Quick answer: We collect your email address only if you subscribe to our newsletter, your name and message if you use the contact form, and anonymous analytics data via Google Analytics. We use essential and analytics cookies. Under UK GDPR you can request access to, correction of, or deletion of your data at any time by emailing info@shishasuperstore.com.

Shisha Superstore ("we", "us", or "our") operates the website https://shishasuperstore.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

Information You Provide

  • Newsletter subscription: If you subscribe to our newsletter, we collect your email address.
  • Contact form: When you use our contact form, we collect your name, email address, and the content of your message.

Information Collected Automatically

  • Analytics data: We use Google Analytics to collect anonymous usage data including pages visited, time spent on pages, referring websites, browser type, and approximate geographic location. This data is aggregated and cannot identify you personally.
  • Cookies: We use essential cookies for website functionality and analytics cookies to understand how visitors interact with our site. See our Cookie section below for more details.
  • Server logs: Our hosting provider may collect standard server log information including IP addresses, browser type, and pages requested.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • To send you our newsletter (only if you have opted in)
  • To respond to your enquiries via our contact form
  • To analyse website traffic and improve our content
  • To maintain the security and functionality of our website

3. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

  • Consent: When you subscribe to our newsletter or accept cookies, you give us consent to process your data for those specific purposes. You may withdraw consent at any time.
  • Legitimate interest: We have a legitimate interest in understanding how visitors use our website so we can improve our content and user experience.
  • Contractual necessity: When you contact us, processing your data is necessary to respond to your enquiry.

4. Cookies

Our website uses the following types of cookies:

Essential Cookies

These cookies are necessary for the website to function properly. They include session cookies and security tokens (CSRF protection). These cannot be disabled.

Analytics Cookies

We use Google Analytics cookies to collect anonymous data about how visitors use our website. These cookies help us understand which pages are most popular and how visitors navigate our site.

  • _ga: Used to distinguish users. Expires after 2 years.
  • _ga_*: Used to persist session state. Expires after 2 years.

Preference Cookies

We store your cookie consent preference in your browser's local storage. This data remains on your device and is not transmitted to our servers.

You can control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling cookies may affect the functionality of our website.

5. Third-Party Services

We use the following third-party services:

  • Google Analytics: For website analytics. Google's privacy policy is available at policies.google.com/privacy.
  • Google Fonts: For web typography. Font files are loaded from Google's servers.
  • Pexels: For stock photography used in our articles. Images are loaded from Pexels' CDN.

6. Data Retention

  • Newsletter subscriptions: We retain your email address until you unsubscribe.
  • Contact form messages: We retain messages for up to 12 months after our last communication.
  • Analytics data: Google Analytics data is retained for 26 months.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

  • Right of access: You can request a copy of the personal data we hold about you.
  • Right to rectification: You can ask us to correct inaccurate personal data.
  • Right to erasure: You can ask us to delete your personal data.
  • Right to restrict processing: You can ask us to limit how we use your data.
  • Right to data portability: You can request your data in a machine-readable format.
  • Right to object: You can object to our processing of your data.
  • Right to withdraw consent: You can withdraw consent at any time by contacting us or unsubscribing from our newsletter.

To exercise any of these rights, please contact us using the details below. We will respond to your request within one month.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • HTTPS encryption for all data in transit
  • Secure password hashing for admin accounts
  • CSRF protection on all forms
  • Regular security updates
  • Access controls on stored data

9. International Transfers

Some of the third-party services we use (such as Google Analytics) may transfer data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

10. Children's Privacy

Our website is not intended for children under the age of 18. We do not knowingly collect personal data from children. Shisha and hookah products are for adults only.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us:

13. Common Questions

What personal data does Shisha Superstore collect?

Only your email address if you subscribe to the newsletter, and your name, email address and message if you use the contact form. Everything else we collect is anonymous analytics data that cannot identify you personally.

Does this site use cookies?

Yes. We use essential cookies required for the site to function (session and CSRF security tokens), and Google Analytics cookies to understand how visitors use the site. Your cookie preference is stored in your browser's local storage and is never sent to our servers.

How do I unsubscribe or have my data deleted?

Use the unsubscribe link in any newsletter email, or email info@shishasuperstore.com to request deletion. We respond to all data requests within one month, as required by UK GDPR.

How long is my data kept?

Newsletter email addresses are kept until you unsubscribe. Contact form messages are kept for up to 12 months after our last communication. Google Analytics data is retained for 26 months.

Is my data shared or transferred outside the UK?

We use Google Analytics, Google Fonts and Pexels, and some of these services may transfer data outside the UK. Where that happens, safeguards such as Standard Contractual Clauses or adequacy decisions apply.

14. Supervisory Authority

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):