TOP25Effective from 21 October 2026
This policy explains what personal data we process on the Top25snuff.com website, for what purpose, how long we keep it and what rights you have. We have prepared it in accordance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council), the Polish Personal Data Protection Act (ustawa o ochronie danych osobowych) and the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) (with regard to cookies and similar technologies).
In short: we do not sell data, we do not display advertisements and we do not profile users. We count visits in Google Analytics only if you agree to it. We collect only what is needed to run your account, publish reviews and forum posts, and protect the website against abuse.
1. Data controller
The controller of personal data is Mateusz Janiszewski, who runs the Top25snuff.com website (hereinafter: “we”).
The controller can be contacted — in all matters concerning personal data — by e-mail: redakcja@top25snuff.com. We have not appointed a data protection officer — we are not obliged to do so.
2. What data we process, why and on what legal basis
Browsing the website
The website can be read without an account. The server on which the website runs records in its technical logs the IP address, the date and time of the request, the page address and information about the browser. We do this so that the website works, is secure and so that attacks can be detected — this is our legitimate interest (Article 6(1)(f) GDPR). The logs are kept by the hosting provider for up to 90 days.
Age verification
The website concerns tobacco products and is intended only for adults. On your first visit we ask for your date of birth. We do not send or store the date — your age is calculated in your browser, and only the result (“adult” or “minor”) is kept in a cookie. Legal basis: our legitimate interest in restricting minors’ access to content about tobacco products (Article 6(1)(f) GDPR).
User account
When creating an account, you provide a username, an e-mail address and a password (we store it only as an encrypted hash) and confirm that you are 18 or over. In your profile you may voluntarily add a display name, a profile photo and other information about yourself.
We process account data in order to provide you with a service by electronic means — to maintain your account and enable you to use the website’s features (Article 6(1)(b) GDPR). We keep it until the account is deleted.
Logging in with Google
If you log in with Google, Google will pass us your e-mail address, your first and last name (or name) and your Google account identifier — solely in order to create your account or log you in (Article 6(1)(b) GDPR). We do not receive your Google account password. Google processes the data as a separate controller under the terms described in the Google privacy policy.
Reviews, ratings, forum and other content
Snuff reviews and ratings, forum posts, replies to reviews, added snuffs and photos are public — they are visible together with your display name and profile. For the website to work smoothly, we also store your “helpful” votes, your list of favourite snuffs and your reports of content for moderation (this information is not public).
We do this to provide the service you use (Article 6(1)(b) GDPR). You publish content voluntarily, and it is visible to everyone, including internet search engines. Remember not to include in it any data you do not want to disclose.
Together with a review or post, we store the IP address from which it was added, so that we can detect spam, multiple accounts and other abuse (Article 6(1)(f) GDPR). The IP address is not public and we keep it for as long as the post.
Private messages
Logged-in users can send each other private messages. We store the content, subject, sender, recipients and date of each message in order to deliver it and show the conversation in the inbox (Article 6(1)(b) GDPR). Messages are not public and we do not read them. The exception: when a recipient reports a message as breaking the site rules (e.g. trading, spam, offensive content), a moderator sees the reported message in order to deal with the report (Article 6(1)(f) GDPR). Messages containing links to shops or auctions are not sent. A conversation disappears from your inbox when you delete it, and from the site database when all its participants delete it or when we delete the account. We notify you of a new message by e-mail; you can turn this off in your notification settings.
Visit statistics (Google Analytics)
If you click “Accept” on the cookie bar, we count visits in Google Analytics 4 to know which pages are read, where visitors come from (e.g. a search engine) and which devices the site is used on. Google Analytics then stores a random identifier in your browser and collects information about the pages you visit, your approximate location (country, city), device and browser. We do not link this data to your account on the site, and we do not count logged-in users at all. Advertising features and Google Signals are turned off.
The legal basis is your consent (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law). Without consent the Google Analytics script is not loaded and no data is sent to Google. You can withdraw consent at any time with the “Cookie settings” link in the footer — we will then remove the Google Analytics cookies from your browser. Data in Google Analytics is kept for 14 months.
Login security
For failed login attempts we record the IP address and username, and after several failed attempts we temporarily block logging in from that address. This protects accounts against takeover (Article 6(1)(f) GDPR). We keep the data for as long as this protection mechanism requires — you may ask for its deletion at any time.
E-mail messages
We send messages needed to operate your account (e.g. registration confirmation, password reset) and — occasionally — important information about the website (e.g. changes to the rules). Legal basis: the contract for the provision of the service (Article 6(1)(b) GDPR) and our legitimate interest in informing users about the website (Article 6(1)(f) GDPR). We do not send advertisements or commercial information — neither our own nor on behalf of other companies.
