Datenschutzerklärung

0. Template notice

This privacy policy is a template. It describes a typical cannabinoid e-commerce data flow, not the actual processing carried out by any particular operator.

Before launch it must be checked against the operator's real systems, its record of processing activities under Article 30 GDPR, its processor contracts and its transfer mechanisms, and it must be reviewed by qualified counsel or a data protection officer.

1. Controller and contact details

The controller for the processing described here is [COMPANY LEGAL NAME], [REGISTERED ADDRESS], company number [COMPANY NUMBER].

Data protection contact: privacy@vitalleafrx.com. Our data protection officer, where one is appointed, is [DPO NAME AND CONTACT]. Our EU/UK representative under Article 27 GDPR, where required, is [ART. 27 REPRESENTATIVE].

Our lead supervisory authority is [SUPERVISORY AUTHORITY]. You may complain to it, or to the authority in the EU country where you live or work.

2. Categories of personal data we process

We collect data you give us, data generated by your use of the site, and data we receive from service providers such as payment and verification partners.

We do not ask for health data and you should not send it to us. If you volunteer health information in a message, we delete it from the ticket once the query is resolved.

• Identity and contact data: name, date of birth or age-band result, email, phone, billing and delivery address
• Order data: items, quantities, prices, currency, order and invoice numbers, delivery instructions
• Payment data: payment method type, last four digits, authorisation and settlement references, chargeback records. We never store full card numbers
• Verification data: age-gate outcome, the reference returned by the verification provider, and where a document check is required, a pass/fail result and check reference
• Account data: credentials in hashed form, saved addresses, wishlist, order history, marketing preferences
• Technical data: IP address, device and browser type, language, referring page, pages viewed, session identifiers
• Communications data: emails, contact-form messages, chat transcripts, review and rating content
• Compliance data: destination-country checks, order-volume flags used to detect resale, and records of refused or cancelled orders

3. Purposes and lawful bases

We process personal data only where a lawful basis under Article 6 GDPR applies. The basis depends on the purpose.

• Taking and fulfilling your order, delivery, returns and customer service — performance of a contract (Art. 6(1)(b))
• Age verification and refusing sales to minors — legal obligation (Art. 6(1)(c)) and our legitimate interest in lawful trading (Art. 6(1)(f))
• Destination-legality screening and resale detection — legitimate interest in lawful, compliant distribution (Art. 6(1)(f))
• Invoicing, accounting, tax and customs declarations — legal obligation (Art. 6(1)(c))
• Fraud prevention, chargeback defence and site security — legitimate interest (Art. 6(1)(f))
• Non-essential cookies, analytics and advertising — consent (Art. 6(1)(a)), withdrawable at any time
• Email marketing to customers about similar products — consent, or the soft-opt-in permitted by local ePrivacy rules, always with an unsubscribe link
• Product reviews you choose to publish — consent (Art. 6(1)(a))
• Defending or bringing legal claims — legitimate interest (Art. 6(1)(f))

4. Where our legitimate interests apply

Where we rely on legitimate interests, we have balanced our interest against your rights and freedoms and concluded the processing is proportionate, expected in an e-commerce context, and limited to what is necessary.

You may object to legitimate-interest processing at any time by writing to privacy@vitalleafrx.com. We will stop unless we can show compelling grounds that override your interests, or the processing is needed for legal claims. Objections to direct marketing are always honoured.

5. Age verification and special categories

Verifying that a customer is 21 or older requires date-of-birth or document data. We keep the minimum: the outcome of the check and a provider reference. Where a document image is used, it is handled by the verification provider and is not retained by us.

We do not infer, record or trade in health data, and we do not build profiles about medical conditions. Cannabinoid purchase history is treated as ordinary order data, and we do not use it to draw conclusions about health.

We do not carry out automated decision-making with legal or similarly significant effects. A failed age or fraud check that blocks an order is reviewable by a human on request.

