This policy explains how Canna Gummies UK (“we”, “us”), trading as Canna Gummies (cannagummies.co.uk), collects and uses your personal data when you visit our website or buy from us. We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. What We Collect

When you place an order: name, delivery and billing address, email address, phone number, and details of what you bought. Payment card details are processed by our payment provider ([e.g. Stripe/PayPal]) — we never see or store your full card number.

When you verify your age: date of birth and, where required, the result of an identity check carried out by our age-verification provider ([provider name]). We receive a pass/fail result, not your identity documents.

When you create an account: login details, order history and any saved preferences.

When you contact us: your name, contact details, and the contents of your message.

When you browse: technical data such as IP address, browser type, device information and pages visited, collected via cookies and similar technologies — see our [Cookie Policy] for full detail and how to control them.

When you opt in to marketing: your email address and your marketing preferences.

We do not intentionally collect data about your health, and we do not collect data from anyone under 18 — our products and website are for adults only.

2. How We Use It, and Our Lawful Bases

Purpose Lawful basis
Processing and delivering your order Performance of a contract
Age verification before sale Legal obligation / legitimate interests (products are 18+ only)
Payment processing and fraud prevention Contract / legitimate interests
Responding to your enquiries Legitimate interests
Order confirmations and service emails Contract
Marketing emails (only if you opt in) Consent — withdraw any time via the unsubscribe link
Keeping records for tax and accounting Legal obligation
Improving our website and product range Legitimate interests
Complying with regulatory requirements (e.g. product traceability, Trading Standards enquiries) Legal obligation

We do not sell your personal data, and we do not use it for automated decision-making that produces legal effects on you.

3. Who We Share It With

Only the third parties needed to run the business:

  • Payment providers ([names]) — to take payment securely
  • Delivery couriers ([names]) — name and address to deliver your order
  • Age-verification provider ([name]) — to confirm you are 18+
  • Our website and hosting platform ([e.g. WordPress/WooCommerce host])
  • Email service provider ([name]) — for order and, with consent, marketing emails
  • Professional advisers and authorities — accountants, insurers, or regulators (such as Trading Standards or HMRC) where the law requires

Each provider processes data only on our instructions and under contracts meeting UK GDPR requirements.

4. International Transfers

Where a provider stores data outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision. Details available on request.

5. How Long We Keep It

  • Order and transaction records: 6 years (tax and legal requirements)
  • Account data: while your account is active, then deleted within [12] months of closure
  • Age-verification results: [retention period per your provider’s arrangement]
  • Enquiry correspondence: [24] months after resolution
  • Marketing data: until you unsubscribe or after [24] months of inactivity

6. Your Rights

Under UK GDPR you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to how we use it, port it to another provider, and withdraw consent at any time (this doesn’t affect processing already carried out). To exercise any right, email contact@cannagummies.co.uk — we respond within one month.

7. Security

We protect your data with [SSL/TLS encryption, access controls, PCI-DSS compliant payment processing — list your real measures]. No online system is perfectly secure, but we take reasonable and proportionate steps to protect what you share with us.

8. Cookies

Our website uses cookies for essential functions (basket, checkout, age-gate), and — with your consent — analytics and marketing. Full detail, including how to accept, refuse or change your choices, is in our [Cookie Policy].

9. Changes to This Policy

We’ll update this page when our practices change, with the date shown at the top. Significant changes will be flagged on the website or by email.

Questions? contact@cannagummies.co.uk