VAPE CUP

Privacy Policy

Last updated: 21 August 2026

This policy explains what personal data the VAPE CUP campaign collects when you take part, why we collect it, who we share it with, and the rights you have over it. It covers both campaign channels — the Geek Bar tournament and the Geekvape tournament — which run on the same platform.

1. Who is responsible for your data

The controller of the personal data described in this policy is the operator of the VAPE CUP campaign (“we”, “us”), acting for the participating brands Geek Bar and Geekvape.

If you sign in, your email address is also processed by the G-POINTS loyalty platform operated by the relevant brand (Geek Bar or Geekvape, depending on which tournament you enter). See section 5.

2. What we collect and why

We only collect what the campaign actually needs. Nothing here is sold, and none of it is used for third-party advertising.

Data	When	Why
Email address	When you request a sign-in code	To create or match your G-POINTS account, deliver your verification code, tie your champion vote to one person, and contact you if you win
Verification code	Each sign-in attempt	To confirm you control the email address. The code itself is never stored — only a keyed hash of it, held for 5 minutes, then discarded
Tournament records (the 16 products you pick, your 15 match results, your champion vote)	While you play	To run the bracket, produce the leaderboard, and determine prize eligibility
Entry credits (entries used, share and referral bonuses)	While you play	To enforce the entry limit fairly and to credit sharing and referrals
IP address and country	Every request	To set your default language, and to detect abuse such as automated or duplicate entries
Story submissions	Only if you choose to submit one	To review and, if selected, display your story on the campaign page
Shipping address and contact details	Only if you win a physical prize	To ship the prize to you
Usage events (pages viewed, actions taken, linked to your account when you are signed in)	While you use the site	To measure how the campaign performs and to investigate problems

We do not ask for or store a password for this campaign. Signing in is done entirely by emailed one-time code. We do not collect your date of birth — the age gate records only that you confirmed you meet the minimum age.

3. Our legal basis

Where the GDPR applies, we rely on:

Performance of a contract — running the tournament, recording your vote, determining winners, and delivering prizes. Without this data you cannot take part.
Legitimate interests — keeping the competition fair (abuse and duplicate-entry detection) and keeping the service secure and working.
Consent — where you actively choose to submit a story, and for any optional marketing you separately opt into. You can withdraw consent at any time.
Legal obligation — where we must keep records of a prize promotion.

Where China’s Personal Information Protection Law (PIPL) applies, we process your personal information on the basis of your consent and as necessary to perform the campaign you have entered.

4. Cookies and local storage

This campaign uses a small number of cookies and browser storage entries. We use no advertising cookies, no cross-site tracking pixels and no third-party ad networks.

Name	Type	Lifetime	Purpose
`qisi_auth_challenge`	Cookie (essential)	5 minutes	Holds the signed, hashed sign-in challenge while you enter your code
`qisi_member_session`	Cookie (essential)	24 hours	Keeps you signed in
`qisi:vape-cup:{brand}:age-ok`	Local storage (essential)	Until you clear your browser	Remembers that you passed the age gate so it is not shown on every visit
`qisi:vape-cup:{brand}:cookie-ok`	Local storage (essential)	Until you clear your browser	Remembers that you acknowledged the cookie notice for the selected brand
`qisi:vape-cup:locale`	Local storage (essential)	Until you clear your browser	Remembers the language you chose

These items are strictly necessary for the campaign to work, so they are set when you use the site. You can delete them at any time through your browser settings; doing so will sign you out and show the age gate again.

Separately, we record usage events (section 2) to measure how the campaign performs. These events are stored on our own systems, are linked to your account only while you are signed in, and are not shared with advertising networks.

We share personal data only with the parties below, and only for the purposes listed.

G-POINTS (Geek Bar / Geekvape loyalty platform) — receives your email address in order to create or match your loyalty account, to deliver your verification code by email, and, if you win, to credit loyalty points. Each brand channel uses its own separate G-POINTS configuration; the two channels are kept apart.
Supabase — database hosting for campaign records.
Cloudflare — website hosting, content delivery and protection against abuse.
Logistics providers — receive winners’ shipping details only, and only to deliver a prize.
Authorities or professional advisers — where we are legally required to disclose.

We do not sell personal data, and we do not share it for third-party advertising.

6. International transfers

The campaign is operated internationally, and the providers listed above may process data outside your country, including outside the European Economic Area and outside mainland China. Where we transfer personal data across borders we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, and — where PIPL applies — on your separate consent to cross-border transfer together with the required transfer assessment.

7. How long we keep it

Sign-in challenges — 5 minutes, then discarded.
Sign-in sessions — 24 hours.
Tournament records, votes and usage events — for the duration of the campaign and for 12 months after it closes, so results can be audited and disputes resolved.
Winner records — for as long as required to prove the prize promotion was run fairly, and to meet tax and accounting obligations.
Shipping addresses — deleted once the prize has been delivered and any return window has passed.
Story submissions — until the campaign closes, or until you ask us to remove them.

Your G-POINTS account is governed by the relevant brand’s own privacy policy and is not deleted when this campaign ends.

8. Your rights

Depending on where you live, you have some or all of the following rights:

Access — ask for a copy of the personal data we hold about you.
Rectification — ask us to correct data that is wrong or incomplete.
Erasure — ask us to delete your data. Note that deleting your data during the campaign will remove your entry and your champion vote.
Restriction and objection — ask us to pause processing, or object to processing we carry out on the basis of legitimate interests.
Portability — receive your data in a portable format.
Withdraw consent — where we rely on consent, withdraw it at any time. This does not affect processing carried out before you withdrew.
Complain — lodge a complaint with your local data protection authority.

Under PIPL you additionally have the right to know and decide how your personal information is handled, to ask us to explain our handling rules, and to request that we transfer your information to another handler.

To exercise any of these, contact us using the details in section 12. We will respond within the time limit that applies in your jurisdiction — one month under the GDPR.

9. Age restriction

This campaign is for adult users of vaping products only. You must be at least 18 years old, or older where your local law sets a higher minimum age for vaping products. We ask you to confirm this before you take part, and we do not knowingly collect data from anyone under that age. If you believe a minor has taken part, contact us and we will delete the data.

10. Security

Traffic to this site is encrypted in transit. Sign-in codes are stored only as keyed hashes and expire after five minutes; sign-in sessions are cryptographically signed. Access to campaign records is restricted to authorised operators and administrative actions are logged. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

11. Changes to this policy

If we change this policy we will update the “last updated” date at the top of this page. If the change is significant, we will make that clear on the campaign page.

12. Contact us

For any privacy question, or to exercise the rights in section 8, contact us through the official customer service channels of the brand whose tournament you entered — Geek Bar or Geekvape. Tell them your request concerns the VAPE CUP campaign and it will be routed to us.

← Back to the campaign