Privacy Policy

Who We Are

Pluggy
Hillcrest, High Street

Tuddenham, Ipswich
Suffolk
IP6 9BN
United Kingdom
Email: support@pluggy.uk

You can contact us using the details above if you have any questions about this Privacy Policy or our data practices.

Overview

Pluggy operates the website https://www.pluggy.uk/. We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our site, create an account, place an order, or otherwise interact with us. By using the site, you agree to the practices described in this policy.

Information We Collect

Information You Provide to Us

Account, order, and contact details: name, billing and shipping address, email address, telephone number, and payment details (processed securely by our payment providers).
Identity and age verification details: where required for age-restricted or eligibility-restricted products, verification session references, verification status or decision, and information submitted during the verification process. This may include identity document details, a selfie or liveness check, date of birth, age result, or similar information collected directly by our verification provider.
Marketing preferences: your email address and communication preferences when you subscribe to our newsletter.
Support and reviews: any information you voluntarily provide when contacting customer support or submitting a review.

Information Collected Automatically

Technical data: IP address, browser type, device information, operating system, and pages visited (via cookies and similar technologies).
Usage data: how you navigate the site and interact with products.

How We Use Your Information

We use your personal data for the following purposes:

To process and fulfil your orders, including payment processing, shipping, and delivery updates.
To manage your account and provide customer service.
To comply with any legal obligations applicable to the products we sell.
To verify your identity, age, or eligibility where this is required before an order can be completed or fulfilled.
To send you order confirmations, updates, and essential service communications.
To send marketing communications (newsletters, offers, product updates) where you have consented or where we have a legitimate interest. You can unsubscribe at any time.
To improve our website, analyse usage, and personalise your experience.
To prevent fraud, comply with legal requirements, and enforce our Terms of Service.

Legal Basis for Processing

Under the UK GDPR, we rely on the following lawful bases:

Performance of a contract — to process your orders and deliver products.
Legal obligation — to comply with regulatory requirements applicable to the products we sell, including age or eligibility checks where required.
Consent — for marketing emails and certain cookies. You can withdraw consent at any time.
Legitimate interests — to improve our services, prevent fraud, protect our business, and send limited marketing where appropriate.

Where an identity or age verification process involves biometric data or other special category data, it is handled by the verification provider and processed only where an additional UK GDPR condition applies, such as explicit consent or another lawful condition explained by the provider during the verification process.

Sharing Your Information

We may share your personal data with:

Third-party service providers who assist us, such as payment processors, shipping couriers, hosting providers, email marketing platforms, and website analytics services. All such providers are contractually required to keep your data secure and process it only on our instructions.
Identity and age verification providers, including Didit where enabled for checkout. We may provide or receive verification session references, order or user references, verification status, and related technical information so that the provider can confirm whether the required verification has been completed. Identity documents, selfie/liveness checks, and similar verification evidence may be collected directly by the provider as part of its hosted verification process.
Law enforcement, regulators, or other authorities where we are legally required to do so.

We do not sell your personal data to third parties for marketing purposes.

Cookies and Tracking Technologies

Our site uses cookies and similar technologies to support checkout, improve performance, and measure usage where permitted. For full details, please see the cookie and related policy pages on our website. You can manage your cookie preferences from our cookie notice banner, your account page (if signed in), or your browser settings.

Data Retention

We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Typically, order-related data is retained for 6 years to comply with tax and consumer laws. Marketing data is retained until you unsubscribe. Where identity or age verification is required, we may retain the verification status, session reference, and related order record for as long as needed to evidence compliance, handle disputes, and meet legal obligations. Verification evidence collected directly by Didit or another verification provider is retained by that provider in accordance with its own privacy notice and retention rules.

Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

Right to access — request a copy of the data we hold about you.
Right to rectification — correct inaccurate or incomplete data.
Right to erasure — request deletion of your data, subject to legal obligations.
Right to restrict processing.
Right to data portability.
Right to object to processing — including for direct marketing.
Right to withdraw consent at any time where consent is the legal basis.

To exercise any of these rights, please contact us at support@pluggy.uk. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk/.

International Transfers

We primarily process data within the UK and EEA. Some service providers, including identity or age verification providers, may process data outside these areas. If any transfers occur outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or other legally recognised transfer mechanisms.

Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. However, no internet transmission is completely secure.

Children's Privacy

Our site and services are not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If we become aware that we have collected data from someone under 18, we will take steps to delete it promptly.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will be revised accordingly. We encourage you to review this page periodically.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Pluggy
Email: support@pluggy.uk
Hillcrest, High Street

Tuddenham, Ipswich
Suffolk
IP6 9BN
United Kingdom