Introduction
At Cannactiva we value the security of our users and customers and we are committed to defending their rights, and therefore their privacy. We want you to feel safe while enjoying your visit to our website and our services. Therefore, in our privacy policy you will find how we process and protect the personal information of all the people who are related to Cannactiva S.L.
In accordance with the provisions of EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights and, for users resident in Switzerland, the Swiss Federal Act on Data Protection of 25 September 2020 (nFADP), Cannactiva S.L. informs you of how it processes, as data controller, the data you provide, to which it applies the security, technical and organisational measures provided for in the current regulations. Each processing activity is based on the legal basis indicated in the legal basis section: not on the acceptance of this policy.
As a company established in Spain, Cannactiva S.L. is subject to the GDPR and to Spanish law. The processing of the data of persons in Switzerland is also subject to the nFADP, which applies whenever processing has effects in Switzerland (art. 3 nFADP); nothing in this policy limits the rights it grants.
This version of the policy applies to the users of the Swiss edition of the website and is published in German, French, Italian and English.
1. Data controller
Who is responsible for the processing of your data?
- Company name: CANNACTIVA S.L.
- Registered office: Calle Calabria 149, Entlo. 1, 08015 Barcelona (Spain)
- Tax ID (CIF): B67233593 / VAT: ESB67233593
- Registry details: Registered in the Barcelona Commercial Register, volume 47990, folio 58, sheet B-568545, 1st entry
- Telephone: +34 932 20 48 98 (business hours: Monday to Friday, except public holidays, from 11 a.m. to 6 p.m.)
- E-mail: info@cannactiva.com
2. Purpose of processing and categories of data processed
What categories of data do we process?
Cannactiva S.L. processes the following categories of data:
Identifying data
- Name, surname, postal address, e-mail address, postcode, telephone numbers.
- Encrypted user identification codes or keys.
- Commercial information data, such as purchase history on the website.
- Transactional data, such as products and services requested and payment method used (card data is processed directly by the payment platform).
- Browsing and connection data: IP address, browser, country and use of the website.
- Content of communications with customer service (e-mail, telephone and WhatsApp) and of product reviews.
In the event that the user provides third-party data, the user declares that they have their consent and undertakes to pass on to them the information contained in this clause, exempting Cannactiva S.L. from any liability in this regard. However, Cannactiva S.L. may carry out the necessary verifications to confirm this fact, adopting the appropriate due diligence measures, in accordance with data protection regulations. In particular, persons under eighteen (18) years of age cannot access the website or make purchases, even with the authorisation of legal guardians. Therefore, Cannactiva will not, under any circumstances, collect data from persons who are minors.
The data that in the forms provided by Cannactiva S.L. through the website are marked with an asterisk (*), will be necessary to fulfil the contractual or legal purposes established. Therefore, if the user does not provide them, it will not be possible to register on the website or attend to their request.
For what purpose and for how long will we process your personal data?
Cannactiva S.L. will process the user's data, manually and/or automatically, for the following specific purposes:
- Managing the registration and administration of the user's account on the website owned by Cannactiva S.L. (hereinafter, the "website").
- Managing the contracting of products and/or services offered through the website, including order processing, invoicing, payment, shipping and purchase-related support.
- Sending customers, by e-mail and/or SMS, communications about products similar to those they purchased, unless they object, which they can also do from each communication.
- When the user has given their express consent, Cannactiva may send commercial and promotional communications by e-mail, post, telephone and/or SMS, with information about offers, promotions, news and content related to its products and services. The user may object or withdraw their consent at any time.
- Answering the queries the user sends us by e-mail, telephone, WhatsApp or the contact form.
- Publishing customer reviews of the products and generating summaries of those reviews with artificial intelligence.
- Following up on unfinished shopping baskets, in order to improve the purchase process and help those who do not complete it.
- Measuring the use of the website and producing statistics, with the analytics cookies the user has accepted.
- Cannactiva S.L. does not make decisions based solely on automated processing of data that produce legal effects concerning the user or similarly significantly affect them.
- Personal data will be kept for as long as necessary to fulfil the purposes for which they were collected and, subsequently, for the legally required periods or until the user requests their deletion or objection, where appropriate. Cannactiva is committed to complying with legally established obligations, as well as verifying compliance with contractual obligations, including fraud prevention.
How long do we keep your data?
Cannactiva S.L. will keep users' personal data only for as long as necessary to fulfil the purposes for which they were collected, as long as the consents granted have not been revoked. Subsequently, the data will be kept blocked for the periods required by law, solely to deal with any possible liabilities. In particular:
- Account data: while the account is active, until the user requests its closure.
- Orders and invoices: six years, in accordance with Article 30 of the Spanish Commercial Code.
- Commercial communications: until the user unsubscribes or withdraws their consent.
- Unfinished shopping baskets recorded in the management system: 12 months from the basket's last activity.
- Files sent via WhatsApp: 30 days on the service provider's servers.
- Cookies: the period indicated for each one in the cookies section.
