Privacy Policy
Last updated: 26 September 2026
This Privacy Policy explains how Smoking Marketing Ltd. collects, uses, shares, and retains personal data when you use Smoking-Hub.com and the related Smoking Hub and Cigar Deal Hunters services we operate, including accounts, forums, deal submissions, newsletters, alerts, community programs, and support (the “Service”).
This Policy provides information about our practices. Visiting the Service or agreeing to our Terms does not by itself give consent to optional tracking, marketing, or other processing that requires consent.
1. Who is responsible for your data?
Smoking Marketing Ltd. is the controller of the personal data processed for the purposes described in this Policy.
UIC: 208445982
Registered address: Lyulyak 5, Pazardzhik, 4404, Bulgaria (European Union)
Privacy contact: admin@smoking-hub.com
Our audience is primarily in the United States. As a company established in Bulgaria, we process personal data in the context of that establishment under the EU General Data Protection Regulation (GDPR), including where the person concerned is outside the EU. Other applicable privacy laws may provide additional rights.
2. Age requirement
The Service is for people aged 21 or older, or a higher age where required for their participation. We do not knowingly offer accounts or marketing subscriptions to people below this requirement.
If you believe an ineligible person has provided personal data, contact us. We will investigate and remove or restrict the relevant information as appropriate, retaining only what is lawfully necessary for purposes such as documenting the action or preventing repeated misuse.
3. Information you provide
The information depends on the features you use:
| Feature | Information involved |
|---|---|
| Account registration and login | Email address, username, account identifier, password authentication data, account status, and registration and login records. |
| Profile | Display name, avatar, biography, website links, preferences, and other optional fields you choose to complete. |
| Forum and deal participation | Topics, comments, reviews, deal submissions, deal requests, images, attachments, links, edits, and submission times. |
| Saved deals and wishlists | Items you save, selected products or topics, and associated preferences and timestamps. |
| Voting and reports | Votes, reactions, reports about expired deals or other content, report explanations, and the account or session associated with the action. |
| Points and community programs | Qualifying actions, point transactions, balances, ranks, badges, leaderboard position, eligibility records, corrections, and rewards history. |
| Newsletters and alerts | Email address, subscription preferences, selected interests, and subscription or withdrawal records. |
| Support and legal reports | Contact details, correspondence, URLs, evidence, and information needed to investigate complaints, rights requests, or copyright reports. |
If you claim a reward, we may additionally request the information necessary to verify eligibility and arrange delivery, such as your name, country or state, contact details, delivery address, or a limited age-confirmation result. The particular promotion will explain its requirements. We request tax or identity documentation only where justified and through an appropriate channel.
Do not post payment credentials, government identification, health information, or other unnecessary sensitive information in public posts or support attachments. Uploaded files can contain personal data in their contents or metadata.
Optional profile fields, public contributions, and marketing subscriptions are voluntary. If you do not provide necessary information, we may be unable to provide the relevant feature.
4. Technical data and information from other sources
Website and security records
We process technical information such as IP address, browser and device type, operating system, requested pages, referral information, timestamps, login events, error records, and security indicators. An IP address may indicate an approximate country or region. These records support delivery of the website, troubleshooting, and abuse prevention.
Cookies, analytics, and advertising
Depending on your choices and the tools enabled, cookies, local storage, pixels, and similar technologies may collect device or browser identifiers, page views, clicks, referral details, and interactions with the Service. Section 8 explains these technologies and your controls.
Email and push delivery
Our email provider, ActiveCampaign, processes delivery, bounce, and unsubscribe records. We utilize open tracking to record when emails are opened and tracked links to record which specific links are clicked. These tracking functions operate based on your consent to receive communications, which can be withdrawn at any time using the unsubscribe link provided in our emails.
If you enable browser push notifications, a push subscription can include a device or browser token, subscription endpoint, technical delivery information, and your chosen topics. We use OneSignal as our push notification provider to process and deliver these notifications.
Retailers, networks, and other members
Affiliate networks or retailers may provide us with conversion reports, including order value, commission and whether a referral was approved, reversed, or refunded. The fields depend on the partner.
We do not collect card numbers or bank credentials to process purchases made on retailers’ websites. Retailers handle their own checkout information under their own policies.
Other people may identify you in a reply, mention, report, or complaint. We may receive public account information when you interact with our official communities on another platform. That platform also handles data under its own policy; membership there does not automatically enroll you in our website or newsletter.
