Skip to content
IKU行く, home page

Privacy

Version 0.1 · Effective 23 October 2026

This policy explains what personal data IKU collects, why, who we share it with, how long we keep it and your rights. It applies under the UK GDPR and the Data Protection Act 2018 in the United Kingdom, and the GDPR in Sweden.

Who is responsible for your data

The controller of your personal data is the company shown at the top of this page, with its address and email. Contact us at that email about anything in this policy.

We have no establishment in the United Kingdom or the European Union yet. We will appoint a representative in the UK and in the EU, and name them here. [VERIFY]

What we collect

  • Account: your email address and the language you use. Session tokens are stored only in a scrambled (hashed) form, and login codes are checked against a hashed copy.
  • Age and identity check: the result, the method (for example BankID), the time, the check provider's reference and whether the name matched. We never store images of your ID, your ID number or your date of birth.
  • Delivery: the name, address and country you give us.
  • Orders and plans: what you bought, your schedule, prices, payments and refunds. For your payment method we keep only the provider's reference and a label such as the card brand and last four digits.
  • What you agreed to: the exact text you were shown at checkout and for each later change, with the date, time, language, price, schedule, the tick box, your IP address and your browser's user agent (the name and version it reports).
  • Compliance records: for every parcel, the country, the verification method and reference, the products and quantities, the dates, the carrier, the tracking number and, in Sweden, the result of the ID check at delivery.
  • Emails: copies of the emails we send you, such as login codes, order confirmations and reminders.
  • Support: messages you send us, problem reports with any photos you upload, and withdrawal requests.
  • Cookies: your cookie choice, stored with a random ID that doesn't identify you and a hashed form of your browser's user agent. Our Cookies policy lists every cookie.
  • Security: a scrambled (hashed) form of your IP address to limit how many login codes can be requested.

Why we use it, and our legal bases

  • To sell to you and deliver your orders (contract): your account, orders, plan, payments, delivery, emails about your orders and support.
  • To meet our legal duties (legal obligation): checking that you are 18 or over before we sell nicotine products, the compliance records required for nicotine sales in Sweden, accounting and tax records, and records of what you agreed to under consumer law. [VERIFY]
  • To keep our service secure and prevent misuse (legitimate interests): login limits, fraud checks and keeping our systems working.
  • Optional cookies and marketing email (consent): we don't use any at present. If we start, we'll ask first and you can withdraw your consent at any time.

We only send marketing email to verified adults aged 18 or over who have opted in, and we never send identity data to a marketing tool.

Who we share it with

We use service providers who process data for us under contract, each only for its own task:

  • website hosting and our database (in the European Union);
  • our payment provider, which handles your card details on its own page;
  • age and identity check providers (a BankID service in Sweden, and a document or database check in the United Kingdom);
  • address lookup;
  • the email service that sends our emails;
  • our warehouses in the United Kingdom and Sweden, which pack your orders;
  • the carriers that deliver them.

We will name each provider here once our contracts are in place. [VERIFY] We share data with authorities only when the law requires it. We never sell your data.

Transfers outside the UK and EU

IKU's founders work from Australia, and some providers may process data outside the United Kingdom and the European Union. Where that happens we use the safeguards the law requires, such as standard contractual clauses. [VERIFY]

How long we keep it

  • Account, delivery and plan data: while you have an account, then for a limited period after. [VERIFY]
  • Age and identity check results: for as long as the law requires us to show that we checked. [VERIFY]
  • Orders, payments and compliance records: for as long as accounting, tax and nicotine sales rules require. [VERIFY]
  • What you agreed to: for as long as we may need to show what was agreed. [VERIFY]
  • Support messages and problem reports with photos: for a limited period after the matter is closed. [VERIFY]
  • Login codes and sessions: until they expire, then deleted. [VERIFY]

Your rights

You have the right to:

  • get a copy of your personal data;
  • have wrong data corrected;
  • have your data deleted, unless we must keep it by law;
  • restrict how we use it, or object to our use based on legitimate interests;
  • receive your data in a portable format;
  • withdraw any consent you've given, at any time.

To use any of these rights, email us at the address at the top of this page. We reply within one month.

The age and identity check decides whether we can sell to you. If you think a check went wrong, contact us and a person will look at it. [VERIFY]

Complaints

If you're unhappy with how we use your data, please contact us first. You can also complain to the Information Commissioner's Office in the United Kingdom (ico.org.uk) or Integritetsskyddsmyndigheten in Sweden (imy.se).

Under 18s

IKU is for adults 18+ only. We don't knowingly collect data from anyone under 18.

Changes to this policy

Each version of this policy has a number and an effective date at the top of this page. If we make an important change, we'll tell you by email.