Last updated 20 September 2026
In short. We use personal information to operate our store, fulfil orders, provide customer service, keep the website secure and, where permitted, communicate with you about Havana Cigar Exchange. Essential cookies and similar technologies are used where needed to provide the service. Non-essential analytics, preference and marketing technologies are controlled through our cookie settings.
This Privacy & Cookies Notice applies to JPD London Ltd trading as Havana Cigar Exchange (“Havana Cigar Exchange”, “HCE”, “we”, “us” or “our”). For UK data protection purposes, JPD London Ltd is the controller of the personal data described in this notice.
Retail address: Havana Cigar Exchange, The Park Tower Knightsbridge, 101 Knightsbridge, London SW1X 7RN, United Kingdom.
Registered office: 20 Coxon Street, Spondon, Derby, DE21 7JG, United Kingdom.
Company number: 07888136 · VAT: GB177734764.
Email: info@havanacigarexchange.com · Telephone: +44 (0)20 7245 6236.
This notice is written primarily for the UK data protection and electronic-communications framework, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”), as amended, including by the Data (Use and Access) Act 2025. Additional rights may apply depending on where you live.
Depending on how you use our website or services, we may collect:
We receive information directly from you and, where relevant, from Shopify, payment providers, delivery providers, marketing platforms and other providers involved in the transaction or service you request.
| Purpose | Typical lawful basis |
|---|---|
| Process orders, payments, deliveries, returns and refunds | Performance of our contract with you; legal obligations where applicable |
| Provide customer service and respond to enquiries | Contract; legitimate interests in providing effective service |
| Prevent fraud, abuse and security incidents | Legitimate interests; legal obligations where applicable |
| Maintain accounting, tax and business records | Legal obligation; legitimate interests |
| Improve our website, catalogue and customer experience | Consent where required for non-essential storage/access technologies; otherwise legitimate interests where permitted |
| Send marketing communications | Consent, or the PECR “soft opt-in” where its legal conditions are met |
| Establish, exercise or defend legal claims | Legitimate interests; legal obligation where applicable |
Where we rely on legitimate interests, we consider whether our interests are proportionate and whether your rights and interests override them. You may object to processing based on legitimate interests in appropriate circumstances.
If you join our mailing list, we may send you information about releases, rare arrivals, offers, events and related HCE services. We send electronic marketing where you have consented or, for existing customers, where the PECR soft opt-in is available and its conditions are met.
You can unsubscribe at any time using the link in a marketing email or by contacting us. Unsubscribing from marketing does not prevent us from sending service messages that are necessary for an order or account.
Cookies and similar technologies can store information on, or access information from, your device. We use them to operate the website and, with your permission where required, for additional purposes such as analytics, preferences and marketing.
Our default approach is straightforward: essential technologies may operate where the law allows them to provide the service you request; non-essential analytics, preference and marketing technologies are controlled through our cookie settings.
| Category | What it is used for | Your choice |
|---|---|---|
| Essential | Cart, checkout, security, fraud prevention, authentication, network operation and remembering your privacy choice. | Used where necessary to provide the service or where another legal exception applies. |
| Preferences | Remembering choices such as language, currency or display preferences. | Controlled through your cookie settings where consent is required. |
| Analytics | Understanding how visitors use the website so we can improve performance, navigation and content. | Controlled through your cookie settings where consent is required. |
| Marketing | Measuring campaigns, attribution and, where used, marketing based on interests. | Controlled through your cookie settings where consent is required. |
UK law contains limited exceptions that can permit certain storage or access technologies without consent, including some uses for statistical purposes or to adapt a service’s appearance or functionality, provided the applicable conditions and safeguards are met. Where HCE relies on an exception, we will still provide the information and choices required by law.
Shopify and enabled apps may use technologies needed to provide their services. Where technologies are managed through Shopify’s Customer Privacy framework, your choices are passed to Shopify-managed services. The precise technologies used can change as Shopify and approved apps are updated, so we review our configuration periodically.
We share personal information only where needed for a legitimate business or legal purpose. Recipients may include:
We do not sell personal information for money.
Some service providers may process personal information outside the United Kingdom. Where UK data protection law requires a safeguard for an international transfer, we use an applicable mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism.
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, tax, fraud-prevention and dispute-resolution obligations.
Depending on the circumstances, UK data protection law gives you rights to request access to your personal information, correction, deletion, restriction, data portability and to object to certain processing. Where processing is based on consent, you can withdraw consent at any time without affecting processing that was lawful before withdrawal.
You have an absolute right to object to direct marketing. To exercise a privacy right, contact info@havanacigarexchange.com. We may need to verify your identity before acting on a request.
If you are unhappy with how we handle personal information, you can complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the opportunity to address your concern first.
We use technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure or access. No online service can guarantee absolute security.
Service providers may use automated fraud, payment or security tools as part of transaction screening. We do not use personal information to make solely automated decisions that produce legal or similarly significant effects on you unless this is permitted by law and appropriate safeguards are provided.
Our tobacco products are intended only for customers who meet the applicable legal age-of-sale requirements. We do not knowingly seek to collect personal information from children for the purpose of selling tobacco products. Where age or identity verification is required by law or by an appropriate fulfilment process, we may process the minimum information necessary for that purpose.
We review this notice periodically and may update it when our services, providers or legal obligations change. The date at the top shows when this version was last updated.
Privacy enquiries should be sent to info@havanacigarexchange.com or by post to JPD London Ltd, 20 Coxon Street, Spondon, Derby, DE21 7JG, United Kingdom.