Privacy & Cookie Policy

The controller of your personal data is Fumant Ltd., Gradina 19, 1700 Sofia, Bulgaria, registration no. 206275820. For any privacy question or request, email contact@fumant.net.

This policy explains what personal data we collect when you visit fumant.net or buy from us, why we use it, who we share it with, and what your rights are under the EU General Data Protection Regulation (GDPR).

When you place an order

We collect your name, email address, phone number, delivery and billing address, the products you order, prices, any discount code and the payment status. We use this to process and deliver your order, send order emails (order acknowledgement and Order Confirmation with tracking), handle returns and warranty claims, and meet our accounting and tax obligations. We need this data to fulfil your order; without it, we can't sell to you.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations (Art. 6(1)(c) GDPR).

Payments

Payments are processed by PayPal and, for card payments, by Braintree, a PayPal service. We receive the payment status, a transaction ID and limited details such as the payment method used. We never receive or store your full card number. PayPal may run fraud checks and 3-D Secure authentication.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).

Delivery

We give your name, delivery address, phone number and email address to DHL so they can deliver your parcel and keep you informed about it. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Support and enquiries

When you contact us through the support form, by email or through another form on our site, we process your name, contact details, your message and any order details you give us so that we can reply. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) where your request relates to an order, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Newsletter

Our newsletter is opt-in. If you sign up, we use your email address to send you news and offers. You can unsubscribe at any time with the link in every newsletter or by emailing us. Legal basis: your consent (Art. 6(1)(a) GDPR).

Browsing our website

When you browse our site, our hosting provider processes technical data such as your IP address, browser type and the pages you request, to deliver the site and keep it secure. We also use Vercel Web Analytics, a privacy-friendly tool that counts visits in aggregate without cookies and without identifying you. Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).

Analytics and marketing (only with your consent)

If you accept analytics cookies, we use Google Analytics 4, loaded through Google Tag Manager, to understand how visitors use our shop. If you accept marketing cookies, we use the Meta Pixel and Meta Conversions API, and possibly the TikTok Pixel, to measure our ads and show relevant ads on those platforms. None of these tools load until you agree. Legal basis: your consent (Art. 6(1)(a) GDPR and the rules on cookies).

With marketing consent, the Meta Conversions API sends certain events, such as a completed purchase, from our server directly to Meta. These events may include pseudonymised (hashed) contact details, such as your email address, so that Meta can match them to an account. Without marketing consent, nothing is sent. We and Meta Platforms Ireland Ltd. are joint controllers for collecting and sending this data. Meta's own privacy policy covers what Meta does with it afterwards.

We share personal data only with the service providers we need to run our shop, and only as far as necessary:

• Vercel Inc. (USA): website hosting and cookieless Vercel Web Analytics.
• Neon: database hosting, with our data stored in an EU region.
• PayPal / Braintree (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): payment processing. PayPal processes payment data as an independent controller under its own privacy statement.
• Resend: sending order and service emails.
• DHL Express: delivering your order. DHL receives your name, address, phone number and email address.
• Google Ireland Ltd.: Google Analytics 4 and Google Tag Manager, only with your consent.
• Meta Platforms Ireland Ltd.: Meta Pixel and Conversions API, only with your marketing consent.
• TikTok Technology Ltd. (Ireland): TikTok Pixel, if we use it, only with your marketing consent.

We may also disclose data to authorities, courts, or our accountants and legal advisers when the law requires it or when we need to establish, exercise or defend legal claims. We never sell your personal data.

Some providers, such as Vercel, Resend, Google, Meta and TikTok, may process data in the USA or other countries outside the EU/EEA. In those cases the transfer is protected by an EU adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or by the European Commission's Standard Contractual Clauses.

Cookies are small files stored by your browser. Some features also use your browser's local storage. We group them as follows.

Strictly necessary (always on)

• Shopping cart (browser local storage): remembers what's in your cart.
• NEXT_LOCALE (cookie): remembers your language.
• Consent choice: remembers your cookie settings so we don't ask on every visit.
• Admin session: used only when our staff log in. Customers never get this cookie.

The site needs these to work, so they don't require consent. When you pay with PayPal or by card, PayPal or Braintree may set their own cookies needed for secure payment and fraud prevention.

Analytics (only with consent)

• Google Analytics 4 (_ga, _ga_XXXXXXXX): tells visitors and sessions apart to produce usage statistics. Kept for up to 2 years.

Marketing (only with consent)

• Meta Pixel (_fbp, _fbc): measures ad performance and helps show relevant ads on Facebook and Instagram. Kept for up to 90 days.
• TikTok Pixel (_ttp), if used: measures ad performance on TikTok. Kept for up to 13 months.

On your first visit we ask whether you consent to analytics and marketing cookies, and nothing in those categories loads until you agree. You can change or withdraw your consent at any time via the Cookie settings link in the footer. Withdrawing consent doesn't affect anything processed before. You can also delete cookies in your browser settings.

• Orders, invoices and related records: 10 years, as Bulgarian accounting law requires.
• Support messages and enquiries: 3 years.
• Newsletter: until you unsubscribe.
• Cookies: for the periods listed above, or until you delete them or withdraw your consent.

When these periods end, we delete or anonymise the data.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, unless we have to keep it by law (for example, order records);
• restrict how we process your data;
• receive your data in a portable format;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw your consent at any time. This doesn't affect processing that took place before.

To use any of these rights, email contact@fumant.net. We reply within one month and may ask you to confirm your identity. We don't make decisions about you based solely on automated processing.

If you think we have mishandled your data, please contact us first. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg) or to the data protection authority of the EU country where you live or work.

Our site uses encrypted HTTPS connections. Payments are handled by PCI DSS-compliant providers, and only the people who need customer data to do their work can access it.

Our shop is for adults aged 18 and over. We don't knowingly collect data from anyone under 18.

We may update this policy when our services or the law change. The current version is always on this page, with the date of the last update at the top.