TEMPLATE — MUST BE REVIEWED BY A LAWYER before publication. This document is a draft and is not legal advice.
Privacy Policy
Last updated: template
1. Data controller
Canna-Tech Sàrl, acting as the official counterparty (model A: buys from the producer, resells to the distributor). Contact: privacy@cbd-exchange.com.
2. Data processed
Producers: contact details (WhatsApp/Telegram/email), messages and media sent, internal region. Distributors: company, VAT no., license documents, orders. No producer data is exposed to distributors and vice versa.
3. Processors and transfers
Messaging via Meta/WhatsApp and Telegram; AI-assisted analysis via Anthropic (Claude); media stored on Cloudflare R2 (private bucket); Neon database (EU, Frankfurt). Transfers outside the EU may occur with these providers, governed by standard contractual clauses.
4. Legal bases
Consent (listing of producer lots), performance of contract (distributor orders), legitimate interest (fraud prevention, security), legal obligation (invoicing, accounting).
5. Retention
Raw messages and identifying media: purged after a lot is validated per INGEST_RETENTION_DAYS (default 90 days). Published lots: kept in anonymised form. Invoicing data: kept per statutory accounting obligations.
6. Your rights
Access, rectification, erasure, restriction, objection, portability. Erasure anonymises identity and deletes raw identifying media while keeping already-published lots anonymised. Contact: privacy@cbd-exchange.com.
7. DPA & security
A data processing agreement (DPA) is available on request for partners. Measures: encryption in transit, private bucket + short signed URLs, role-based access control, audit logging.