5. Why we use data and our legal bases
| Purpose | Principal data used | GDPR basis |
|---|---|---|
| Provide requested accounts and community features | Account, profile, submissions, saved items, and interaction records | Performance of our agreement with you, where the processing is objectively necessary for the requested feature. |
| Administer participation, points, and published reward programs | Qualifying activity, point history, eligibility, and fulfillment information | Performance of the applicable program agreement; legal obligation for required reporting. |
| Send newsletters and promotional deal alerts | Contact details, selected topics, and subscription records | Consent. |
| Deliver optional browser push notifications | Subscription tokens and notification preferences | Consent to the relevant subscription and required device permissions. |
| Send necessary account or service notices | Account details and relevant service events | Performance of our agreement; legitimate interests in keeping the Service secure and communicating essential changes where appropriate. |
| Run optional analytics, advertising, and tracking-based attribution | Online identifiers and interaction data | Consent where required; we do not use legitimate interests to bypass a device-tracking consent requirement. |
| Reconcile affiliate commissions after a referral | Referral and conversion records | Legitimate interests in measuring and accounting for referral revenue, subject to the required consent for any underlying tracking. |
| Secure the Service, prevent fraud, and moderate abuse | Technical logs, reports, content, account and participation records | Legitimate interests in protecting users, fair participation, and the Service; legal obligation where a specific obligation applies. |
| Answer requests and handle disputes or rights complaints | Contact information, correspondence, and relevant evidence | Legitimate interests in providing support and resolving disputes; performance of an agreement or legal obligation where applicable. |
| Share public contributions in our ordinary community coverage | Public contribution and displayed username | Legitimate interests in operating and documenting the community, balanced against the author’s expectations and rights. Separate consent is used where required, including for an identifiable standalone testimonial. |
| Keep legally required records and respond to lawful demands | Relevant transaction, request, and legal records | Legal obligation; legitimate interests in establishing or defending legal claims where applicable. |
Where we rely on legitimate interests, we consider the necessity of the processing and its effect on you. You can request information about that assessment and object as described in section 13. A copyright license does not replace a GDPR legal basis.
We do not treat account registration or agreement to the Terms as consent to newsletter marketing.
6. What other people can see
Public posts and the profile information displayed with them can be read by other people and may be indexed by search engines or copied outside our control. Public community displays may include your username, avatar, contributions, membership date and badges.
Your email address, authentication information, private support correspondence, nonpublic saved deals, and internal moderation notes are not intentionally published as part of your public profile. Saved deals and wishlists remain nonpublic unless you deliberately use a feature clearly identified as public sharing.
A members-only area limits who can access it through the Service, but other members may still copy its contents. Treat material posted there as visible to that audience.
Administrators and authorized moderators may access information needed for account support, community administration, and investigations. Access is limited according to their roles. Information on external platforms is also subject to those platforms’ settings.
7. Email, account notifications, and browser push
We use ActiveCampaign for newsletter and related email functions. You can unsubscribe from marketing using the link in an email or by contacting us. We may keep a minimal suppression record so that your address is not inadvertently added again.
Unsubscribing from marketing does not close your account. While your account remains active, we may send necessary security, account, moderation, or legal notices. Optional forum or deal subscriptions can be managed through the available subscription controls or by contacting us.
You can withdraw browser push permission in your browser or device settings and use any notification controls offered on the Service. Disabling push does not automatically unsubscribe you from email, and email unsubscribe does not revoke browser permission.
Adding the website to your home screen does not by itself authorize marketing notifications or access to unrelated content on your device.
8. Cookies, tracking, and choices
We use necessary technologies to provide functions such as login sessions, security, and remembering privacy choices. Optional technologies may support preferences, analytics, affiliate attribution, or advertising.
Our Cookie Settings control provides choices about optional categories and information about active vendors, purposes, and cookie durations. You can revisit it to change or withdraw your choices. Browser controls provide additional options, although blocking necessary cookies may affect functionality.
Where prior consent is required, optional cookies and equivalent device tracking are not activated until that consent is given. Rejecting optional tracking does not prevent account registration or ordinary access, although functions that specifically depend on a permission may be unavailable. Withdrawing consent does not make earlier lawful processing unlawful.
The supplied tools to verify for the published version are:
- Google Analytics 4: website measurement, only with the configuration and choices described in Cookie Settings.