6. Recipients and processors

We share personal data with service providers who process it on our instructions under Article 28 contracts, and with third parties where the law requires it.

We do not sell personal data and we do not disclose it for third-party marketing.

• Hosting, CDN and application monitoring — [HOSTING PROVIDER]
• Payment service providers and acquirers — [PSP NAMES]; they act as independent controllers for their own compliance duties
• Age and identity verification — [VERIFICATION PROVIDER]
• Carriers and fulfilment partners — [CARRIERS], who receive name, address, phone and any adult-signature requirement
• Customs brokers, for cross-border shipments, who receive declaration data
• Email, ticketing and review platforms — [PROVIDERS]
• Analytics and advertising partners, only after consent — [PROVIDERS]
• Accountants, auditors, insurers and legal advisers, under duties of confidentiality
• Law enforcement, tax authorities, customs and regulators where a valid legal request or obligation exists

7. International transfers

Some processors are established outside the EEA, including in the United States and in [OTHER COUNTRIES], because part of our supply chain and testing operation sits in California.

Transfers rely on an adequacy decision where one exists, otherwise on the EU Standard Contractual Clauses, or the UK International Data Transfer Addendum for UK data, supported by a transfer impact assessment and technical measures such as encryption in transit and at rest.

You may request a copy of the safeguards used for a particular transfer by writing to privacy@vitalleafrx.com.

8. Retention

We keep personal data only as long as needed for the purpose it was collected for, or as long as a law requires.

• Order, invoice and tax records — [6–10] years from the end of the financial year, as required by local accounting law
• Age-verification outcomes and references — 5 years, as evidence that a sale was lawful
• Account data — until you delete the account, then 30 days in backups
• Customer-service tickets — 24 months from closure
• Marketing consents and withdrawals — 3 years after the last interaction, then deleted
• Analytics data — 14 months maximum, in aggregated form thereafter
• Fraud and chargeback records — 6 years, for claims defence
• Server and security logs — 90 days

9. Security

We use TLS for all traffic, encryption at rest for the order database, hashed and salted passwords, role-based access control, multi-factor authentication for staff, and least-privilege access for support agents.

Access to age-verification results and payment references is restricted to staff who need it. Access is logged.

No system is perfectly secure. If a breach is likely to result in a risk to your rights and freedoms, we notify the supervisory authority within 72 hours and inform you where the risk is high.

10. Your rights

Subject to conditions in the GDPR, you have the following rights. We answer within one month, extendable by two months for complex requests, and we may ask you to confirm your identity first.

• Access — a copy of your personal data and information about the processing
• Rectification — correction of inaccurate or incomplete data
• Erasure — deletion where the data is no longer needed and no legal duty requires us to keep it
• Restriction — pause processing while a dispute about accuracy or lawfulness is resolved
• Portability — receive data you gave us in a structured, machine-readable format
• Objection — to legitimate-interest processing and, absolutely, to direct marketing
• Withdraw consent — at any time, without affecting processing already carried out
• Complain — to your supervisory authority; ours is [SUPERVISORY AUTHORITY]

11. Cookies and similar technologies

We set strictly necessary cookies to run the cart, the session, the age gate and fraud prevention. Everything else — analytics, personalisation, advertising — runs only after you consent through the cookie banner.

You can change or withdraw consent at any time through the cookie settings link in the footer. The Cookie Policy lists each category and the retention period.

12. Children

This store is not intended for anyone under 21 and we do not knowingly process the data of minors.

If we learn that a minor has created an account or placed an order, we cancel the order, close the account and delete the data except what we must keep as evidence that the sale was refused.

A parent or guardian who believes a minor has given us data should write to privacy@vitalleafrx.com.

13. Changes to this policy

We update this policy when our processing changes. The effective date is shown at the top of the page and we keep previous versions available on request.

Where a change materially affects you, we tell you by email or a prominent site notice before it takes effect.