Privacy Policy

Initial template to be reviewed by legal counsel. The entries marked [TO BE COMPLETED] must be filled in.

This privacy policy describes how the online store "Golden CBD Europe" (hereinafter "we", "our" or "the Site") collects, uses, retains and protects the personal data of its visitors and customers. It is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the French Data Protection Act ("Informatique et Libertés").

By browsing the Site and placing an order, you acknowledge having read this policy.

1. Data controller

The controller of the data collected on the Site is:

Company: PW PURPLE WAVE DISTRIBUTION, SAS with a share capital of 100 €, SIREN 914 362 009 (RCS Antibes)
Address: 9 rue Desjoberts, 06700 Saint-Laurent-du-Var, France
Data protection contact: contact@goldencbd.fr

2. Data we collect

We only collect the data strictly necessary for the purposes described below:

Identity data

Surname, first name and, where applicable, title.
Date of birth or proof of legal age, as part of the age verification required for the sale of CBD products.

Contact data

Email address, telephone number.
Delivery address and billing address.

Order data

Details of products purchased, order history, amounts, exchanges relating to customer service.

Payment data

Information necessary for the payment of your order. Your complete bank details are never stored on our servers: they are processed directly by our secure payment service providers.

Browsing data and cookies

IP address, browser and device type, pages viewed, connection data and session identifiers placed via cookies or similar trackers.

3. Purposes of processing

Create and manage your customer account.
Process, prepare, dispatch and track your orders.
Manage payment and prevent fraud.
Verify that you are of legal age, the sale of CBD products being reserved for persons at least 18 years of age.
Respond to your requests to customer service and manage returns, complaints and disputes.
Send you, with your consent or where the law permits, commercial communications and our newsletter.
Improve the Site, measure its audience and personalise your experience.
Comply with our legal obligations, in particular accounting and tax obligations.

4. Legal bases

Performance of the contract: management of your account, processing and delivery of your orders, after-sales service.
Consent: sending of marketing communications, placement of non-essential cookies. You can withdraw your consent at any time.
Legitimate interest: fraud prevention, security of the Site, improvement of our products and services.
Legal obligation: retention of invoices, age verification, response to requests from the competent authorities.

5. Recipients and processors

Your data is intended for our authorised internal departments and for service providers acting on our behalf. We never sell your personal data.

Store hosting: Shopify, which hosts and operates the Site.
Payment service providers: [TO BE COMPLETED: payment service providers used] for the secure processing of transactions.
Carriers and logistics services: in particular UPS, for the delivery of your parcels.
Analytics and marketing tools: [TO BE COMPLETED: tools used] for audience measurement and communication.

6. Retention periods

Customer account data: for the duration of the commercial relationship, then up to 3 years after your last activity for prospecting purposes.
Order and billing data: 10 years from the close of the accounting year.
Prospecting data (newsletter): until your consent is withdrawn or 3 years after the last contact.
Cookies and trackers: a maximum of 13 months for cookies subject to consent.

7. Data transfers outside the European Union

Some of our service providers may process data outside the European Union. Where this is the case, these transfers are governed by appropriate safeguards within the meaning of the GDPR (standard contractual clauses of the European Commission or an adequacy decision).

8. Data security

We implement appropriate technical and organisational measures (HTTPS/SSL encryption, access management, secure hosting) to protect your data. Despite these measures, no transmission over the Internet can be guaranteed to be completely infallible.

9. Your rights

Right of access, rectification, erasure, objection, restriction and portability of your data.
Right to withdraw your consent at any time, without calling into question the lawfulness of the earlier processing.
Right to set guidelines regarding the fate of your data after your death.

To exercise these rights, send your request to contact@goldencbd.fr. Proof of identity may be requested. We respond within one month.

10. Complaint to the CNIL

If you consider that your rights are not respected, you may lodge a complaint with the CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at www.cnil.fr.

11. Cookies

The Site uses cookies necessary for its operation, as well as audience measurement and marketing cookies subject to your consent. To find out more, see our cookie policy.

12. Protection of minors

The Site and the sale of CBD-based products are strictly reserved for adults at least 18 years of age. We do not knowingly collect data concerning minors.

13. Changes

We may amend this policy in order to adapt it to changes in our practices or in the regulations. The applicable version is the one published on the Site at the time of your visit.