Privacy policy

SLAY Privacy Policy (Including Cookie Policy)

(Rewritten and Standardised Version for Continental Tobacco UK Ltd)

Effective date: [Insert publication date]

1. Who We Are

We are Continental Tobacco UK Ltd (“we”, “our”, “us”), a company registered in England and Wales (Company No. 16674379) with our registered office at:
Fitzroy House, Crown Street, Ipswich, Suffolk, IP1 3LG.
Our VAT number is GB 501 3490 35.

We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you visit or make a purchase from our Website (the “Site”). It also outlines your rights under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

The responsible person for data-protection matters can be contacted at:
📧 uk.team@continentaltobacco.com
This contact handles any questions or requests relating to how we process your personal data, including data-subject rights.

2. Your Duty to Keep Us Updated

It’s important that the information we hold about you is accurate and current. Please let us know promptly if your personal data changes.
We can’t be responsible for issues caused by inaccurate, incomplete or out-dated information you provide.

3. Information We May Collect

We collect and process personal data in the following ways:

(a) Information you provide directly:
When you:

  • Create an account or place an order;
  • Subscribe to marketing communications or services;
  • Register your personal data in a promotion or on our website or social media;
  • Contact us via email, phone, or our online form;
  • Enter a competition, survey, or promotion; or
  • Provide feedback.

This may include your name, postal address, email, phone number, and order details.

(b) Information we collect automatically:
When you visit our Site, we automatically collect:

  • IP address, device and browser information;
  • Login data, time zone, type of digital device used, browser and operating system;
  • Website usage data (e.g. pages viewed, time spent, navigation paths);
  • Information relating to your advertising and marketing preferences, including information about personalised offers and rewards, cookie and tracking data (see Section 13).

(c) Information from other sources:
We may receive personal information about you from carefully selected third parties who help us provide and protect our services, including:

  • Payment and delivery partners – confirmation of successful payment, delivery status, and transaction identifiers (Lawful basis: Contract).
  • Age-verification providers – confirmation of age-check outcome (Lawful basis: Legal obligation).
  • Analytics and advertising providers – aggregated website-use statistics and campaign-performance data (Lawful basis: Consent or Legitimate interests).
  • Fraud-prevention and credit-reference agencies – limited identification data to prevent fraudulent transactions (Lawful basis: Legitimate interests).

We use this information to verify your eligibility to buy our products, process orders efficiently, detect and prevent fraud, and improve our marketing relevance.

We do not knowingly collect data from anyone under the age of 18.

4. Why We Use Your Information (Lawful Bases)

We only use your personal data where the law allows us to. We process it under one or more of the following lawful bases:

  • Contract: to fulfil your order or manage your account.
  • Legal obligation: to meet legal or regulatory requirements, including age verification.
  • Consent: when you’ve given clear consent (e.g. for marketing emails).
  • Legitimate interests: to run and improve our business — for example, to prevent fraud, manage debt, analyse performance, and enhance our products — as long as your rights are not overridden.
  • Age restriction: By using our Site and providing your personal data, you confirm that you are over 18 years of age, as our products are age-restricted and not intended for anyone under 18.

If you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services) or perform our legal obligations. In this case, we may have to cancel a product or service you have with us but we will notify you at the time.

5. How We Use Your Information

We may use your data to:

  • Process and deliver your orders;
  • Provide customer support and respond to enquiries;
  • Verify your age and eligibility to purchase our products;
  • Improve our website, products, and services;
  • Send service updates, such as order confirmations and policy changes;
  • Conduct analytics and monitor website performance;
  • Manage our relationship with you, including competitions or surveys;
  • Send marketing communications (if you’ve consented);
  • Ensure website safety and prevent fraud.

We will contact you only by email, post or phone as determined by you when you set your contact preferences in your account. You can update your marketing preferences or withdraw consent at any time by contacting us at hello@slaypouches.com or sending a letter to Continental Tobacco UK Ltd, Fitzroy House, Crown Street, Ipswich, Suffolk, IP1 3LG.

6. Marketing and Communications

You’re always in control of whether you hear from us. You can:

  • Opt in to marketing when creating your account or placing an order;
  • Change your preferences at any time in your account settings; or
  • Unsubscribe via any marketing email you receive.

If you unsubscribe, we’ll stop sending marketing messages but may still send service-related emails (e.g. order updates).

