We do not openly display our products. Users request visual information about a specific product themselves after completing the age check and reviewing the product list. All product information on BigSmoke.kz is provided solely to inform visitors about the product list and key characteristics.
BigSmoke

Consent to personal data processing

Effective from 1 September 2026

This consent sets out which personal data of an individual IE «VR46» may collect and process, for what purposes it is used, to whom it may be transferred, for how long it is processed and how the consent can be withdrawn. It applies when you register on and use the Bigsmoke.kz website, place and receive orders (including orders through Glovo), contact support, and exchange, return or have goods serviced under warranty.

1. The operator and the data subject

1.1. The owner and operator of the database containing personal data is the individual entrepreneur Rustem Nurlanovich Mukhtarov, trading as IE «VR46», IIN 910605300019, address: 21 Al-Farabi Avenue, non-residential premises 1177, Almaty, Republic of Kazakhstan, 050013 (A15E2X1), hereinafter the «Operator».

1.2. The data subject is the individual whose surname, first name and patronymic are given at registration, when placing an order, when contacting the Operator or in the confirmation block of this consent, hereinafter the «Subject».

1.3. If the Subject accesses sections intended for adults or buys tobacco products, tobacco heating systems or other age-restricted goods, the Subject confirms that they are aged twenty-one or over. The Subject also confirms that the information they provide is accurate.

1.4. The Subject voluntarily, specifically, knowingly and unambiguously consents to the Operator collecting and processing personal data to the extent, for the purposes and on the terms set out below. The consent does not cover data whose processing is unrelated to those purposes.

1.5. Refusing to provide data that is objectively necessary for registration, the age check, placing, paying for or delivering an order, or complying with the law may make the relevant action or service impossible. Declining optional marketing messages does not prevent the Subject from buying Goods or receiving mandatory service.

2. Personal data covered

2.1. Depending on the way of interacting and actual need, the Operator may collect and process the following categories of data:

  • surname, first name, patronymic; date of birth; confirmation of being aged twenty-one or over; sex — only if given voluntarily or objectively necessary for the chosen service;
  • IIN, the type and certain details of an identity document — only where they are required by law, by the method of identification or by a particular transaction;
  • home, registered or delivery address; a geographical location chosen by the Subject to determine an address or whether delivery is available;
  • phone number, e-mail address, username or ID on a social network or messenger, if the Subject uses that channel;
  • the account ID and settings, login history, registration and age status, chosen settings and records of consents given or withdrawn; the Operator does not collect or store passwords in plain text;
  • information about orders, purchases and returns: the contents and price of the order, discounts applied, the address and method of collection, the date and status of delivery, the method and status of payment, the number of the payment document; full bank card details are processed by the payment organisation and are not passed to the Operator, unless the Subject is expressly shown otherwise;
  • information about enquiries, claims, exchanges, returns and warranty service, including the correspondence, the date and content of the enquiry, and photos or videos of a defect provided by the Subject;
  • information about goods or a device handed in for diagnostics: brand, model, serial or other identification number, date of purchase, warranty status, test results, technical logs and diagnostic data to the extent needed for the service;
  • an audio recording of a call with support — only after notice that the call is recorded; photos and videos — if the Subject provided them or separately agreed to be filmed;
  • technical information: IP address, device and browser type, operating system, date and time of access, session identifiers, error and security logs. Data from cookies and similar technologies is processed in accordance with the separate cookie policy and the settings chosen by the Subject;
  • information about taking part in a loyalty program, survey, research, promotion or event, and preferences and interaction history — only to the extent needed for the activity the Subject has chosen.

2.2. The Operator obtains data directly from the Subject, from the Bigsmoke.kz website, and from Glovo, a courier, a payment organisation, a bank, a service centre, a manufacturer, an importer or another engaged party, to the extent needed to fulfil an order, payment, delivery, return, warranty or lawful requirement.

2.3. The Operator does not carry out hidden or unlimited searches for additional information about the Subject on social networks or other public sources. Information from a public source may be used only for a specific lawful purpose, for example to check a public contact provided by the Subject or to protect rights in a dispute.

2.4. During a visual age check, the identity document is used only to establish identity and date of birth. It is not copied or photographed and its details are not stored, unless there is a separate lawful basis or a need for a particular transaction of which the Subject has been informed.