- Google Tag Manager: a system for deploying other tags; it is not itself a substitute for consent controls.
- Microsoft Clarity: behavioral analytics, heatmaps, and session recording to evaluate website interaction, subject to the configuration and choices described in Cookie Settings.
- Affiliate networks and retailer technologies: referral attribution, depending on the link, provider, and user choices.
- Cloudflare: strictly necessary security and network routing technologies (such as bot management cookies) required to protect the Service from malicious traffic and ensure availability. These are essential and cannot be disabled.
Embedded media and third-party content may also transmit information to their providers. We obtain permission before loading them where required. Following an external link opens a separate service whose data practices may differ.
9. Who receives personal data
We disclose data only as needed for the purposes described here, with the required legal basis and safeguards:
| Recipient | Purpose and scope |
|---|---|
| Hosting, backup, content-delivery, security, and support providers | Operate, maintain, and protect the Service. |
| Any transactional email or push provider | Deliver communications, manage subscriptions, and process delivery information. |
| Enabled analytics or advertising providers | Measure interactions or deliver advertising functions as described in section 8 and the consent controls. |
| Affiliate networks and retailers | Attribute referrals, reconcile commissions, and address related inquiries; they do not receive your private forum or wishlist information merely because they are a partner. |
| Reward sponsors and fulfillment providers | Verify eligibility or deliver a particular reward using the information needed for that purpose. The promotion identifies the relevant sponsor or provider. |
| Authorized staff, moderators, contractors, and advisers | Support, moderation, administration, accounting, and professional advice within their roles. |
| People involved in a legal report or dispute | Information needed to investigate and respond. Relevant information from copyright reports may be shared with the affected contributor or other parties only where necessary and lawful to investigate or resolve the matter, as explained in section 16 (Copyright and Takedown Requests) of our Terms and Conditions. |
| Authorities or other parties entitled to disclosure | Compliance with a valid legal requirement or protection of legal rights where permitted. |
Providers processing data on our instructions are subject to appropriate processing agreements. Retailers, advertising providers, platforms, and other recipients may act as independent controllers, or in some circumstances joint controllers, for their own purposes; they are not all our processors.
Installing software such as WordPress, wpForo, wpDiscuz, UltimateMember or myCred does not by itself mean its developer receives member data.
In a proposed or completed sale, merger, or restructuring of the business, relevant data may be disclosed to advisers and a prospective or actual successor where lawful, with confidentiality, minimization, and appropriate notice. Such a transaction does not remove your rights or authorize incompatible new uses without the required legal basis.
10. U.S. privacy choices and advertising disclosures
We do not sell your email address, account details, or newsletter subscription records for monetary compensation. However, because we utilize third-party analytics (such as Google Analytics 4 and Microsoft Clarity) and affiliate marketing networks to measure website performance and track referrals, technical data (such as IP addresses, device identifiers, and browsing interactions) transmitted to these partners may constitute “sharing” of personal information under certain U.S. state privacy laws (such as the California Consumer Privacy Act).
Where applicable, you may opt out of this “sharing” of data by rejecting optional cookies in our Cookie Settings. We also honor recognized opt-out preference signals, such as the Global Privacy Control (GPC), transmitted by your browser.
Depending on your state of residence, you may also have the right to access, correct, delete, or receive a copy of your information, limit certain uses of sensitive information, use an authorized agent, or appeal a decision about a request. You can exercise these rights by contacting admin@smoking-hub.com. We will explain any required verification and the decision process. We do not unlawfully discriminate against users for exercising their privacy rights.
11. International transfers
We transfer, store, and process personal data outside the European Economic Area (EEA), specifically in the United States. This includes our primary website hosting infrastructure, which is physically located on U.S. servers, as well as data processed by our third-party service providers for content delivery (Cloudflare), communications (ActiveCampaign, OneSignal), and analytics (Google, Microsoft).
For these restricted cross-border transfers, we rely on recognized legal mechanisms. Where the U.S.-based recipient is certified under the EU-U.S. Data Privacy Framework, we rely on that adequacy decision. For other transfers, we implement the European Commission’s Standard Contractual Clauses (SCCs) alongside required technical and organizational supplementary measures.
You may contact admin@smoking-hub.com for information about the relevant transfer safeguards or a copy, subject to appropriate redactions.
