Personal Data Protection Policy: Rules on Personal Data Protection and Use of Cookies

Privacy & Cookie Policy

The purpose of this Privacy Policy (hereinafter referred to as the "Policy") is to set out the rules for the processing of personal data in accordance with applicable legislation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter referred to as the "GDPR") and Act No. 110/2019 Coll., on the processing of personal data.

These Principles will help you understand what data our company (as the controller of your personal data) Canna b2b, s.r.o., with its registered office at Žižkova 708, Příbram II, 261 01, Czech Republic, Company ID: 02023024, Tax ID: CZ02023024, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. C 214621 (hereinafter referred to as the "Controller"), collects, how it uses it, with whom it shares it and how you can exercise your rights against the Controller.

1. User registration

If you register on our e-shop, we process the following personal data:

• E-mail address
• username
• password

We process this data for the purpose of managing your user account on the basis of the performance of the contract pursuant to Art. 6 para. 1 lit. b) GDPR.

We store the data for the duration of your user account, but no longer than 3 years after the last activity. If you cancel your account, your data will be promptly deleted from all of our databases.

Transfer of data to third parties

Your personal data may be transferred to the following third parties in connection with the administration of your user account:

• Upgates – e-commerce platform, e-shop manager
• Děkovačka.cz (dekovacka.cz) – service for sending thanks to customers automatically

2. Newsletter

If you subscribe to the newsletter, we will process your e-mail on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

We use email to send you information about:

• news on our e-shop
• special offers and discounts
• news from cooperating seed banks and cannabis fairs
• marketing competitions
• Related Content

We store the email address for 3 years. If you withdraw your consent, we will stop sending you the newsletter and delete your email from all our databases.

Transfer of data to third parties

We use the services of external providers to send newsletters:

• SmartEmailing, Incomaker – email service providers
• Google, Facebook, Instagram, WhatsApp, TikTok, LinkedIn, Sklik, Zboží, Heureka, Smartsupp – marketing service providers

3. Marketing competitions

If you participate in our competition, we process the following data:

• First and last name (or nickname)
• age
• email

We process this data on the basis of consent (Art. 6 (1) (a) GDPR) for the purpose of organising the competition, contacting the winner and publishing the winner of the competition.

We store the data for the duration of the competition and then for 6 months in case of complaints or disputes.

Transfer of data to third parties

In the event of a win, your personal data may be transferred to:

• Zásilkovna s.r.o. ID: 28408306 – carrier for the purpose of delivering the prize

4. Cookies and similar technologies

When you visit our website, we use cookies to help us improve your user experience, analyze traffic and target advertising. We use the following types of cookies:

Necessary cookies
Necessary cookies ensure basic functionality of the website, such as login, security and order completion. Without these cookies, the website would not function properly. The processing of these cookies is based on a legitimate interest (Art. 6 (1) (f) GDPR).

If you wish to prevent the processing of these cookies, you can object in accordance with Article 21 GDPR. However, in this case, we may not be able to guarantee the full functionality of our website.

Preference cookies Preference
cookies allow our website to remember information about your preferences, such as the language you have selected or the region you are in. We process these cookies only on the basis of consent (Art. 6 (1) (a) GDPR).

You can refuse or change the use of preference cookies at any time through the cookie settings on our website or in your browser.

Statistical cookies
Statistical cookies help us understand how visitors use our site – for example, which pages are the most popular or how long visitors stay on the site. This information allows us to optimize content and improve the user experience. The processing of statistical cookies takes place only on the basis of consent (Art. 6 (1) (a) GDPR).

If you wish to refuse the use of statistical cookies, you can do so at any time through the cookie settings on our website or in your browser settings.

Marketing cookies
Marketing cookies are used to show you advertisements that are relevant to you. These cookies track your behaviour on our site and can be used to build a profile of your interests. Based on this profile, you will then see ads tailored to your preferences. Marketing cookies are processed only on the basis of consent (Art. 6 (1) (a) GDPR).

If you wish to refuse the use of marketing cookies, you can do so at any time through the cookie settings on our website or in your browser settings.

Unclassified cookies
Unclassified cookies are cookies that are undergoing a classification process and have not yet been assigned to any of the above categories. We process these cookies on the basis of a legitimate interest (Art. 6 (1) (f) GDPR).

If you wish to prevent the processing of unclassified cookies, you can object in accordance with Article 21 GDPR.

Sharing cookies by third parties

Some cookies are stored by third parties (e.g. Google, Facebook, Seznam) and can be used to combine data with other sources for advertising targeting or analytical purposes. In these cases, the processing of cookies is subject to the privacy policies of the relevant third parties.

The use of cookies by third parties includes the following cases:

• Google – for analytics purposes (Google Analytics) and ad targeting (Google Ads)
• Facebook – for the purpose of targeting advertising based on user behaviour
• Seznam.cz – for the purposes of personalizing advertising and measuring its effectiveness
• Heureka – for the purposes of analyzing product performance, measuring conversions, optimizing offers and personalizing ads

Cookie data storage

Cookies are stored for the following periods:

• Necessary cookies – for the duration of the session or until the browser is closed
• Preferential cookies – for 12 months
• Statistical cookies – for 24 months
• Marketing cookies – for 12 months
• Unclassified cookies – for the duration of the session or until the browser is closed

5. Order in the e-shop

If you make a purchase from us, we process the following data:

• Name and surname
• email
• phone
• Billing and delivery information

We process this data on the basis of the performance of a contract (Art. 6 (1) (b) GDPR) for a period of 5 years (for accounting purposes).

Transfer of data to third parties

Your personal data may be transferred in connection with the order:

• Zásilkovna s.r.o., General Logistics Systems Czech Republic s.r.o. (GLS), UNITED PARCEL SERVICE CZECH REPUBLIC, s.r.o. (UPS) – transport systems and carriers for the purpose of delivering goods
• PayU S.A., GOPAY s.r.o., Twisto payments a.s. – payment service provider

 

6. Automated decision-making

As part of age verification using the (Adulto.cz) service, automated decision-making occurs. In accordance with Article 22 of the GDPR, you have the right to:

• Require human intervention
• express your opinion
• challenge the decision

7. Rights of the data subject

You have the right to:

• Access to personal data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• Erasure of data ("right to be forgotten") (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)

If you believe that we are processing your data in violation of the GDPR, you have the right to file a complaint with the Office for Personal Data Protection (www.uoou.cz).

8. How to contact us

If you have any questions regarding the processing of your personal data, please contact us by e-mail [email protected] or at the address of the company's registered office.

9. Applicability of the Policy

This policy is valid from 30. 4. 2025.