tobacco shop gdpr