Privacy Protection and Processing of Personal Data

We respect your privacy. We process personal data in accordance with the General Data Protection Regulation (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2, Official Gazette of the Republic of Slovenia, No. 163/22) and the Electronic Communications Act (ZEKom-2). This document explains what data we collect, why we collect it, who we share it with, how long we retain it and what rights you have.

Data controller

We are not required to appoint a Data Protection Officer and have not appointed one. For any questions regarding personal data, please contact us at info@tobaccostuff.net.

What data we collect, why we collect it and how long we retain it

We collect personal data only when you provide it to us yourself – when you place an order, create a user account, submit an inquiry or leave a product review.

Processing your order

Data: first and last name, billing and delivery address, email address, telephone number, company details and tax number (for business purchases), order contents, amount, payment method and delivery method.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c)) in the areas of taxation and accounting.
Retention: data contained on issued invoices is retained for 10 years after the end of the year to which the invoice relates, as required by tax and accounting regulations. Other order-related data is retained until the expiry of the applicable limitation periods relating to liability for lack of conformity of goods.

User account

Data: email address, password (stored in encrypted form), first and last name, address, telephone number and order history.
Legal basis: performance of a contract or your consent.
Retention: until the account is deleted. You may request deletion at any time by contacting info@tobaccostuff.net. Information contained on invoices that have already been issued will continue to be retained after account deletion where required by law.

If you sign in to the store using your Google account, we receive your email address, name and account identifier from Google solely for the purpose of identifying you when you sign in. We do not receive your Google account password.

Inquiries and contact forms

Data: name, email address, telephone number and the content of your message.
Legal basis: taking steps at your request prior to entering into a contract or our legitimate interest in responding to your inquiry.
Retention: two years from the date of the last contact, unless the inquiry results in an order.

Marketing communications and newsletters

Data: email address, name and country.
Legal basis: our legitimate interest in direct marketing of our own similar products to existing customers (Article 226(6) of ZEKom-2) or your consent, where provided.
Retention: until you unsubscribe.

You can unsubscribe at any time. Every marketing message contains an unsubscribe link, and you can also unsubscribe by contacting us at info@tobaccostuff.net. Once you unsubscribe, we will no longer send you marketing communications. We retain your email address only on our suppression list so that we can respect your opt-out request.

Product ratings and reviews

Data: the name or nickname you enter and the content of your review.
Legal basis: your consent, which you provide by submitting the review.
Retention: until consent is withdrawn. You may request withdrawal by contacting info@tobaccostuff.net.

Website operation and security

Data: IP address, device and browser type, and event logs (sign-ins, form submissions, errors).
Legal basis: our legitimate interest in ensuring security, preventing misuse and resolving technical issues.
Retention: for as long as necessary for these purposes, generally no longer than two years.

Traffic measurement and advertising

Data: website visit and purchase data collected through cookies used by Google Analytics and Meta Pixel.
Legal basis: your consent, which you may withdraw at any time.
Retention: in accordance with the retention rules of the relevant tool.
Further details are provided in our Cookies policy.

Who we share personal data with

We do not sell personal data or provide it to third parties for their own purposes. We share it only with parties that require it in order to process your order or operate the online store, and only to the extent necessary:

• GLS – delivery of shipments (name, address, telephone number, email address and cash-on-delivery amount),
• Stripe – processing card payments (payment details that you enter directly with the provider; we do not receive or store your card details),
• Metakocka – issuing and storing invoices and managing inventory,
• our hosting and email service provider, through which order-related messages are sent,
• Google – website traffic measurement (Google Analytics) and Google account sign-in, if you use it,
• Meta – measuring advertising effectiveness (Meta Pixel),
• our accounting service provider and, where necessary, legal representatives or debt collection representatives,
• public authorities, where we are legally required to provide data.

We have entered into data processing agreements with service providers that process personal data on our behalf.

Transfers of data outside the European Union

Some providers, such as Google and Meta, may also process data in the United States of America. Such transfers are carried out on the basis of a European Commission adequacy decision (the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

Automated decision-making

We do not carry out profiling or automated decision-making that produces legal effects for individuals.

Your rights

With regard to your personal data, you have the right:

• to access – to find out what personal data we process about you and receive a copy of it,
• to rectification of inaccurate data or completion of incomplete data,
• to erasure (the “right to be forgotten”) where there is no longer a legal basis for processing,
• to restriction of processing,
• to data portability for data you have provided to us,
• to object to processing based on legitimate interests and, at any time, to processing for direct marketing purposes,
• to withdraw your consent where processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Please submit your request to info@tobaccostuff.net or by post to Derma Op d.o.o., Kajuhova ulica 1, 8250 Brežice. We will respond within one month of receiving your request at the latest. This period may be extended by a further two months, in which case we will notify you. For security reasons, we may request additional proof of your identity.

Right to lodge a complaint

If you believe that your rights have been infringed, you may lodge a complaint with the supervisory authority:

Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, email: gp.ip@ip-rs.si, telephone: 01 230 97 30.

Data security

We use appropriate technical and organisational measures to protect personal data, including an encrypted connection (HTTPS), encrypted password storage, restricted access to data and regular backups.

Cookies

The website uses cookies. Information about which cookies are used and how you can manage them is provided in our Cookies policy.

Changes

We may update this document from time to time. The version currently published on the website is the applicable version.

Last updated: 1 September 2026.