We do not openly display our products. Users request visual information about a specific product themselves after completing the age check and reviewing the product list. All product information on BigSmoke.kz is provided solely to inform visitors about the product list and key characteristics.
BigSmoke

Privacy policy

Last updated and effective from: 1 September 2026

1. General provisions

This Privacy and Consumer Personal Data Processing Policy (the «Policy») sets out how the personal data of users of the website www.bigsmoke.kz, buyers, customers and other persons dealing with IE «VR46» is collected, processed, stored, used, transferred and protected.

The Policy applies to every way of dealing with IE «VR46», including the website, shops, events, e-mail, telephone, social networks, feedback forms, loyalty programs and other physical or electronic channels.

If the provisions of this Policy conflict with the legislation of the Republic of Kazakhstan or with the terms of a separate consent to the collection and processing of personal data, the legislation of the Republic of Kazakhstan and the terms of that consent apply.

Personal data is processed in accordance with the legislation of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan «On Personal Data and Its Protection».

2. Who processes personal data

The owner and operator of the database containing personal data is:

Name: IE «VR46»
Individual entrepreneur: Rustem Nurlanovich Mukhtarov
IIN: 910605300019
Address: 21 Al-Farabi Avenue, non-residential premises 1177, Almaty, Republic of Kazakhstan, 050013 (A15E2X1)
E-mail: contact@bigsmoke.kz
Phone: +7 778 888 78 81
Support phone: +7 778 888 68 81

In this Policy, «we», «us» and «our» mean IE «VR46», and «you», «your» and «user» mean the individual whose personal data is processed.

3. Who the Policy covers

The Policy covers the personal data of:

  • visitors and registered users of the Website;
  • buyers and potential buyers;
  • participants in loyalty programs, events, surveys and research;
  • people who contact support;
  • recipients of information messages;
  • representatives of counterparties and business partners;
  • other persons who provide us with their personal data.

The Website and the services related to tobacco or nicotine-containing products are intended solely for persons aged 21 or over.

We do not knowingly collect the personal data of persons under 21 to give them access to age-restricted information, goods or services. If we become aware that such data has been received without a proper legal basis, it will be blocked or destroyed in the established manner.

4. How we obtain personal data

4.1. Data provided directly by the user

We may receive personal data when you:

  • register or create an account;
  • fill in forms on the Website;
  • buy, order or reserve goods;
  • take part in a loyalty program;
  • ask for warranty or other service;
  • send an enquiry, claim, review or request;
  • contact us by phone, e-mail or through social networks;
  • take part in surveys, events, contests or promotions permitted by law;
  • subscribe to information or marketing messages permitted by law;
  • give consent to the collection and processing of personal data;
  • deal with us in any other way.

4.2. Data collected automatically

When you use the Website, the following may be collected automatically:

  • IP address;
  • browser type and version;
  • device type and operating system;
  • device and session identifiers;
  • date and time of the visit;
  • session duration;
  • pages viewed;
  • links followed;
  • search queries on the Website;
  • the address of the page from which the user came to the Website;
  • approximate location determined from the IP address;
  • information about technical errors;
  • cookies and data from similar technologies.

Detailed information about the cookies used, their purpose and how to manage them is given in the Cookie Policy.

4.3. Data received from third parties

In the cases provided for by law and the relevant consent, we may receive personal data:

  • from payment organisations;
  • from delivery services;
  • from loyalty program providers;
  • from service and warranty organisations;
  • from partners with whom an event permitted by law is held;
  • from social networks, if the user has made the information public themselves or contacted us through a social network;
  • from other lawful and verified sources.

The mere fact that information has been made public does not remove the obligation to process it in accordance with the legislation of the Republic of Kazakhstan.

5. What personal data we may process

Depending on the nature of the interaction, we may process the following categories of data.

5.1. Identification data

  • surname, first name and patronymic;
  • date of birth;
  • age;
  • sex;
  • citizenship;
  • information needed to confirm identity and age;
  • identity document details;
  • a copy or image of an identity document;
  • a photograph or image of the face for age verification.

