PRIVACY POLICY

Below we present information related to the processing of your personal data, in connection with the use of our store at cannabigold.co.uk (“Store”) and placing orders for products via the Store. We are committed to protecting the security of your personal data. We only use them for lawful reasons that we explain to you in this privacy policy (“Privacy Policy”). This document explains how your data are collected, used, transferred and disclosed by HemPoland.

Our Privacy Policy contains the following information:

About us
We care about your data
The legal grounds for processing
The purposes of the processing your personal data, the legal basis for processing and the types of personal data processed
Profiling
The storage period of personal data
The categories of recipients of your personal data
The transfer of personal data to recipients in third countries
Your rights
Failure to provide your personal data
Cookies and other technologies
Changes to the Privacy Policy
Contact details

All words appearing in this Privacy Policy and beginning with a capital letter should be understood according to their meaning contained in the Terms and Conditions of our Online Store available on this website.

About us

The controller of the personal data collected through our Store at cannabigold.co.uk is HemPoland spółka z ograniczoną odpowiedzialnością with its registered office in Władysławowo (82-300) at Władysławowo 30A, entered into the Register of Entrepreneurs of the National Court Register in Olsztyn, 8th Commercial Division of the National Court Register under the number KRS 0000534517, National Business Registry Number REGON 360289332, Tax Identification Number NIP 5783115991, with share capital amounting to PLN 1,000,000.00 paid up in full, hereinafter referred to as “HemPoland” or “Controller”.

HemPoland is a subsidiary of The Green Organic Dutchman Holdings Ltd. incorporated under the law of Canada, with its registered office in 6205 Airport Road, Building A, Suite 200, Mississauga, Ontario, Canada, listed on The Toronto Stock Exchange.

HemPoland is a producer and distributor of hemp products containing natural phytocannabinoids and other hemp products and is the owner of CannabiGold brand.

We care about your data

As the security of your personal data is important to us, we make every effort to protect your data. In particular we ensure that the data are:

processed lawfully, fairly and in a transparent manner in relation to our Customers;
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
accurate and, where necessary, kept up to date;
kept in a form which permits identification of our Customers for no longer than is necessary for the purposes for which the personal data are processed;
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

The legal grounds for processing

We process your personal data in compliance with all regulations governing the processing of personal data, including in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union No 119, p. 1), hereinafter referred to as “GDPR” and The Data Protection Act 2018, hereinafter referred to as “DPA 2018”..

The legal basis for processing your personal data are as follows:

of a contract or taking steps at your request prior to entering into a contract. On this basis your data are processed in particular to: place an order; make a payment, deliver products to you and allow you to return them (Article 6 paragraph 1 letter b) of GDPR);
indispensable for the purposes of the legitimate interests pursued by the Controller that are not overridden by your rights. On this basis your data are processed in particular: to develop our business and improve the satisfaction of our Customers, for direct marketing purposes, answering questions sent by the Customer via the contact form on our website, as well as for our analytical and statistical purposes and to determine, assert or defend claims (Article 6 paragraph 1 letter f) of GDPR);
. On this basis your data are processed in particular: to create an account and register you as our new Customer, to provide you with our newsletter (Article 6 paragraph 1 letter a) of GDPR). Remember when your data are processed on this basis you have the right to withdraw your consent at any time;
Article 6 paragraph 1 letter c) of GDPR).

The purposes of processing your personal data, the legal basis for the processing and the types of personal data processed