7. Sharing Your Information

We only share personal data that’s necessary for the relevant purpose and ensure all partners comply with UK data-protection law. We may share your data with trusted partners who help us operate our business, such as:

  • Delivery and logistics providers;
  • Payment processors (who encrypt and handle card data securely);
  • IT and system administrators;
  • Analytics and advertising partners (aggregated or anonymised data only);
  • Professional advisers – such as lawyers, auditors, bankers, and insurers – where necessary to obtain professional advice, manage legal or business risks, or comply with our legal obligations. Such sharing is based on our legitimate interests in running our business responsibly or on a legal obligation where applicable. Prior notice is not required for these routine or legally mandated disclosures.

We may also disclose your data:

  • If required by law or regulation;
  • To prevent fraud or protect security; or
  • In the event of a business sale or merger, where your data would be transferred under equivalent safeguards.

We never sell your personal information.

8. International Transfers

Your data may be processed outside the UK by third-party providers. When this happens, we ensure your data remains protected by:

  • Using providers located in countries recognised by the UK as offering an adequate level of protection, or
  • Implementing UK-approved Standard Contractual Clauses and equivalent safeguards.

You can contact us for further details about these safeguards and the countries where your data may be processed.

9. Data Security

We apply technical and organisational measures to protect your personal data from loss, misuse, or unauthorised access. This includes encryption, access controls, and secure servers.

While we take security seriously, transmission of information online isn’t completely secure. Any data you send is at your own risk, but we use all reasonable measures to protect it once received.

If we become aware of a data breach affecting your personal information, we’ll notify you and the Information Commissioner’s Office (ICO) where required by law.

10. Data Retention

We keep your personal data only for as long as necessary for each purpose, including to meet legal, accounting, or reporting obligations. Typical retention periods are:

  • Order and payment records: 7 years (from transaction date) to meet tax and legal-reporting requirements.
  • Account details: for as long as your account is active and up to 2 years after inactivity.
  • Marketing preferences and consent: until you unsubscribe or after 3 years of inactivity.
  • Customer service enquiries: up to 2 years after resolution.

After these periods, data will be securely deleted or anonymised.

11. Your Data Protection Rights

Under UK law, you have the following rights:

  • Access – request a copy of the personal data we hold about you.
  • Correction – ask us to correct or complete inaccurate information.
  • Restriction – ask us to suspend or limit processing in certain circumstances.
  • Objection – object to processing, including for marketing purposes.
  • Portability – request transfer of your data to you or another provider.
  • Withdraw consent – where we rely on consent, you can withdraw it anytime.
  • Erasure – request deletion of your data where there’s no valid reason for us to keep it. This is sometimes called the “right to be forgotten.” It allows you, in certain cases, to ask us to delete your personal data — for example, if we no longer need it, you withdraw your consent, you’ve objected to our processing, or we’re required by law to erase it.

Please note that we can’t always restrict or delete your information. We may need to use it to meet legal obligations, resolve disputes, maintain security, or prevent fraud and abuse.

If you’d like to exercise any of these rights, please contact us at hello@slaypouches.com.
We may ask you to verify your identity before responding to your request.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO) at www.ico.org.uk/make-a-complaint.

12. Links to Other Websites

Our Site may include links to other websites or services. We’re not responsible for their content, privacy practices, or security. Please read the privacy policy of any external website you visit before sharing your data.

13. Cookie Policy

What are cookies?
Cookies are small text files stored on your device when you visit our Site. They help us make your experience smoother and improve our services.

Types of cookies we use:

  • Essential cookies – required for website functionality (e.g. basket and checkout).
  • Performance cookies – help us understand how visitors use our site.
  • Functional cookies – remember your preferences.
  • Marketing cookies – enable personalised ads and track campaign performance (used only with your consent).

Managing cookies:
You can manage or disable cookies in your browser settings. If you block all cookies, some parts of the Site may not work properly. When you first visit our Site, a Cookie Banner appears that explains our use of cookies and allows you to manage your preferences. Non-essential cookies (Performance, Functional, and Marketing) are only activated after you give explicit consent.
You can change or withdraw your consent at any time via the Cookie Settings link in the website footer. This system ensures compliance with the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR Article 7.

Third-party cookies:
We may allow trusted third parties (e.g. analytics providers) to set cookies to help us understand usage patterns or deliver relevant content.

Further information about cookies is available at www.allaboutcookies.org.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we’ll post the new version on this page and update the “Effective date” above. If the changes are significant — for example, if we alter the types of personal data we collect, change who we share your data with, or modify the lawful basis for key processing activities — we’ll notify you by email or another suitable method before the changes take effect.

Compliance Statement

This Privacy Policy complies with:

  • UK General Data Protection Regulation (UK GDPR)
  • Data Protection Act 2018
  • Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR)
  • Electronic Commerce (EC Directive) Regulations 2002