3. Purposes of processing

3.1. Personal data is processed for the following main purposes:

  • registering, creating and maintaining an account on Bigsmoke.kz, identifying the Subject and keeping access secure;
  • confirming age and complying with statutory restrictions on access to, sale and handover of certain categories of goods;
  • putting together, confirming and fulfilling an order, accepting and confirming payment, packing, delivery, issuing payment documents and keeping the Subject informed of the order status;
  • fulfilling orders placed through Glovo and dealing with the owner of the Platform, the Courier and payment organisations;
  • providing support, handling enquiries and claims, arranging exchanges, returns, diagnostics, repairs and warranty service;
  • preventing fraud and abuse, protecting accounts, information systems, property and the rights of the Operator, the Subject and third parties;
  • keeping accounting, tax and management records, confirming transactions, responding to requests from public authorities and meeting other obligations established by law;
  • improving the website and the quality of service on the basis of anonymised or aggregated information and, where optional cookies are used, in accordance with the Subject's separate choice.

3.2. Advertising messages, personalised offers, and invitations to promotions, surveys, research, events and loyalty programs are sent only with the separate voluntary consent provided for in section 9.

3.3. Data collected to fulfil an order or comply with the law is not used for an incompatible purpose without a new lawful basis or the Subject's additional consent.

4. Operations with data and methods of processing

4.1. Consent is given to the receipt and collection, accumulation, systematisation, storage, clarification, modification, supplementing, use, retrieval, matching, transfer of and provision of access to personal data in the cases specified in this consent, and to its anonymisation, blocking and destruction.

4.2. Processing may be automated, non-automated or mixed, using databases, information systems, paper documents, communication means and software.

4.3. The Operator processes only the data that is necessary and sufficient for the stated purposes, restricts access to it and applies the organisational and technical protection measures required by law.

4.4. Automated checks may be used to validate mandatory fields, detect technical errors, prevent suspicious transactions and determine whether services are available. If an automated decision significantly affects the Subject's rights, the Subject may ask for an explanation and a review in the cases provided for by law.

5. Transfer to third parties

5.1. The Subject agrees that the Operator may transfer personal data to third parties to the minimum extent necessary for the stated purposes and receive information from them about the progress of the operation entrusted to them.

5.2. Such third parties may include:

  • the owner and operator of the Glovo platform, its related persons and Couriers — to place, pay for, deliver, cancel and return an order;
  • banks, payment organisations, fiscal data operators and other participants in settlements — to make and confirm payments and refunds and issue payment documents;
  • delivery services, pick-up points and persons authorised to hand over goods and check age;
  • providers of hosting, cloud infrastructure, CRM, telephony, e-mail, SMS, messengers, security analytics and technical support;
  • manufacturers, importers, suppliers, service and authorised centres — for diagnostics, warranty service, repair or replacement of goods;
  • auditors, accountants, lawyers, insurers and other professional advisers — where necessary and subject to a duty of confidentiality;
  • courts, law enforcement, tax and other competent public authorities — in the cases and to the extent provided by law.

5.3. A person given access to personal data on the Operator's instructions must use it only for the agreed purpose, keep it confidential and ensure the necessary protection.

5.4. Glovo itself determines how it processes the data that the Subject provides directly when registering on and using the Platform, in accordance with its own privacy policy. This consent governs the processing of data by IE «VR46» and does not replace Glovo's consents and notices.

6. Storage and cross-border transfer

6.1. The Operator accumulates and stores personal data in a database located in the Republic of Kazakhstan, in compliance with the law.

6.2. Cross-border transfer of personal data may take place in the course of processing. The Subject hereby expressly agrees to the transfer of the necessary data outside the Republic of Kazakhstan to the owner of the Glovo platform, to providers of cloud, communication, service or technical services, and to manufacturers and service centres, where such transfer is required to achieve the stated purpose.

6.3. Cross-border transfer is made to countries that ensure the protection of personal data, or with the Subject's consent and on other grounds and with other measures provided for by the legislation of the Republic of Kazakhstan. Only the minimum necessary data is transferred.

7. Public sources and publication

7.1. This consent does not make the Subject's personal data publicly available, does not remove its confidentiality and does not allow an indefinite range of persons to use it freely.

7.2. The Operator does not place personal data in public sources on the basis of this consent. Publishing a name, image, review, username, details of a promotion winner or other data is allowed only on the basis of the Subject's separate consent or another lawful basis.

7.3. If the Subject publishes a review, comment, photo or other information on the Operator's public page or a third-party platform themselves, the visibility of that publication is determined by the settings and rules of the resource concerned. This does not give the Operator an unlimited right to disclose other data of the Subject.