The purposes of the processing	The legal basis for the processing	The types of personal data processed
performance of a contract and taking steps at your request prior to entering into a contract, this includes: payment, delivery, returns, warranty claims	Article 6 paragraph 1 letter b) of GDPR (performance of a contract)	first name, last name, address, delivery address, email address, telephone number, payment information, details of the order
creating an account and registering you as our new Customer	Article 6 paragraph 1 letter a) of GDPR (consent)	first name, last name, address, email address, telephone number, date of birth, order history, payment information and history of payment, click and browsing history (connected with cookies)
answering questions sent by the Customer via the contact form on our website	Article 6 paragraph 1 letter f) of GDPR (legitimate interests pursued by the Controller – growing and running a business, taking care of customer relations)	first name, email address
newsletter	Article 6 paragraph 1 letter a) of GDPR (consent)	first name, last name, email address
direct marketing we will recommend you our products via email or text messages and inform you about discounts and offers that may be of interest to you	Article 6 paragraph 1 letter f) of GDPR (legitimate interests pursued by the Controller – growing and running a business)	first name, last name, email address, telephone number, products and offers you have clicked on
administration, development, protection of our business and improvement of our services and products	Article 6 paragraph 1 letter f) of GDPR (legitimate interests pursued by the Controller –growing and running our business, improve of products)	e-mail address, order history, delivery information, payment details, click and browsing history (connected with cookies)
analysis of your activity on our website to improve our website, products and customer relationships, to display the advertisements of our Products and to adapt their content to the preferences of our Customers; all data used for these purposes are pseudonymized	Article 6 paragraph 1 letter f) of GDPR (legitimate interests pursued by the Controller – growing and running a business, improve our products and website)	details of your device, IP address, browser type and version, location, operating system, information about your activity in our Store, such as how you use it, what you were looking for
compliance with a legal obligations arising from regulations, such as tax and accounting issues	Article 6 paragraph 1 letter c) of GDPR (compliance with a legal obligation)	first name, last name, address, payment information, details of the order
pursuing claims and defense against claims	Article 6 paragraph 1 letter f) of GDPR (legitimate interests pursued by the Controller – defense of the Controller’s interests)	first name, last name, address, payment information, details of the order

Profiling

In our Store we may use profiling. Profiling is automated processing of personal data to evaluate certain things about our Customers. We may use profiling for marketing purposes. It allows us to know better your preferences concerning our products and tailor our offer to your needs. It does not produce any legal effects concerning you and does not similarly significantly affect you. We do not use any other automated individual decision-making process. Being subject to a decision based on profiling is allowed when the person has provided explicit consent (which may be withdrawn at any time), it is authorized by law, or it is necessary for the entry into or performance of a contract.

The storage period of personal data

Your personal data will be stored only for a limited period of time; only as long as is necessary for the purposes such data was provided.

Personal data processed for the purposes of the entry into and performance of a contract will be stored as long as this contract is in effect and after its expiry for the period necessary to secure or pursue any claims and to fulfill any legal obligations (e.g. resulting from tax law provisions).

Personal data processed to fulfill our legal obligations or to implement our legitimate interests will be stored as long as the law obligates us to process the data.

When processing of your personal data is based on your consent, it may be stored until you withdraw your consent or you object to the processing or until it is no longer necessary for the purpose the consent was given. After this period your data will be kept until the expiry of the limitation period for any claims.

The categories of recipients of your personal data

Your trust is essential to us. We do not sell any of your personal data to any third party. However, in order to provide you with our products and services and to run our business, we may disclose and share your data with the following categories of recipients:

to business partners that support us in running our business, such as:
- technical service providers that we engage in providing IT systems, software and to host our website;
- companies that enable your order to be completed, such as online payment service providers, delivery companies, warehouses;
- the bank keeping our bank account;
- companies that provide marketing communication and advertising services;
- companies that provide services in relation to the sending of emails, text messages and postal mail on our behalf,
to our advisers including lawyers, accountants, auditors who provide professional services,
to authorities, if we are obliged to disclose your personal data in order to comply with any legal regulations,
to our parent company The Green Organic Dutchman Holdings Ltd.

Please be aware that many of these recipient companies have an independent right or obligation to process your personal data.

Transfer of personal data to recipients in third countries

The personal data we collect may be transferred to and stored in countries of the European Economic Area (“EEA”), in particular in Poland, which is our main place of business. It may also be transferred to and stored in countries outside the EEA. This usually happens when an entity cooperating with us performs its services outside EEA. Any such transfer of your personal data will be carried out in compliance with applicable laws. You are entitled to obtain a copy of your personal data transferred to a third party outside of the EEA. We will provide for an adequate level of protection of your personal data. This may also include the use of standard contractual clauses for the transfer of personal data, approved by the European Commission, that provide personal data protection similar to that in Europe.

