Privacy Policy

Your data is held by Tactical HB. Tactical HB decides what is collected and why, and is the data controller for everything described here.

For any question about this policy, or to exercise any of the rights below, write to admin@tactical-hb.com.

We collect only what a specific part of the site needs in order to work. Nothing here is gathered speculatively.

• When you place an order: your name and surname, email address, phone number, and the delivery address or branch you choose, together with what you ordered and what you paid. We need this to fulfil the order — it is processed to perform our contract with you.
• If you create an account: your email address, a password we never see in readable form, your name, and your marketing preference. Your favourites, loyalty points and vouchers are linked to that account.
• If you subscribe to the newsletter: your email address, the language you want to be written to in, and the record of your consent. This is processed on the basis of that consent, and you can withdraw it at any time.
• If you leave items in your basket and have opted in to our emails: your email address and the contents of that basket, so we can remind you. This is processed on the basis of your consent and stops the moment you unsubscribe or complete the order.
• When you use the contact or wholesale form: the details you enter in it — typically a name, an email address, and your message or company details.
• Cookies and similar storage, as described below.

Necessary cookies are always on, because the site cannot work without them: they keep you signed in, remember your basket, and record the cookie choice you made so we do not ask again.

Analytics and marketing cookies are off until you switch them on. Nothing in either category is set before you accept it, and you can change your mind at any time through the cookie settings link in the footer.

We do not sell your data and we do not share it for anyone else's marketing. It reaches a small number of service providers only where one of them performs a part of the service for us:

• the providers who host this site and its database;
• our payment provider, who takes the card payment. Your card details go directly to them and never reach our servers;
• the carrier you choose at checkout, who needs your name, phone number and delivery point in order to deliver the order;
• our email provider, who sends order confirmations, shipping updates and, if you asked for them, our newsletters;
• our fiscal receipt provider, where Ukrainian law requires a receipt to be issued for a sale.

Each of them receives only what that one task needs, and none of them may use it for anything else. We will also disclose data where we are legally required to, and no further than that requirement goes.

• Order records are kept for as long as accounting and tax law in Ukraine requires us to keep them. We cannot delete these on request while that period is running.
• Account data is kept while your account exists. Delete the account and it goes with it.
• Newsletter data is kept until you unsubscribe, after which we keep only the fact that you unsubscribed — so that we do not email you again by accident.
• Abandoned basket records are cleared once the basket is bought or the reminder sequence ends.

Wherever the law gives you these rights — and under the GDPR, if you are in the EU, it does — you can ask us to:

• give you a copy of the data we hold about you;
• correct it, if it is wrong;
• delete it, subject to the retention periods above;
• stop or limit what we do with it;
• send it to you, or to someone else, in a portable format;
• stop processing it where we rely on your consent or on a legitimate interest.

Withdrawing consent is always free and always immediate: every marketing email carries an unsubscribe link, and the cookie settings can be reopened from the footer at any time. Withdrawing it does not undo anything we did lawfully beforehand.

If you think we have handled your data badly, please tell us first — but you are also entitled to complain to your national data protection authority, or in Ukraine to the Ukrainian Parliament Commissioner for Human Rights.

We operate from Ukraine and our providers operate internationally, so your data may be processed outside your own country — including outside the European Economic Area. Where that happens we rely on our providers' own safeguards for those transfers.

Access to customer data is restricted to the people who need it to run the business. Passwords are stored only as irreversible hashes, card details never touch our systems, and traffic to the site is encrypted in transit.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your data and puts you at risk, we will tell you.

This site sells hookah accessories and is not intended for children. We do not knowingly collect data from anyone under the age at which these products may lawfully be bought where they live.

If this policy changes materially, we will update the date at the top of the page. If the change affects how we use data you have already given us, we will tell you directly rather than relying on you re-reading this page.