Privacy policy

Last updated: 20 October 2026

Who We Are

VYE Global Ltd, trading as VYE, operates vyemist.com and its related shopping and customer support services (the “Services”). We are registered in England and Wales under company number 17026482. Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom.

VYE Global Ltd is the controller of the personal information we process to operate our business. Shopify provides our store platform and also processes certain information for its own purposes, as explained below.

This Privacy Policy explains what personal information we collect, why we use it, who we share it with, how long we keep it, and your rights under applicable data protection law, including the UK GDPR, the Data Protection Act 2018, and the EU GDPR where it applies.

Using our website or reading this policy does not, by itself, give consent to marketing or tracking that requires your consent.

Personal Information We Collect

Personal information means information that identifies you or can reasonably be linked to you. Depending on how you interact with us, we may process:

Contact information: your name, billing and delivery addresses, email address, and telephone number.
Order and transaction information: the products you order, order history, delivery information, payments, refunds, returns, and communications relating to your purchases.
Payment information: information needed to process and reconcile payments, including billing details, payment method, payment status, transaction references, and limited card information made available by payment providers. Payment providers also process the payment credentials you submit through their payment facilities.
Account information: account identifiers, contact details, preferences, and information used to authenticate access.
Age-verification information: information needed to assess whether you meet our purchase eligibility requirements, which may include identifying details, information you provide as proof of age, and the outcome of a verification check.
Customer communications: enquiries, complaints, feedback, reviews, and information you choose to provide when contacting us.
Device and usage information: your IP address, browser and device information, identifiers, pages viewed, shopping activity, and interactions with our website or communications.
Preferences and permissions: marketing preferences, cookie choices, consent records, and records of requests to exercise your rights.

Please do not send payment card details or identity documents through ordinary email unless we have specifically provided an appropriate process for doing so.

Where Information Comes From

Directly from you when you browse, order, create or use an account, subscribe, submit a review, or contact us.
Automatically through our website and communications, including cookies and similar technologies where permitted by law.
From service providers involved in payments, fraud prevention, age verification, fulfilment, delivery, and customer support.
From other parties where you authorise the disclosure or where obtaining the information is otherwise lawful and necessary.

How We Use Information and Our Lawful Bases

We use personal information only where we have an applicable lawful basis. Different activities may rely on different bases:

Orders and customer service: we use contact, payment, and transaction information to take steps you request before a purchase, perform our contract, arrange delivery, manage returns, and provide order-related support.
Accounts: we use information to provide the account services you request and, where appropriate, pursue our legitimate interests in maintaining secure and reliable access.
Age verification: we use proportionate information to comply with applicable age-of-sale obligations where those obligations require the processing. Where processing is not required by a specific legal obligation, we rely on our legitimate interests in enforcing our purchase eligibility requirements and preventing inappropriate sales, subject to your rights and interests.
Security and fraud prevention: we rely on our legitimate interests in protecting customers, transactions, and our systems, or on a legal obligation where one applies.
Business records: we retain information required by tax, accounting, and other applicable laws to comply with our legal obligations.
Service improvement: we may use information to understand and improve our Services where this is necessary for our legitimate interests and does not override your rights. We obtain consent where the collection or use of information requires it.
Marketing: we rely on consent where required. Where the law permits marketing about our own similar products without fresh consent, we may rely on our legitimate interests, provided the conditions of that exception are met, including the required opportunities to opt out.
Advertising and tracking: we obtain consent where required for advertising technologies and other tracking. We do not treat acceptance of our terms as consent to these activities.
Complaints, disputes, and legal claims: we process information to comply with legal obligations and pursue our legitimate interests in investigating complaints, resolving disputes, and establishing or defending legal claims.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether your rights and interests override those interests.

Some information is necessary to provide a requested service or meet a legal requirement. If you do not provide it, we may be unable to process your order, complete a required check, or provide that service.

Age Verification

We may use verification providers and request additional information to check that purchasers meet our eligibility requirements. The information used depends on the verification method. Where additional information or an identity check is required, the relevant process should explain what is needed and how it will be handled.

If you believe a check has produced an incorrect result, contact support@vyemist.com so that we can investigate. Where applicable data protection law gives you rights in relation to a solely automated decision with legal or similarly significant effects, you may exercise those rights, including requesting human intervention and contesting the decision.

Email and Text Message Marketing

You can unsubscribe from marketing emails using the link in the message or by contacting us. For marketing text messages, follow the opt-out instructions in the message or contact us.

If you opt in to text messages, we may send marketing and cart reminders where permitted by law. Shopping-cart information and associated technologies may be used to identify an abandoned cart and trigger a reminder where the required permissions are in place.

We do not share text messaging opt-in information or consent status with third parties for their own marketing. We may share that information with providers who help operate and deliver our messaging service.

Withdrawing marketing consent or opting out does not stop necessary non-promotional communications, such as order confirmations, delivery updates, safety notices, and responses to your enquiries.

You have the right to object to the use of your personal information for direct marketing at any time. If you do, we will stop using it for that purpose.

Cookies and Similar Technologies

Our website uses cookies and similar technologies for functions such as shopping-cart operation, checkout, security, remembering choices, and understanding website use. Advertising technologies may also be used where permitted and subject to the required consent.

Technologies that require consent must not be used before that consent is given. Where an exemption from consent applies, we must meet its conditions and provide the required information and choices.