8. Term of the consent

8.1. The consent takes effect when the Subject confirms it and remains in force until the purposes of processing are achieved or until it is withdrawn, whichever comes first, unless longer processing is required by law or by an unfulfilled obligation.

8.2. Account data is processed for as long as the account is used and for the period needed to close the account, complete outstanding orders and settle enquiries. Data on orders, payments, returns, warranty service and claims is kept for the mandatory periods of accounting, tax, consumer and other applicable records.

8.3. Data used only for marketing messages is processed until the separate marketing consent is withdrawn or the channel or program concerned ends.

8.4. Once the purpose is achieved, the mandatory period expires or a valid withdrawal is received, the data is destroyed, anonymised or blocked in the established manner. Copies in backup systems are deleted within the normal backup retention cycle, with access and use restricted in the meantime.

9. Messages and separate marketing consent

9.1. The Operator may send, without separate marketing consent, service messages needed for registration, security, fulfilling an order, payment, delivery, exchange, return, warranty and replying to an enquiry.

9.2. Advertising phone calls, SMS, e-mails, messages on social networks and messengers, personalised offers, and invitations to promotions, loyalty programs, surveys, research and events are sent only after the Subject's separate choice:

☐ I agree to receive advertising and information messages ☐ I do not agree

9.3. The Subject may opt out of marketing messages at any time using the unsubscribe link or command in the message, the account settings, or by contacting the Operator. Opting out does not stop necessary service messages.

9.4. Using data about activity on the website to personalise advertising also depends on the cookie settings chosen by the Subject and is not automatically included in the main consent.

10. Withdrawal of consent and requests

10.1. The Subject may withdraw the consent in full or in part, clarify or add to the data, request information about its processing, and demand that the data be corrected, blocked or destroyed where there are grounds for this under the law.

10.2. Requests are sent by e-mail to contact@bigsmoke.kz, by post to 21 Al-Farabi Avenue, non-residential premises 1177, Almaty, Republic of Kazakhstan, 050013 (A15E2X1), through an available form on Bigsmoke.kz, or by phone on +7 778 888 78 81 and +7 778 888 68 81. The Operator may ask for information needed to confirm the applicant's identity and protect the data from unauthorised access.

10.3. Within 15 (fifteen) business days of receiving a valid withdrawal, the Operator stops the relevant processing, unless storage or processing is required by law or an unfulfilled obligation, or sends a reasoned refusal.

10.4. Consent cannot be withdrawn where withdrawal would contradict the legislation of the Republic of Kazakhstan or where the Subject and the Operator have an unfulfilled obligation. In such cases processing is limited to the necessary lawful purpose and period.

10.5. Withdrawal of consent does not affect the lawfulness of processing carried out before it was received. Withdrawing an optional part of the consent does not stop processing needed to fulfil an order, consider a claim, observe document retention periods or protect legitimate rights.

11. Form and confirmation of consent

11.1. Consent may be given on paper, through a state or non-state service, or in another way that allows its receipt by the Operator to be confirmed.

11.2. Where consent is given electronically, it is confirmed by an active action of the Subject: ticking an empty consent box themselves and pressing the button to register, continue or confirm. Silence, inaction or a pre-ticked box do not count as consent.

11.3. To evidence the consent, the Operator records the Subject's surname, first name and patronymic, the account or order ID, the date and time, the method of confirmation, the version of the consent text, the IP address and the necessary technical information. These records are kept to confirm the lawfulness of processing and to protect the rights of the parties.

11.4. This electronic consent is deemed given in a form that allows its receipt to be confirmed and applies to relations arising after it is confirmed. The current version of the consent text must be available to the Subject.

12. Confirmation details

☐ I have read this document and give IE «VR46» my consent to the collection and processing of my personal data on the terms set out in it

Subject's surname, first name and patronymic: ______________________________________________________

Subject's IIN, if required for a particular transaction: _________________________________

Account or order ID: ______________________________________________

Date and time consent was given: _________________________________________________

Method of confirmation: ☐ electronic tick and button ☐ signature ☐ other: _____________

Subject's signature if on paper: ______________________________________________

Where the form is electronic, the field values required by law may be included automatically in the consent record from the account, the order or the form filled in by the Subject.

13. Related documents

13.1. Privacy and Personal Data Processing Policy of IE «VR46».

13.2. Cookie Policy.

13.3. For questions about the processing and protection of personal data: contact@bigsmoke.kz; +7 778 888 78 81; support +7 778 888 68 81.

This is a translation. In the event of any discrepancy, the Russian version prevails.