Contacting us
If you write to us, we process your e-mail address and the content of your message in order to reply (Article 6(1)(f) GDPR). We keep the correspondence for as long as needed to deal with the matter, and then for up to one year in case of further questions.
3. Cookies and browser storage
The website uses cookies and browser storage (localStorage) that are necessary for the features you knowingly use — such files do not require consent (Article 399(3) of the Polish Electronic Communications Law). Google Analytics cookies are set only with your consent, given on the bar shown on your first visit; you can change your decision at any time with the “Cookie settings” link in the footer. We do not use advertising cookies.
| Name | Purpose | Duration |
|---|---|---|
t25_wiek |
result of the age verification (without the date of birth) | 30 days (or until the browser is closed); 24 hours if the result is “minor” |
wordpress_logged_in_…, wordpress_sec_… |
keeping you logged in | until you log out; 2 days, or 14 days with the “remember me” option |
wordpress_test_cookie |
checking whether the browser accepts cookies when logging in | until the browser is closed |
wp-settings-… |
user dashboard settings | 1 year |
_lscache_vary |
technical — a separate version of the page for logged-in users (cache) | until you log out |
t25theme (localStorage) |
selected light/dark mode | until deleted in the browser |
t25view (localStorage) |
selected view of the snuff list | until deleted in the browser |
t25_compare (localStorage) |
snuffs added for comparison | until deleted in the browser |
t25_wizard_draft (localStorage) |
draft in the add-snuff wizard | until the form is submitted or the draft deleted |
t25_zgoda |
your decision about analytics cookies | 12 months |
_ga, _ga_… |
Google Analytics — distinguishing visitors and sessions (only after consent) | 2 years or until consent is withdrawn |
You can delete or block cookies at any time in your browser settings. Blocking necessary cookies will make it impossible to log in, and the age gate will appear on every visit.
Fonts and all website files are loaded from our own server. Older forum posts may contain images or videos embedded from other services (e.g. YouTube, image hosting services) — when they are displayed, your browser connects to those services, which may record your IP address or set their own cookies. The “Share” buttons are ordinary links: no data is sent to social networks until you click the chosen service. The same goes for the review translation button: in browsers with a built-in translator the text is translated on your device and is not sent anywhere; in other browsers the button opens Google Translate with the review text — only then is that text sent to Google.
4. Who we share data with
We do not sell data and do not share it with companies for marketing purposes. Data may be disclosed only to:
- the hosting provider on whose servers the website and e-mail run: cyber_Folks S.A., based in Poznań — it processes data on our behalf under a data processing agreement;
- Google — if you choose to log in with Google (see above);
- Google Ireland Limited (Google Analytics) — only if you consent to analytics cookies; Google processes this data on our behalf under the Google Ads and Google Analytics data processing terms;
- public authorities — only where required by law.
The content you publish (reviews, posts, profile) is publicly visible to all visitors to the website.
We do not transfer data outside the European Economic Area. Exceptions may be logging in with Google and — if you consent to it — Google Analytics: Google may also process this data in the USA and applies the mechanisms provided for in the GDPR (including the EU-US Data Privacy Framework and standard contractual clauses).
5. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectify your data — you can change most of your account data yourself in your profile,
- erasure of your data (the right to be forgotten),
- restriction of processing,
- portability of the data you have provided to us,
- object to processing based on our legitimate interest,
- lodge a complaint with the President of the Polish Data Protection Authority (UODO) (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) if you believe that we process data unlawfully.
To exercise your rights, write to redakcja@top25snuff.com from the address linked to your account. We will reply without undue delay, and at the latest within one month.
Deleting your account. At your request we will delete your account and profile data. We will delete your reviews and forum posts or — if you prefer to keep them for other readers — anonymise them so that they cannot be linked to you. Ratings included in the ranking may remain in it in anonymised form.
6. Do you have to provide data?
Providing data is voluntary. However, without an e-mail address, username and password you cannot create an account, and without an account you cannot add a review or a forum post. You can read the website without providing any data (apart from confirming that you are an adult).
7. Profiling and automated decisions
We do not profile users and do not make decisions about them by automated means within the meaning of Article 22 GDPR. We look at Google Analytics data only as aggregate statistics and do not use it for advertising. Automatic filters can only hold for review by a moderator a post that appears to break the rules (e.g. contains a link to a shop) — a human decides whether it is published.
8. Security
The connection to the website is encrypted (HTTPS), we store passwords only as encrypted hashes, we limit the number of login attempts, and only authorised persons have access to the administration panel. We regularly update the website’s software.
9. Changes to this policy
We update the policy when the law or the way the website works changes. The current version is always available on this page, and the date of the last change is given at the top. We will inform registered users of significant changes by e-mail or by a notice on the website.