Personal data protection policy: rules on personal data protection and the use of cookies

The purpose of these Personal Data Protection Policy (hereinafter referred to as the “Policy”) is to express the personal data protection standards we follow, with regard to the legal framework – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, hereinafter referred to as “GDPR”, Act No. 110/2019 Coll., on the processing of personal data, and related legal regulations.

This Policy will help you understand, for example, what data about you our company BrandsofHemp s.r.o., ID No.: 190 87 608, registered office Žižkova 708, Příbram II, 261 01, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. C 374196 (hereinafter referred to as the “Controller”), collects, how it is used, with whom it may be shared, or how you can exercise your data protection rights against the Controller.

1. User registration

If you register, you share your e-mail as personal data with the Controller, and you also share the username and password you have chosen. Your e-mail as your personal data is processed only in our internal database for the purpose of managing your user account. This management is also performed by an external entity – the administrator of our websites. Therefore, the data are transferred to this external entity. However, we have ensured that this external entity will observe all legal standards in relation to your personal data and therefore their misuse cannot occur.

Providing this data is voluntary, but necessary for registration/conclusion of the contract. The legal basis for processing is the performance of the contract within the meaning of Art. 6(1)(b) GDPR, as registration and account management is a service we provide to you at your request. If you register in our system solely for the purpose of using our services, your explicit consent for the processing of your personal data is not required. This processing of your e-mail is an essential part of managing your profile.

We store the data associated with your user account for the duration of active use of the service. If in the future you decide to no longer use our services and delete your profile on our website, we will subsequently delete your data from all our databases without undue delay (no later than within 30 days from the cancellation of the registration), unless prevented by other legal reasons.

2. Newsletter

If you order our newsletter, you share your e-mail with us as personal data. Your e-mail as your personal data is further processed for the purpose of sending our commercial communications. These commercial communications will always relate to the content of our e-shop www.canntropy.com They may concern promotional offers from cooperating seedbanks, cannabis fairs, or other related commercial communications. Your e-mail may also be used to send an offer of a marketing competition organized by us or a survey organized by us. However, it will never concern communications that are unrelated to the content of our website. Processing of your e-mail for this purpose takes place on the basis of your consent (Art. 6(1)(a) GDPR), which you granted by ordering the newsletter. The consent is completely voluntary, and providing your e-mail for the newsletter is neither a legal nor a contractual obligation.

We inform you that newsletter administration is operated via an external marketing application. Thus, your e-mail is transferred to this external entity. However, you do not have to worry about your personal data. As already stated above, we have ensured that this contractual partner will comply with all legally required standards when handling your e-mail, and therefore misuse cannot occur.

We process your e-mail on the basis of your clear consent to receive such communications. If you wish to withdraw this consent in the future, each e-mail containing such communication contains a link in its header for withdrawing the consent. Consent may also be withdrawn at any time by sending an email to [email protected]. If you withdraw consent, we will delete you from all our databases and stop sending you any commercial communications. If you change your mind in the future, you can simply subscribe to the newsletter again on our website. Providing an e-mail for newsletter subscription is voluntary, but without providing it we cannot send you commercial communications.

We will process your e-mail for sending the newsletter for as long as you wish to receive it – i.e., until you withdraw consent or unsubscribe. The data will then be deleted, no later than within 14 days of unsubscribing.

3. Marketing competitions

From time to time, we organize marketing competitions for attractive prizes. If you decide to participate in our competition, we need your first and last name, your e-mail so that we can contact you regarding a potential win in the competition, and possibly your age so we can verify that you meet the conditions for participating in such a competition.

If you become a winner, we will further contact you to request contact details for sending the prize. When sending the prize, your personal data is, of course, transferred to the carrier. Also in this case, we have ensured that legal standards for the protection of your personal data will be observed and misuse cannot occur. The purpose of processing personal data is to carry out the competition, in the case of a win to announce the winner publicly, and to contact the winner. Your data is processed based on the performance of a contract (Art. 6(1)(b) GDPR), which you conclude by participating in the competition according to its rules.

When completing the competition form, you always have the option to give us consent to receive commercial communications described in the previous section “Newsletter”. In that section, you can further familiarize yourself with how your personal data will be handled.

Data of participants who do not win will be deleted or anonymized without undue delay after the end of the competition and evaluation of the winners. Data of the winners will be stored for the period necessary to deliver the prize and further only to the extent and for the period necessary for the fulfillment of our legal obligations.

4. Cookies and similar technologies

When you browse our website, we use technologies that help make browsing as easy as possible for you. These are mainly so-called cookies – short text files which the server places into your computer (or other device) when loading a website. Technically, they are a series of codes according to which the browser collects and subsequently sends information about your behavior back to our server. Cookies are not directly linked to your name or e-mail address, but they often contain your login data to the system. A detailed description of all collected cookies can be found here. The link also lists how long individual cookies are stored.

On our website we primarily use cookies solely for the purpose of transmitting a communication, or where necessary to provide services that you as a user of our website or customer of our e-shop expressly request. In such cases, the legislation does not require your consent for the use of cookies. These cookies are labeled as “Necessary”.

For all other types of cookies we need your consent. Consent to the collection of individual types of cookies can be withdrawn at any time by changing the settings of the relevant internet browser. The website can, of course, also be used in a mode that does not allow the collection of data on your behavior on our website.

These are primarily cookies that allow our website to remember information that changes how the website behaves or looks. This includes, for example, the preferred language or the region where you are located. These cookies are labeled as “Preference”.