Copies of documents, facial images and biometric data are processed only where the relevant verification method is actually used, where there is the necessary legal basis and, where required, separate consent.

5.2. Contact data

  • phone number;
  • e-mail address;
  • home address;
  • delivery address;
  • postcode;
  • social network accounts or usernames;
  • preferred means of contact.

5.3. Account data

  • username;
  • account ID;
  • password in protected or encrypted form;
  • date of registration;
  • login history;
  • chosen settings;
  • cart contents;
  • information about participation in a loyalty program;
  • history of bonuses earned and used.

We do not store passwords in plain text.

5.4. Purchase and service information

  • information about goods selected, bought or reserved;
  • date, time, price and place of purchase;
  • order number;
  • address and delivery details;
  • information about returns or exchanges;
  • cash-register and payment documents;
  • history of warranty and other service;
  • the content of enquiries and support replies.

5.5. Payment information

When paying, the information needed to make the payment may be processed.

Full bank card details may be processed directly by the bank, payment organisation or payment service. IE «VR46» does not receive or store bank card details: it has access only to the fact, amount, date and method of payment.

5.6. Preferences and interaction

  • preferred goods and product categories;
  • survey answers;
  • reviews and enquiries;
  • participation in events;
  • responses to messages sent;
  • history of interaction with the Website, shops and support;
  • information about consumer interests permitted by law.

5.7. Technical data

  • IP address;
  • device identifiers;
  • cookies;
  • browser and operating system information;
  • technical logs;
  • data on visits to and use of the Website;
  • information about failures, suspicious activity and attempts at unauthorised access.

We collect only the personal data that is necessary and sufficient for the stated purposes of processing.

6. Purposes of processing personal data

We may process personal data for the following purposes:

  • Verifying identity and that the user is aged 21 or over.
  • Registering the user and managing the account.
  • Providing access to sections and functions of the Website.
  • Accepting, handling and fulfilling orders or reservations to the extent permitted by law.
  • Processing payments, refunds and payment documents.
  • Arranging delivery or handover of goods.
  • Providing warranty, service and customer care.
  • Handling enquiries, requests, claims and reviews.
  • Running loyalty programs.
  • Preventing fraud, abuse and unauthorised access.
  • Ensuring information security and stable operation of the Website.
  • Complying with the tax, accounting, trade and other legislation of the Republic of Kazakhstan.
  • Keeping internal records and reports.
  • Analysing the performance of the Website, shops, support and other channels.
  • Improving the quality of service, the functionality of the Website, the range and the user experience.
  • Conducting surveys and research into the customer experience.
  • Sending information and marketing messages with the necessary consent and only about products, services and events that the law does not prohibit informing about.
  • Protecting the rights and legitimate interests of IE «VR46», users and third parties.
  • Considering and settling disputes.
  • Other purposes of which the user is informed before the relevant processing begins.

Personal data is not used for purposes incompatible with those communicated when it was collected. For a new purpose, we ask for additional consent where the law requires it.

7. Legal grounds for processing

We process personal data on the following grounds:

  • the consent of the data subject;
  • the need to conclude or perform a contract with the user;
  • performance of obligations established by the legislation of the Republic of Kazakhstan;
  • protection of the rights and legitimate interests of the user, IE «VR46» or third parties in the cases provided for by law;
  • other grounds expressly provided for by the legislation of the Republic of Kazakhstan.

Where processing is based on consent, the consent is given in a way that allows its receipt to be confirmed.

Refusing to provide mandatory data may make it impossible to:

  • register an account;
  • confirm age;
  • give access to certain sections of the Website;
  • place or fulfil an order;
  • provide delivery;
  • meet the requirements of a loyalty program;
  • provide warranty or other service;
  • consider the user's enquiry.

Providing data that is not mandatory is voluntary.