Where website cookie controls are available, you can use them to review or change your choices. You can also manage cookies through your browser settings, although blocking necessary cookies may affect shopping and checkout. Browser controls do not necessarily manage every type of tracking technology. Contact us if you need help exercising your choices.

Who Receives Personal Information

We disclose information only where necessary and lawful, including to:

Store and technology providers: Shopify and providers supporting hosting, systems, communications, and customer service.
Payment and verification providers: providers supporting payment processing, fraud prevention, and age verification.
Fulfilment and delivery providers: warehouse operators and carriers that prepare and deliver your order.
Marketing and analytics providers: providers helping us deliver communications, understand service use, and carry out permitted advertising, subject to applicable consent and other legal requirements.
Professional advisers and authorities: advisers, regulators, courts, law enforcement bodies, and others where disclosure is required or justified by law.
Parties to a business transaction: where necessary for a proposed or completed reorganisation, sale, or transfer of our business, subject to appropriate confidentiality and data protection safeguards.
Other recipients you request or authorise: where you ask us to share information or give valid consent.

Service providers may act on our behalf, while some recipients act as independent controllers for their own legally defined purposes. Those controllers are responsible for their processing and provide their own privacy information.

Shopify’s Role

Shopify hosts our store and processes information to provide and support the Services. Information may be processed by Shopify and its service providers in countries other than the country where you live.

Our store also uses Shopify features that may involve information about interactions with this store, other merchants, and Shopify. For processing that Shopify carries out as an independent controller, Shopify is responsible for explaining that processing and handling the relevant data protection rights requests. Applicable consent and other legal requirements still apply.

For more information, read the Shopify Consumer Privacy Policy or visit the Shopify Privacy Portal. You can contact VYE about processing for which we are responsible.

International Transfers

Our providers may process personal information outside the United Kingdom or European Economic Area. Where a transfer is subject to UK or EU data protection restrictions, we use an applicable lawful transfer mechanism.

This may include an adequacy regulation or decision, or appropriate contractual safeguards such as the European Commission’s Standard Contractual Clauses together with the UK Addendum where required, or the UK International Data Transfer Agreement. Additional protections are applied where necessary.

You can contact us for information about the safeguards relevant to your information and how to obtain a copy, subject to appropriate redactions.

How Long We Keep Information

We retain personal information only for as long as necessary for the relevant purposes. We determine retention by reference to:

Order and financial records: the period required by applicable accounting and tax law, together with any continuing need to resolve an order issue or legal claim.
Account information: the period needed to provide your account, followed by any necessary retention for security, legal, or unresolved transaction purposes.
Customer support and complaints: the time needed to resolve the matter and any justified period for handling related disputes, regulatory enquiries, or claims.
Age-verification information: the minimum period justified by the verification purpose and applicable compliance obligations. The need to keep a verification result is assessed separately from the need to keep supporting identity information.
Marketing records: the period during which the relevant permission or other lawful basis remains applicable. We may retain a limited suppression record after an opt-out so that we can respect it.
Cookie and technical information: the duration appropriate to the technology’s purpose, the choices you make, and any justified security or legal requirements.

We may retain relevant information longer where necessary for a specific legal obligation or ongoing dispute. When information is no longer needed, we delete it or anonymise it appropriately.

Security

We use appropriate technical and organisational measures to protect personal information. No system can guarantee absolute security. Please keep account access details secure and contact us promptly if you suspect unauthorised access.

Children’s Information

Our store is not intended for children. We may process limited information when identifying or preventing an ineligible purchase. If you believe a child has provided information to us outside that context, contact us so that we can investigate and take appropriate action.

Your Rights

Depending on the law that applies and the circumstances, you may have rights to:

Access your personal information and receive information about its use.
Correct inaccurate or incomplete information.
Request deletion of information.
Restrict certain processing.
Receive qualifying information in a portable format and request its transmission to another controller.
Object to processing based on legitimate interests.
Object to direct marketing, including associated profiling.
Withdraw consent without affecting the lawfulness of processing before withdrawal.
Exercise applicable rights concerning solely automated decisions.

These rights may be subject to legal conditions and exceptions. For example, we may need to retain information to meet a legal obligation or handle a legal claim.

Contact support@vyemist.com to make a request. We may ask for proportionate information to confirm your identity or an authorised representative’s authority. We normally respond within one month, subject to any extensions or adjustments permitted by applicable law. We will explain any applicable extension or refusal.

Privacy Complaints

If you have concerns about our handling of personal information, email support@vyemist.com or write to Data Protection Complaints, VYE Global Ltd, 128 City Road, London, EC1V 2NX, United Kingdom.

We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed as appropriate, and explain the outcome.

You also have the right to complain to the UK Information Commissioner’s Office. Where EU data protection law applies, you may complain to the competent supervisory authority, including in the country of your habitual residence, place of work, or the alleged infringement. See the EEA supervisory authority directory.

Other Websites

Links to other websites do not make us responsible for those organisations’ processing. Review their privacy information before providing personal information. This does not exclude responsibility that the law places on VYE for its own activities.

Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. We will update the date above and provide additional notice where required. A policy update does not replace consent where fresh consent is needed.

Contact

VYE Global Ltd
128 City Road
London, EC1V 2NX
United Kingdom
Email: support@vyemist.com
Telephone: +44 20 8073 0094