We also collect cookies that are used for website traffic measurement and for identification within the advertising network and retargeting. These cookies are labeled as “Statistical”.

We also collect cookies for advertising targeting purposes. The intention is to display primarily advertising that is relevant and interesting for the individual user and thus more valuable for publishers and third-party advertisers. These cookies are labeled as “Marketing”.

The last category is the so-called Unclassified cookies. These are cookies that we are in the process of classifying together with the providers of the individual cookies. After classification, they will be included in one of the above-mentioned categories.

When processing cookies, we observe the general principles resulting from the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC), particularly the principles contained in Articles 25 and 5.

We may share information about how you use our website with our advertising and analytics partners. Partners may combine this data with other information you have provided to them or which they have obtained as a result of your use of their services (provided that you have consented through cookie settings).

Cookie usage settings form part of the browser you use. Cookies can be completely rejected or restricted through your browser. However, doing so may also limit the functioning of our website and you may not be able to fully use the features we offer.

5. Order in the e-shop

If you make a purchase in our e-shop www.canntropy.com, we process the following data you provide: first name, last name, e-mail, phone, your billing information (including any Company ID and VAT ID) and your shipping information if not identical to billing information. We process your personal data further in our internal database for the purpose of fulfilling our contractual obligations – especially sending the goods you have ordered. Data processing in connection with the purchase is necessary for contractual performance (Art. 6(1)(b) GDPR), therefore providing such personal data is a contractual requirement.

In connection with your purchase in our e-shop, your personal data is transferred to several external entities:

1. Administration of our website is provided by an external company. Within the administration of our website, it has access to this content as well.

2. Your personal data is transferred to an external accounting company for the purpose of fulfillment of our legal obligations.

3. Transfer of your personal data to the carrier (an alternative is pickup at the Controller’s registered office).

4. Transfer of your personal data to the payment service provider you have selected (an alternative is payment in cash upon pickup at the Controller’s registered office or cash on delivery upon shipment).

5. We measure customer satisfaction through email surveys under the Certified Customers program in which our e-shop participates. We send them to you every time you shop with us, unless in accordance with Section 7(3) of Act No. 480/2004 Coll. on certain information society services you refuse the sending of our commercial communications or withdraw a previously granted consent (see section 2 of these Policy “Newsletter” for more). For sending surveys, evaluation of your feedback and analysis of our market position, we use a processor that is the operator of the Heureka.cz platform; for these purposes we may transfer information about the purchased goods and your e-mail address.

However, you do not need to worry. We have ensured that all of these external entities will observe all legal standards in relation to your personal data and therefore misuse of your personal data cannot occur.

If you have placed an order in our e-shop, we may subsequently send you further offers of our goods or services even without your explicit consent. If you do not wish to receive such offers, each e-mail containing such communication will include a link in its header to unsubscribe from our offers.

We process data about your order for the period necessary to handle the purchase and for the duration of statutory periods (e.g. for exercising rights due to defective performance). Subsequently, we store billing data in a limited scope for the period during which we are required to store accounting and tax documents under legal regulations. After these periods expire, the data is securely deleted or anonymized. The e-mail address for the Certified Customers program is used once for sending the survey and is not further retained by Heureka – we keep the information that the survey was sent for a maximum of 6 months.

6. How we protect personal data

When collecting and storing your personal data, we enforce physical, electronic, and process safeguards. To keep your personal data safe:

1. We use computer security such as file password protection and firewalls.

2. We enforce physical access controls to our buildings and files.

3. We grant access to your personal data only to employees who need it to perform their work duties.

4. During transmission of your data when purchasing on our e-shop www.canntropy.com, we protect the security of your information by encrypting it using Secure Sockets Layer (“SSL”).

5. In cases where your personal data is transferred to another processor (e.g. the administrator of our website), we have ensured that each such processor will observe all legal standards in relation to your personal data and misuse cannot occur.

7. How long we use personal data

We process your personal data mainly for the duration of our contractual relationship. Personal data that are necessary for the fulfillment of our obligations (obligations arising from a contract or from generally binding legal regulations) must be processed for the period provided by such legal regulations or in accordance with them. We store your personal data only for the period strictly necessary. The purpose for which the data were collected must always be taken into account.

If the legal grounds for their storage cease to exist, we are obliged to delete your personal data from all our databases. Please note that sometimes the deletion of your personal data from one of our databases may be prevented by the fulfillment of legal obligations – e.g. keeping records of billing data of e-shop customers.

8. Other rights of data subjects

The rights you are entitled to include:

• Right of access to personal data (Art. 15 GDPR),
• Right to rectification of inaccurate data (Art. 16 GDPR),
• Right to erasure (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability (Art. 20 GDPR),
• Right to object to processing (Art. 21 GDPR).

If you believe that we process your personal data unlawfully or in conflict with generally binding legal regulations, you also have the right to lodge a complaint with the Office for Personal Data Protection, ID No.: 70837627, registered office Pplk. Sochora 27, 170 00 Prague 7.

If you are interested in learning more about your personal data protection rights, we recommend visiting the designated website https://www.gdpr.cz or contacting the Office for Personal Data Protection directly.

9. How to contact us

If you are interested in accessing your personal data or have other requests, questions, or comments regarding how we collect, store, and use your personal data, please contact us by e-mail at [email protected] or write to us at the registered office of our company. Your request will be processed without undue delay, but no later than within one month. In exceptional cases, especially given the complexity of your request, we are entitled to extend this period by another two months. In such case of extension, including justification, you will be informed.

These Personal Data Protection and Cookie Use Policy are valid and effective as of 24 September 2025.