8. Information and marketing messages

We may send the user electronic, telephone or other messages where we have the necessary consent and provided the content of the messages is not prohibited by the legislation of the Republic of Kazakhstan.

The user can opt out of such messages by:

Opting out of marketing messages does not apply to service notifications needed to fulfil an order, keep the account secure, reply to an enquiry or comply with the law.

9. Automated processing and profiling

To analyse the use of the Website and improve our service, we may automatically group information about users' actions, interests and preferences.

Such processing may be used to:

  • tailor the content of the Website;
  • remember user preferences;
  • analyse demand for goods and services;
  • ensure security;
  • produce anonymised statistics;
  • send personalised messages permitted by law where consent has been given.

Decisions producing legal effects for the user based solely on automated processing are not made.

If such processing is introduced, the user will be given the necessary information before it starts and asked for consent in the cases established by law.

10. Who personal data may be shared with

Within the stated purposes and where there is a legal basis, personal data may be provided to:

  • employees and authorised representatives of IE «VR46»;
  • providers of hosting and technical support for the Website;
  • providers of CRM systems and loyalty programs;
  • telecom operators and messaging services;
  • banks, payment organisations and payment services;
  • courier and logistics companies;
  • warranty, repair and service centres;
  • providers of age and identity verification services;
  • providers of analytics services;
  • consultants, auditors, accountants and legal representatives;
  • business partners — only within the relevant consent or contract;
  • public and law enforcement authorities — where there is a lawful demand;
  • courts and other persons — where necessary to protect legitimate rights;
  • a successor or acquirer of the relevant part of the business — in the manner provided for by law.

The main operators and third parties entrusted with processing personal data:

  • PS Internet Company (PS.kz), Almaty — hosting of the Website server and database;
  • Telegram — notifications to shop staff about new orders (name, phone, e-mail, address and order contents);
  • WhatsApp — correspondence with the buyer about an order, if the buyer chose this channel;
  • Glovo — fulfilment of orders placed through the Glovo platform;
  • Kaspi Bank JSC and Halyk Bank (People's Savings Bank of Kazakhstan JSC) — accepting payment by QR code;
  • Google — the map on the Contact page and, once connected and only with the user's consent, web analytics.

Persons given access to personal data must keep it confidential, use it only for the agreed purposes and take the necessary protective measures.

We do not sell users' personal data.

11. Data storage and cross-border transfer

The database containing users' personal data is stored in the Republic of Kazakhstan.

Location of the main personal data database: Almaty, Republic of Kazakhstan, on a server of the hosting provider PS.kz.

Personal data may be transferred outside the Republic of Kazakhstan only in compliance with the legislation of the Republic of Kazakhstan, including the requirements for data protection in the country concerned, and where there is consent or another lawful basis.

Foreign services through which data may be transferred: Telegram, WhatsApp, Glovo, Google, and Yandex — once web analytics is connected and only with the user's consent. The servers of these services may be located outside the Republic of Kazakhstan.

12. Personal data retention periods

Personal data is kept no longer than necessary to achieve the purposes for which it was collected and processed, unless a longer period is established by law or contract.

Indicative periods are as follows:

  • data of an active account — for as long as the account is used and, after it is deleted, for the period needed to complete settlements and deal with enquiries;
  • information about an incomplete registration — until registration is completed or deleted at the user's request;
  • information about orders and settlements — for the period of fulfilling the order and the subsequent period established by tax, accounting and other legislation;
  • information about warranty service — for the warranty period and the period for considering possible claims;
  • support enquiries — for the period of considering the enquiry and, after it is closed, for the period needed to protect the rights of the parties;
  • recordings of phone calls, if made with notice to the user — for the period needed to consider the enquiry;
  • loyalty program data — until participation ends and, after that, for the period needed to complete settlements;
  • marketing data — until consent is withdrawn or the mailing concerned ends;
  • technical logs and security information — for the period needed to ensure security and investigate incidents;
  • analytics data — until the purposes of the analysis are achieved, after which it is deleted or anonymised;
  • data needed to resolve disputes — until the applicable limitation periods expire and the relevant proceedings are completed.

