Privacy Policy

1. Introduction

Bay Smokes Europe is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data in accordance with the General Data Protection Regulation (GDPR/AVG) and applicable Dutch data protection laws.

Please read this Privacy Policy carefully before using baysmokes.nl (the “Site”) or purchasing products from us. By using the Site, you agree to the data processing practices described in this policy.

2. Data Controller Information

Under Article 4(7) of the GDPR, the data controller is:

Bay Smokes Europe
📧 Email: offer@baysmokes.nl
🌐 Website: https://baysmokes.nl

3. Personal Data We Collect

We may collect and process the following categories of personal data:

Data Category	Specific Examples	Collection Scenario
Identity Data	Name, date of birth	Registration, orders, age verification
Contact Data	Email address, phone number, delivery address	Orders, delivery, customer service
Transaction Data	Order details, payment information (full card numbers not stored), purchase history	Processing orders and refunds
Technical Data	IP address, browser type, device information, operating system	Website operation and security
Usage Data	Browsing behaviour, pages visited, time spent	Analytics and service improvement
Communication Data	Chat records with support, email correspondence	Customer support

4. Legal Bases for Processing Personal Data

Under Article 6(1) of the GDPR, we process your personal data only when we have at least one of the following lawful bases:

4.1 Performance of a Contract (Article 6(1)(b) GDPR)

We need to process your data to perform our contract of sale with you or to take steps at your request before entering into a contract, including:

Processing orders and deliveries
Processing payments and refunds
Providing customer support

4.2 Legal Obligation (Article 6(1)(c) GDPR)

We may process your data to comply with applicable legal obligations, such as tax and accounting requirements.

4.3 Legitimate Interests (Article 6(1)(f) GDPR)

We may process your data for the following legitimate interests:

Fraud prevention and abuse detection
Website security
Improving our products and services

4.4 Consent (Article 6(1)(a) GDPR)

We will ask for your explicit consent in the following situations:

Sending marketing communications (e.g., email newsletters)
Placing non-essential cookies (e.g., analytical and advertising cookies)

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

5. Cookies and Similar Technologies

5.1 Types of Cookies We Use

In accordance with Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet) and the GDPR, we use the following types of cookies:

Cookie Category	Consent Required?	Purpose
Necessary Cookies	No	Essential website functions (login, shopping cart, consent preferences)
Functional Cookies	No	Remembering your preferences (language, region)
Analytical Cookies	Generally no, but must be disclosed	Understanding how visitors use the website
Advertising/Tracking Cookies	Yes – explicit consent required	Personalised advertising, cross-site tracking

5.2 Your Cookie Choices

On your first visit, we display a cookie banner requesting your consent for non-essential cookies
You can change or withdraw your cookie preferences at any time
We do not use “cookie walls” – you can still access the website even if you refuse non-essential cookies
Information about cookie retention periods is available in the cookie settings

5.3 Third-Party Cookies

We may use cookies from third-party services (such as analytics tools and payment processors). These third parties have their own privacy policies, which we recommend you review.

6. Data Sharing

6.1 Who We Share Data With

We may share your personal data in the following circumstances:

Recipient	Purpose of Sharing	Legal Basis
Delivery service providers (PostNL, DHL, etc.)	Delivering orders	Performance of contract
Payment processors	Processing payments and refunds	Performance of contract
IT service providers	Website hosting, email services	Legitimate interests
Legal/regulatory authorities	Complying with legal obligations or responding to lawful requests	Legal obligation

6.2 Data Sales

We do not sell your personal data to third parties.

6.3 Cross-Border Data Transfers

If we transfer data to countries outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) or adequacy decisions.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal retention requirements:

Data Type	Retention Period
Account data	Duration of account activity + 30 days after deletion request
Transaction records	7 years (tax/accounting requirements)
Marketing consent records	Deleted immediately upon withdrawal of consent
Website analytics data	Maximum 26 months

When retention periods expire, we securely delete or anonymise your data.

8. Your Rights

Under the GDPR, you have the following rights:

8.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data.

8.2 Right to Rectification (Article 16 GDPR)

You have the right to request correction of inaccurate or incomplete personal data.

8.3 Right to Erasure / “Right to Be Forgotten” (Article 17 GDPR)

In certain circumstances, you have the right to request deletion of your personal data, for example when the data is no longer necessary or the processing is unlawful.

8.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request restriction of the processing of your data.

8.5 Right to Data Portability (Article 20 GDPR)

You have the right to receive your data in a structured, commonly used, and machine-readable format, and to request its transfer to another controller where technically feasible.

8.6 Right to Object (Article 21 GDPR)

You have the right to object to processing based on legitimate interests and to direct marketing.

8.7 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time.

8.8 How to Exercise Your Rights

To exercise any of these rights, please contact us at offer@baysmokes.nl. We will respond to your request within one month. If an extension is needed (up to two additional months), we will inform you.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

SSL/TLS encryption to protect data in transit
Access controls limiting employee access
Secure storage and regular backups
PCI DSS compliant payment processing

While we strive to protect your data, no method of internet transmission or storage is 100% secure.

10. Data Breach Notification

If a data breach occurs that may pose a high risk to your rights and freedoms, we will:

Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours
Notify you promptly where appropriate

11. Children’s Privacy

Our products and services are intended only for individuals aged 18 and over. We do not knowingly collect personal data from minors. If we discover that we have collected data from a minor, we will delete it immediately.

12. Complaints to the Data Protection Authority

If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Autoriteit Persoonsgegevens
🌐 Website: https://autoriteitpersoonsgegevens.nl
📞 Phone: 088 – 1805 250 (Monday–Friday, 09:00–15:00)

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Posting the updated version on the Site
Sending an email (if you have an account)
Posting a prominent notice on the Site

Continued use of the Site constitutes acceptance of the updated Privacy Policy.

14. Records of Processing Activities

Under Article 30 of the GDPR, we are required to maintain records of processing activities (Verwerkingsregister). These records include:

Purposes of processing
Categories of personal data
Categories of recipients
Retention periods
Technical and organisational security measures

You may request access to relevant records at offer@baysmokes.nl (to the extent permitted by applicable law).

15. Summary of Key Information

Topic	Summary
Data Controller	Bay Smokes Europe
Primary Legal Bases	Contract performance, legal obligation, legitimate interests, consent
Data Sharing	Delivery providers, payment processors, IT service providers
Data Sales	No, we do not sell data.
Retention Periods	Transaction records 7 years, analytics data up to 26 months
Your Rights	Access, rectification, erasure, restriction, objection, portability
Complaints Authority	Autoriteit Persoonsgegevens
Contact	offer@baysmokes.nl

16. Age Verification and Legal Compliance Notice

Important Notice: Under Dutch law, recreational cannabis is technically illegal, though a tolerance policy (gedoogbeleid) permits limited sales through licensed coffeeshops. Online sales of cannabis products are not protected by the tolerance policy.

As a website operator, you are responsible for ensuring:

Age verification mechanisms comply with legal requirements
No sales to minors
Compliance with applicable consumer protection laws

This Privacy Policy does not constitute legal advice. Bay Smokes strongly recommends consulting with a qualified Dutch legal professional to ensure full compliance with the GDPR, the Opium Act (Opiumwet), and all applicable regulations governing the sale of cannabis-related products in the Netherlands.

This Privacy Policy is effective as of the last updated date.

Please Download Threema App

to your Mobile Device and click again

Bay Smokes