If you send us your CV, we will process it to assess your application in our recruitment processes, with your consent, and we will keep it for a maximum of one year, unless you ask us to delete it before then.
What security measures do we apply to protect your data?
For the protection of the different types of data reflected in this privacy policy, Cannactiva S.L. will carry out all necessary technical security measures to prevent their loss, manipulation, dissemination or alteration:
- Confidentiality agreement for website workers and service providers.
- Encryption of communications between the user's device and Cannactiva S.L. servers.
- Passwords stored in encrypted form (never in readable text) and access to the servers restricted to authorised personnel.
- Other measures to prevent access to user data by third parties.
- Data transfers outside the European Union, where there are any, are explained in section 4, next to each provider.
3. Legal basis
What is the legal basis for processing your data?
The legal basis for the processing of user data by Cannactiva S.L. to carry out the registration of the user on the website is the performance of the contract that the user accepts when creating their account.
For its part, the management of the contracting of products or services through the website, payment, invoicing and corresponding shipments is based on the performance of the contract itself.
The sending of electronic newsletters and commercial communications by e-mail or SMS is based on the User's consent. When the User is already a customer, we may send them communications about products similar to those they purchased based on our legitimate interest, in accordance with Article 21.2 of Law 34/2002 (LSSI); the User may object at any time, also from each communication.
The preparation of statistical reports on access habits and user activity on the website by means of analytics cookies is based on the consent given in the cookie notice.
The generation of review summaries with artificial intelligence is based on the legitimate interest of Cannactiva S.L. in offering users useful information about the products. Address autocompletion at checkout is based on the performance of the contract. The follow-up of unfinished shopping baskets is based on the legitimate interest of Cannactiva S.L. in improving its purchase process and assisting Users who do not complete it, without sending them commercial communications unless they have consented to them.
Answering the queries the user sends us by e-mail, telephone, WhatsApp or the contact form is based on the application of pre-contractual measures or on the performance of the contract and, where there is no contractual relationship, on the consent the user gives by writing to us. The publication of reviews is based on the consent the customer gives by submitting them.
The consents obtained for the above purposes are independent, so the user may revoke one or more of them without affecting the others.
Likewise, the user's information may be used to comply with the various legal obligations of Cannactiva S.L.
For users resident in Switzerland: the nFADP does not make processing depend on a legal basis, but on compliance with its principles (art. 6 nFADP); where a justification is required, Cannactiva S.L. relies on these same grounds (art. 31 nFADP). Communications about products similar to those already purchased are sent without prior consent only to customers who gave us their contact details when buying, after being informed in this policy that they can refuse them, and every message allows them to do so easily and free of charge (art. 3 para. 1 let. o of the Federal Act against Unfair Competition, UCA).
4. Data communication
To which recipients will your data be communicated?
The providers that process data on behalf of Cannactiva S.L. (data processors) may only do so following our instructions and in order to provide their service to us. In the event that data communication is necessary, Cannactiva S.L. will only share the personal data strictly necessary for the purpose:
- To the Cannactiva S.L. staff responsible for shipments, customer service and marketing, to manage orders, queries received through the contact form and commercial campaigns (name, surname, e-mail and telephone).
- To banks and financial institutions for payment of the services offered through the QuickPay payment platform. Card data is entered directly on the payment platform and does not pass through our servers (see privacy policy).
- To the shipping company for order delivery: for shipments to Switzerland, UPS (see privacy policy), which also receives the data needed for the customs clearance of the parcel.
- To the e-mail manager HubSpot (see privacy policy) for sending the newsletter and commercial communications.
- To the SMS sending platform Instasent (see privacy policy) for sending promotional SMS.
- To the messaging service WhatsApp, when the User decides to write to us through that channel from the links on the website (see privacy policy).
- To AcruxLab SpA (Chile), provider of the ChatRoom we use to handle WhatsApp messages (apichat.io service): telephone number, profile name and content of the messages, which are also stored in our management system (Odoo) to handle the conversation. Files sent through this channel are kept on its servers for 30 days. AcruxLab SpA is located in Chile and uses Amazon Web Services servers in the United States, outside the European Economic Area; the European Commission has not recognised Chile as having an equivalent level of protection; the User may request information about the safeguards applied to this transfer by writing to info@cannactiva.com. If the User prefers that their data does not leave the European Economic Area, they can contact us by e-mail (info@cannactiva.com) or by telephone instead of WhatsApp (see AcruxLab privacy policy).
- To the website hosting provider, Hetzner Online GmbH, with servers in Germany, and to the backup provider, Contabo GmbH, with servers in France (see Hetzner privacy policy, see Contabo privacy policy).
- To our management system Odoo (Odoo S.A., with servers in Belgium), where orders, invoicing and customer service are managed. Shopping baskets (products and amount) are also sent to Odoo together with the IP address, browser and country and, if the User has provided them, their e-mail, name and telephone, in order to follow up on unfinished purchases; these baskets are kept for 12 months from their last activity (see privacy policy).