12. Retention and account deletion
We keep personal data for the relevant purpose and then delete or genuinely anonymize it, except where a lawful retention requirement or justified legal claim requires otherwise. Removing a visible post or deactivating an account does not necessarily delete every related record immediately.
| Data | Retention period or determining criteria |
|---|---|
| Active account and private preferences | While needed to provide your account and requested features. After closure, ordinary identifiable account data is removed within 30 days, except for the limited records below. |
| Public contributions and attachments | While the contribution remains published. On closure or an erasure request, we assess deletion or effective anonymization, taking account of applicable rights and lawful exceptions. Merely replacing a username is not anonymization if the remaining content still identifies you. |
| Points and reward eligibility records | While needed for the active program, reconciliation, and its published dispute process; thereafter for 12 months following the conclusion of the specific reward cycle to address accounting and potential disputes. |
| Marketing subscription data | Until withdrawal or removal under our inactive-subscriber policy. |
| Suppression and consent evidence | The minimum information needed to respect an objection or demonstrate a relevant consent, for a period of 5 years after the consent is withdrawn or the account is closed, in alignment with statutory limitation periods for legal claims. These records are not used to restart marketing. |
| Routine security, access, and error logs | 90 days, with relevant extracts retained longer only for a documented incident, legal obligation, or claim. |
| Support, reports, and moderation records | 5 years after resolution, subject to justified continued handling of an active dispute, repeat abuse, or legal claim. |
| GA4 user/event information and other analytics | 14 months for Google Analytics 4 user and event data, and 30 days for Microsoft Clarity session recordings. Aggregated information may be retained longer only if it no longer identifies people. |
| Giveaway entries and ordinary eligibility records | 3 years after the promotion and claim/dispute process ends. Winner, payment, tax, or accounting records follow the applicable legal retention requirements. |
| Push subscription records | Until withdrawal, expiry, or removal of an invalid subscription, followed by deletion within 30 days, apart from a limited record lawfully needed to respect your choice. |
| Backups | Replaced on a rolling cycle of 30 days. Deleted data is not restored to routine use; relevant deletion instructions are reapplied if a backup must be restored. |
A legal hold is limited to the relevant records and is reviewed when the matter ends. We do not retain all account data indefinitely because some records may be needed for legal purposes.
You can request account closure or erasure at admin@smoking-hub.com. For content containing personal data, identify the relevant posts or URLs where possible. We cannot guarantee deletion of independent copies held by other websites, search engines, or recipients, but will take steps required by applicable law.
13. Your GDPR rights
Subject to the conditions and exceptions in the GDPR, you can request access, correction, erasure, restriction of processing, and portability of eligible data. You can withdraw consent and object to processing based on legitimate interests for reasons relating to your situation.
You can object at any time to processing for direct marketing, including related profiling. We will stop using your data for that marketing purpose.
Contact admin@smoking-hub.com. We may request proportionate information to verify your identity and protect other people’s data. We do not routinely require a government ID for every request. Requests are ordinarily free of charge, subject to the limited exceptions permitted by law.
We respond without undue delay and normally within one month. If a lawful extension is necessary because of complexity or number of requests, we will explain it within the initial month; the GDPR permits up to two additional months in those circumstances.
You may complain to a competent supervisory authority, including the Bulgarian Commission for Personal Data Protection (CPDP). Its website provides contact and complaint instructions. You do not have to contact us before approaching the authority.
14. Automated calculations and decisions
Rules may automatically calculate points, ranks, notifications, or eligibility flags from recorded activity. These calculations can affect displayed status and access to particular features. Spam tools may also flag activity for moderation.
For ordinary program questions, contact us for an explanation or human review of an apparent error. If we introduce solely automated decisions producing legal or similarly significant effects, we will provide the information, legal basis, and safeguards required before using that processing.
15. Security
We use technical and organizational measures appropriate to the risks, including access controls and measures to protect account and service information. No system is completely secure. If a breach requires notification to an authority or affected people, we will provide it as required by law.
16. External services
Retailers, social networks, linked websites, and other external services have their own privacy practices. This Policy covers the processing for which we are responsible; it does not replace their notices or excuse our responsibilities for disclosures we initiate.
17. Changes
We may update this Policy when our practices or applicable requirements change. We will revise the date and provide additional notice of material changes where appropriate or required. When a new use requires consent, we will request it before that use. Continued use of the website is not consent to new optional processing.
18. Contact
Privacy questions and rights requests: admin@smoking-hub.com.