This Privacy and Data Management Policy (hereinafter: “Policy”) explains how CANNADOL (hereinafter: “Data Controller”, “we”, “us”, or “our”) collects, processes, and protects your personal data when you visit or make a purchase on www.cannadolcbd.eu
The Data Controller’s activities comply with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Slovak laws.
1. Data Controller Information and Contact Details
Company name: MULTIGREEN s.r.o.
Registered office: Komenského 215/25, 94301 Štúrovo / Slovakia
Identification and contact data (name, e-mail, phone number, billing and shipping address)
Order and payment data (order number, purchased products, invoices, payment status – we do not store credit card data)
Customer service communications (letters, messages, attachments)
Account data (optional): e-mail, password hash, order history
Marketing data (newsletter subscription, preferences, campaign data)
Technical data (IP address, device information, cookies)
Age verification data (proof of being over 18, if necessary)
3. Source of Data Processing
We collect data directly from you (orders, contact inquiries, registrations, newsletter subscriptions), as well as automatically through cookies and similar technologies (depending on consent).
4. Purpose and Legal Basis of Data Processing
Purpose
Legal Basis (GDPR Article 6)
Order management, payment, shipping
contract performance (Article 6(1)(b))
Customer service
contract performance / legitimate interest
Accounting, tax obligations
legal obligation (Article 6(1)(c))
Newsletter, marketing
consent (Article 6(1)(a))
Analysis, performance measurement
consent (Article 6(1)(a))
Fraud prevention, IT security
legitimate interest (Article 6(1)(f))
5. Cookies
The Website uses cookies to operate and improve performance. Types:
Necessary cookies: essential for webshop operation (cannot be disabled)
Preference cookies: to remember settings (with consent)
Marketing cookies: ad personalization (with consent)
Consent to cookies can be withdrawn at any time. We do not use pre-checked checkboxes.
6. Data Processors and Recipients
Payment service providers
Shippers: [Packeta, Slovenská pošta, DHL, GLS]
Newsletter provider: MailerLite
IT and hosting providers
Accountants, legal advisors
7. Data Transfers Outside the EU
We only transfer data to countries that provide adequate protection (e.g., providers certified under the EU–US Privacy Shield Framework) or according to the EU-approved Standard Contractual Clauses.
8. Retention Periods
Order and invoice data: 10 years
Customer service data: 3 years
Account data: until account deletion
Marketing data: until withdrawn or after 24 months of inactivity