- To Atomiar Trade S.L. (Tax ID B56918832, Barcelona), a company related to Cannactiva S.L. that manages the shipping of orders: name, address, telephone and e-mail of the recipient.
- To SendCloud (SendCloud B.V.), the platform we use to generate shipping labels and which communicates the delivery data to the shipping company (see privacy policy).
- To Google Maps Platform (Google Ireland Limited), to suggest addresses while the User types theirs at checkout. The query is made from our server and only the text of the address being typed is sent, without the User's IP address (see privacy policy).
- To Aircall (Aircall SAS, France), the telephone system we use to handle customer service calls: telephone number and call data (see privacy policy).
- To the website analytics and security services, Google Analytics (Google Ireland Limited), Hotjar (Hotjar Ltd., Malta) and Cloudflare (Cloudflare, Inc.), under the terms explained in the cookies section. Google Analytics and Hotjar are only activated if the User accepts cookies.
- To OpenAI (OpenAI Ireland Ltd.), to generate with artificial intelligence the summaries of the product reviews shown on the website. Only the rating and the text of the reviews are sent, without the name or contact details of the person who wrote them. Only customers with a completed order can publish reviews, and the summaries are marked on the website as generated with artificial intelligence. We ask Users not to include health data or other personal data in their reviews. OpenAI may process this data in the United States, outside the European Economic Area; these transfers are covered by the European Commission's standard contractual clauses or by an adequacy decision (see privacy policy).
International transfers
Some of these providers process data outside the European Economic Area:
- HubSpot, Inc. (e-mail), Cloudflare, Inc. (website security) and Google LLC (Google Analytics and store map), in the United States, are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection.
- OpenAI (United States) relies on the European Commission's standard contractual clauses or on an adequacy decision.
- AcruxLab SpA (Chile and United States): see its entry above.
For users resident in Switzerland: their data is disclosed to Spain, where Cannactiva S.L. is established, and to the recipients listed in this section, in the countries indicated for each one. The Swiss Federal Council recognises an adequate level of data protection in the States of the European Economic Area and, for organisations certified under the Swiss-U.S. Data Privacy Framework, in the United States (art. 16 para. 1 nFADP and Annex 1 to the Data Protection Ordinance). Disclosures to recipients in the United States that are not certified under that framework rely on standard data protection clauses recognised by the FDPIC (art. 16 para. 2 let. d nFADP). Chile is not on the Federal Council's list: see the entry for AcruxLab SpA above.
The User may request more information about these safeguards by writing to info@cannactiva.com.
5. Other data processed by Cannactiva S.L.
When you call us, Cannactiva S.L. processes your telephone number and the call data to handle your request and improve the quality of the service, through the Aircall telephone system. The legal basis is the application of pre-contractual measures, the performance of the contract or, where there is no contractual relationship, the consent you give by calling us.
6. User rights
What rights does the user or data subject have?
You may send us a written request at any time and free of charge, for the exercise of the following rights:
- Revoke the consents granted.
- Obtain confirmation as to whether or not Cannactiva S.L. is processing personal data concerning you.
- Access your personal data.
- Rectify inaccurate or incomplete data.
- Request the deletion of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
- Obtain from Cannactiva S.L. the restriction of data processing when any of the conditions provided in data protection regulations are met.
- Object to the processing of your data on grounds relating to your particular situation. Cannactiva S.L. will cease processing the data, except for compelling legitimate grounds, or the exercise or defence of possible claims.
- Object at any time, and without having to give reasons, to receiving commercial communications.
- Request the portability of your data.
- Lodge a complaint with the Spanish Data Protection Agency (AEPD) or, if you reside in Switzerland, report the matter to the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) when the data subject considers that Cannactiva S.L. has violated the rights recognised by the applicable data protection regulations.
Privacy policy: contact
You can exercise all your rights by contacting us:
- Telephone: +34 932 20 48 98 (business hours: Monday to Friday, except public holidays, from 11 a.m. to 6 p.m.)
- E-mail: info@cannactiva.com
7. Confidentiality
The personal data collected through this website or through the various communications maintained with the user will be treated confidentially, and we undertake to keep them secret in accordance with the provisions of applicable legislation.
9. Privacy policy update
This Privacy Policy may need to be updated. For this reason, it is necessary for the user to review this policy periodically and, if possible, each time they access the website in order to be adequately informed about the type of information collected and its processing. Notwithstanding the foregoing, the user will be informed of any modification to this privacy policy that affects the processing of their personal data.
Contact
If you have any enquiry, query, question, suggestion, comment… Contact us. If you have any questions about the privacy policy and/or want to request any information and/or send communications and/or submit corrections and/or comments about sales, orders, products, payments and shipments, you can do so through these channels:
- E-mail: info@cannactiva.com
- Telephone: +34 932 20 48 98 (business hours: Monday to Friday, except public holidays, from 11 a.m. to 6 p.m.)
- Contact form that you will find on the Cannactiva contact page
Thank you very much!