Privacy Policy
This policy sets out how personal data of visitors and customers of bigsmoke.kz is collected, processed and protected. Processing is carried out under the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On personal data and its protection". Version of [fill in: date].
1. Owner and operator
1.1. The owner and operator of personal data is [fill in: legal name, BIN, registered address] (the Operator).
1.2. Enquiries about data processing are sent to contact@bigsmoke.kz.
2. Data processed
2.1. When an order is placed: surname and first name, phone number, e-mail address, handover address (city, street, building, postcode), order comment, order contents and total.
2.2. When the contact form is used: the subject, surname and first name, e-mail address, phone number, the message itself, the interface language and the address of the page the form was sent from.
2.3. When an account is registered: e-mail address, password (stored as an irreversible cryptographic hash), saved addresses, wishlist, order history.
2.4. When the site is visited: IP address, cookies, technical request information (browser type, language, time of request).
2.5. The Operator does not collect special categories of data (health, religion, ethnicity) and does not carry out automated decision-making producing legal effects for the data subject.
3. Purposes of processing
3.1. Concluding and performing the contract: confirming the order, agreeing its contents and price, handing over the goods, settling payment.
3.2. Verifying the age restriction under article 110 of the Code "On public health and the healthcare system". The details of the document presented at handover are not recorded or stored by the Operator: the document is shown for a visual age check.
3.3. Handling enquiries, claims and requests to exchange or return goods.
3.4. Meeting obligations under accounting and tax legislation.
3.5. Keeping the site working and secure, including rate-limiting form submissions against automated spam.
4. Legal grounds
4.1. The consent of the data subject, given when placing an order, registering or sending a message.
4.2. The necessity of processing to perform a contract to which the subject is a party.
4.3. Compliance with obligations placed on the Operator by the law of the Republic of Kazakhstan.
5. Disclosure to third parties
5.1. The courier service — the recipient's surname and first name, phone number and address, to the extent needed for delivery.
5.2. Banks and payment organisations — what is needed to settle payments made by Kaspi QR and Halyk QR. Payment card details are neither passed to nor stored by the Operator.
5.3. The hosting provider — by virtue of the information system running on rented hardware.
5.4. State authorities — in the cases and to the extent expressly provided by law, on a reasoned request.
5.5. The Operator does not disclose personal data to third parties for their own marketing and does not sell it.
5.6. Opening the Contact page loads a map hosted by Google LLC; as a result technical data (IP address, browser information) may be processed by that company on terms it sets itself. This is the only cross-border transfer of technical data on the site.
6. Retention periods
6.1. Order data and related documents — [fill in: period, allowing for accounting-record retention rules].
6.2. Contact form messages — [fill in: period] from the date of reply.
6.3. Account data — until the subject deletes the account; afterwards only records of completed transactions are kept, to the extent the law requires.
6.4. Cookies — for the lifetimes set out in the Cookie Policy.
7. Rights of the data subject
7.1. The subject may: obtain information about the data held and its composition; require it to be amended or supplemented where incomplete or inaccurate; require blocking or destruction of data processed in breach of the law; withdraw consent previously given.
7.2. Requests are sent to contact@bigsmoke.kz from the e-mail address used for the order or the account, or in writing to the shop's address. A reply is sent within [fill in: response time].
7.3. Withdrawal of consent does not extend to data whose processing is necessary to perform a contract already concluded or to meet obligations imposed on the Operator by law.
8. Security measures
8.1. Data travels between the browser and the site over a secure protocol (HTTPS).
8.2. Passwords are stored as irreversible cryptographic hashes; access to the order database is limited to a defined group of staff.
8.3. The public part of the site holds no read rights over enquiries and orders: technically it can only write them. Compromise of the storefront's access key would not expose customer records.
9. Data of minors
9.1. The site is not intended for persons under twenty-one. The Operator does not deliberately collect their personal data. Where such data is identified, it is destroyed on request to contact@bigsmoke.kz.
10. Changes to this policy
10.1. The Operator may amend this policy. The current version is published on the site with its date. Significant changes are additionally noted on this page.