Once the purposes of processing are achieved, personal data is destroyed or anonymised unless the law requires it to be kept further.

13. Protection of personal data

We apply the necessary legal, organisational and technical measures to protect personal data against:

  • unauthorised or accidental access;
  • alteration;
  • copying;
  • disclosure;
  • dissemination;
  • blocking;
  • loss;
  • destruction;
  • other unlawful actions.

Depending on the nature of the data and the systems used, such measures may include:

  • separation of access rights;
  • identification and authentication of users;
  • use of secure connections;
  • encryption and hashing;
  • backups;
  • security logs;
  • software updates;
  • monitoring the actions of persons with access to the data;
  • confidentiality obligations of employees and suppliers;
  • regular assessment and mitigation of security risks.

No method of transmitting or storing information is absolutely secure. Nevertheless, we take protective measures to the extent required by law and appropriate to the nature of the data processed.

If a personal data security breach is detected, we take measures to stop the breach, reduce possible harm and notify the competent persons or authorities in the cases provided for by law.

14. User rights

In accordance with the legislation of the Republic of Kazakhstan, the user has the right to:

  • know whether we hold their personal data;
  • receive information about the purposes, methods and periods of processing;
  • receive information about the sources of the data;
  • receive information about the persons who have access to the data;
  • demand access to their personal data;
  • demand that inaccurate or incomplete data be changed or supplemented;
  • demand that personal data be blocked where there are lawful grounds;
  • demand the destruction of data collected or processed in breach of the law, or after the purposes of processing have been achieved;
  • withdraw consent to the collection and processing of data, unless further processing is required by law;
  • opt out of marketing messages;
  • appeal against our actions or inaction to a competent public authority or a court;
  • exercise other rights provided for by the legislation of the Republic of Kazakhstan.

To exercise their rights, the user may send a request:

E-mail: contact@bigsmoke.kz
Postal address: 21 Al-Farabi Avenue, non-residential premises 1177, Almaty, Republic of Kazakhstan, 050013 (A15E2X1)
Support phone: +7 778 888 68 81

To protect the data, we may ask for information needed to confirm the applicant's identity.

After receiving a withdrawal of consent, we stop processing the personal data within the period provided by law, unless further storage or processing is required by law. Where there are lawful grounds to continue processing, the user is given a reasoned reply.

Withdrawal of consent does not affect the lawfulness of processing carried out before it was received.

15. Cookies

The Website may use essential, functional, analytics and, with consent, advertising cookies.

The user can manage optional cookies through the settings of the Website or the browser. Disabling essential cookies may cause some functions to work incorrectly.

Categories, providers, retention periods and ways of disabling cookies are set out in the separate Cookie Policy.

16. Third-party websites and services

The Website may contain links to third-party websites and services. This Policy does not govern the processing of data by the owners of such resources.

Before using a third-party resource, the user should read its terms and privacy policy.

17. Changes to the Policy

We may change this Policy in connection with changes in the law, the ways in which data is processed, the structure of the Website or the services used.

The current version is published on the Website. If the nature of the changes requires separate notice or new consent, we will take the relevant steps in the manner provided for by law.

This version was last updated and took effect on 1 September 2026.

18. Contact information

For questions about the processing and protection of personal data, please contact IE «VR46»:

Individual entrepreneur: Rustem Nurlanovich Mukhtarov
IIN: 910605300019
Address: 21 Al-Farabi Avenue, non-residential premises 1177, Almaty, Republic of Kazakhstan, 050013 (A15E2X1)
E-mail: contact@bigsmoke.kz
Phone: +7 778 888 78 81
Support phone: +7 778 888 68 81
Person responsible for personal data processing: Rustem Mukhtarov

This is a translation. In the event of any discrepancy, the Russian version prevails.