We cooperate with Klaviyo, 225 Franklin St floor 10, Boston, MA 02110 United States and use their tools that assist us in e-mail and SMS marketing of our products. These tools allow us to create personalized messages and send them to our Customers. Your consent is required to use this service. You can also object to using it at any time. Klaviyo automatically collects information about your use of our website. This information is transmitted to, and stored at, Klaviyo’s server in the United States.

Klaviyo is certified under the Privacy Shield. Here you can obtain more information about Klaviyo’s privacy policy: https://www.klaviyo.com/privacy/policy.

We may also use Google Analytics tools provided by Google LLC, 1600 Amphitheate Parkway, Mountain View, CA 94043, United States, to analyse the use of our website. You should know that Google LLC is also certified under the Privacy Shield. Here you can get more information about Google privacy policy https://policies.google.com/privacy?hl=en-US. You can read more about Google Analytics in section ”Cookies and other technologies”.

As mentioned above, we are a part of a global capital group with parent company The Green Organic Dutchman Holdings Ltd., with its registered office in Canada. Accordingly, your data may be transferred to Canada. The European Commission has stated that Canada is considered as providing an adequate level of protection for personal data transferred from the EU (Commission Decision of 20 December 2001, No. 2002/2/EC).

Your rights

In accordance with the provisions on the protection of personal data and with the restrictions indicated therein you have the following rights:

the right to access to your personal data – you are entitled to have access to your personal data and to obtain a copy of the personal data we have stored, as well as detailed information about how we process your personal data;
the right to rectification of your personal data – you have the right to have your personal data rectified if they are inaccurate or incomplete;
the right to erasure of your personal data (right to be forgotten) – you are entitled to request us to delete your personal data, if there is no reason for us to continue processing them. However, we may not always be able to erase your personal data completely, for example when we still need them to comply with legal obligations or to deal with legal claims. If this happens, you will be notified in response to your request;
the right to restriction of processing of your personal data – this entitles you to request the limitation of processing of your personal data in certain situations, for example when you have contested the accuracy of your personal data or you have objected to our processing of your data, the restriction applies for a period enabling the Controller to verify the accuracy of personal data;
the right to data portability – you have the right to receive a digital copy of your personal data. You also have the right to request the transfer of your personal data to another controller. This right is limited to situations where the processing is carried out by automated means and applies to personal data processed on the basis of your consent or on a contract;
the right to object to processing of your personal data – you have the right to object to processing of your personal data at any time, for reasons related to your particular situation. In such an event, we are no longer entitled to process of your personal data unless we demonstrate vital legitimate grounds for the processing which override your interests, rights and freedoms or the grounds for the establishment, exercise or defence of legal claims. You also have the right to object to the processing of your personal data for direct marketing purposes;
the right not to be subject to a decision based solely on automated processing, including profiling – you are entitled to request human intervention, when a decision based on profiling produces legal effects on you or affects you in a similar significant way;
the right to lodge a complaint – if you have any complaints regarding the way we process your data, you have the right to lodge a complaint with a supervisory authority. In Poland, The President of the Office for Personal Data Protection is the competent authority and in England – The Information Commissioner’s Office.

We will respond to your request without undue delay and at the latest within one month of receipt of the request. This period may be extended by two further months if necessary, taking into account the complexity and number of the requests. We will notify you of any such extension within one month of receipt of your request, together with the reasons for the delay.

Failure to provide your personal data

Providing personal data in our Store is voluntary, but it is necessary to use most functionalities of our Store, in particular to place an order and perform a contract, subscribe to a newsletter. Failure to provide your personal data may result in the inability to perform most of the activities on our website.

Cookies and other technologies

Our website, like most others, uses cookies. Cookies are small pieces of information which allow our website to recognise your device and are downloaded to your device when you visit us, if you agree our website doing so. Cookies are then sent back to our website on each subsequent visit, or to another website that recognises that cookies.

Obtaining and storing information using cookies is possible on the basis of your consent. During your first visit on our website we present you information on the use of cookies and ask you to accept them.

Thanks to cookies, the use of websites is much easier, more pleasant and their content is tailored to the expectations and preferences of their users.

