shown the date, the value and the status of the order — never the name, email address or delivery address of the person who placed it.

What we do not collect

Card numbers, CVCs or expiry dates — these never touch our servers.
Advertising or cross-site tracking identifiers.
Any analytics at all, unless and until it is added and disclosed here first.
Customer account details — buying needs no account and there is nothing to sign up for. The only accounts on this site belong to the creator programme, which is opt-in and separate from shopping.

Cookies

Age confirmation: Records that you confirmed you are of legal age. Kept 30 days. Strictly necessary.
Basket: An opaque token linking your browser to a basket. Kept 30 days. Strictly necessary.
Order view: Set only after you place an order or look one up, so the order page can show it to you without the reference in the address bar. Kept two hours. Strictly necessary.

All three are strictly necessary for the shop to function, so no consent banner is shown. Adding anything beyond this would require asking first.

The age check on your order

Before an order is dispatched, a member of our team confirms it is going to someone of legal age for their destination, and we record when that was done andwho did it against the order. We do not ask for, or store, a date of birth or an identity document. See our age policy for how the check works.

How long we keep things

Orders and their line items are retained for the period required by tax and accounting law. Baskets that are never checked out are periodically cleared. Messages sent through the contact form are kept so that the reply can be tracked. Stock movement records are permanent, but reference products rather than people.

Your rights

Under the GDPR you may request access to your data, correction, erasure, restriction, portability, or object to processing. Use the contact form and we will respond within one month. You may also complain to the data-protection supervisory authority in the country where you live.