We use cookies for the following purposes:

to adjust the content of our website to your preferences and to optimize the use of our website;
to recognise the user’s device and to maintain the session after user’s logging in,
to create statistics that allow us to develop our Store and products and to better understand the need of our Customers
to display the advertisements of our Products and to adapt their content to the preferences of our Customers.

We use two basic kinds of cookies on our website: session cookies and persistent cookies.

Session cookies are temporary files that are stored on your device until logging out or ending the session.

Persistent cookies are stored on your device for the period specified in the file parameters or until they are deleted. This means that its information will be transmitted to the server every time the user visits the Store.

In addition to cookies that belong to our domain, our website may also use third-party cookies. This is due to the fact that third parties provide us with some functions necessary for the proper functioning of our website. We use the services of the following companies that use cookies on our website:

Google Analytics,
Google marketing tools,
Adform,
Criteo,
Klaviyo,
Trustpilot.

Browsers usually allow the storage of cookies on the user’s device by default. You can manage the use of cookies at any time, including blocking and deleting, using the privacy settings on our website or in your browser. You can also block only third-party cookies, accepting cookies used directly by the Controller. Remember that disabling or limiting the use of cookies may cause difficulties in using our website and affect some available functionalities.

Google Analytics

As we mentioned above we use Google Analytics to analyse the use of our website. Google collects information as your location (based on your IP address) and your behaviour when you access our website (based on cookies) through our use of abovementioned tool on our website. Google Analytics generates statistical and other information about our website use by means of analytical cookies. Thanks to this solution we are able to better understand the needs of our Clients and to adopt our offer to this needs. You can opt out of Google Analytics by installing the browser add-on under the link https://tools.google.com/dlpage/gaoptout?hl=en-GB.

Social media plugins

Our Store uses plugins of Facebook and Instagram. These plugins will directly connect you to our social media profiles. For more detailed information, we recommend that you familiarise yourself with the privacy policies of individual social media networks. Please note that we do not accept any responsibility for these policies.

Changes to the Privacy Policy

This version of the Policy has been effective since 16 of July 2021.

From time to time we may change this Privacy Policy, for example to comply with new requirements imposed by applicable laws, in particular considering the protection of personal data or consumer rights or because of technical requirements. We will notify you about any changes of this Privacy Policy on our website.

Contact details

We are happy to answer any questions of our Customers regarding their personal data or their requests for more information about our Privacy Policy.

Our Customers may also contact our Data Protection Officer at the following e-mail address: iod@hempoland.eu.

You may also contact us in the following way:

by post:
Władysławowo 30A, 82-300 Elbląg
by phone:
+48 668 696 368
by e-mail:
info@cannabigold.com
or with the use of the form in the contact tab on cannabigold.co.uk website.

viewed_cookie_policy	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
cookielawinfo-checkbox-necessary	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-uncategorized	This cookie is set by GDPR Cookie Consent plugin. The purpose of this cookie is to check whether or not the user has given the consent to the usage of cookies under the category 'Uncategorized.
cookielawinfo-checkbox-analytics	This cookie is set by GDPR Cookie Consent plugin. The purpose of this cookie is to check whether or not the user has given the consent to the usage of cookies under the category 'Analytics'.
cookielawinfo-checkbox-performance	This cookie is set by GDPR Cookie Consent plugin. The purpose of this cookie is to check whether or not the user has given the consent to the usage of cookies under the category 'Performance'.

_ga	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, camapaing data and keep track of site usage for the site's analytics report. The cookie store information anonymously and assigns a randoly generated number to identify unique visitors.
_gid	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages visited (in an anonymous form).

thwcfe_session_id	Cookie set by the Checkout Field Editor plugin. Stores data from order form for 1 hour.
_gat_UA-96208801-3	This is a pattern type cookie set by Google Analytics, where the pattern element on the name contains the unique identity number of the account or website it relates to. It appears to be a variation of the _gat cookie which is used to limit the amount of data recorded by Google on high traffic volume websites.

__kla_id	Tracks when someone clicks through a Klaviyo email to our website
KL_FORMS_MODAL	Tracks when someone subscribes (opts in) to a form.
woocommerce_recently_viewed	Tracks the recently viewed products.