Table of Contents
1. Introduction
WeedPOS ("we," "our," or "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy describes how we collect, use, and disclose personal information when you use our website (weedpos.xyz) and our Cannabis Club Management System (collectively, the "Services").
We act as both a data controller (when processing data about visitors to our website and our customers) and as a data processor (when processing member data on behalf of Cannabis Social Clubs who use our Services).
This Privacy Policy is designed to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) and similar privacy regulations.
2. Definitions
- Personal Data: Any information relating to an identified or identifiable natural person.
- Data Controller: The entity that determines the purposes and means of processing personal data.
- Data Processor: The entity that processes personal data on behalf of the Data Controller.
- Club: Cannabis Social Club organizations that use our Services and act as Data Controllers for their member data.
- Member: An individual who has joined a Cannabis Social Club that uses our Services.
- User: Any person who uses our Services, including Club staff and administrators.
- Visitor: Any person who visits our website without being a registered User.
3. Data Collection
We collect different types of information depending on your relationship with us:
3.1 Information We Collect from Visitors
When you visit our website, we may collect:
- Device Information: IP address, browser type, device type, operating system, and screen resolution.
- Usage Data: Pages visited, time spent on pages, referring website, and interactions with our website.
- Cookies and Similar Technologies: Information collected through cookies and similar tracking technologies as described in our Cookie Policy.
- Contact Information: If you contact us through our website, we collect the information you provide, such as your name, email, and the content of your message.
3.2 Information We Collect from Club Administrators and Staff
When you register for and use our Services as a Club administrator or staff member, we collect:
- Account Information: Name, email address, username, password (encrypted), and profile information.
- Club Information: Club name, address, contact details, business registration details, and banking information for payment processing.
- Usage Information: Log data, device information, IP addresses, and information about how you use our Services.
- Communications: Records of your communications with us for support or other purposes.
- Payment Information: Billing address and payment method details (we do not store full credit card information).
3.3 Information Clubs Collect About Their Members
When Clubs use our Services to manage their membership, they may collect and input into our system:
- Member Identity Information: Name, date of birth, ID document details, membership number, and photos.
- Contact Information: Email address, phone number, and physical address.
- Membership Information: Membership type, status, join date, renewal date, and membership history.
- Transaction History: Purchase records, visit history, and payment information.
- Preferences: Product preferences and selections.
For this information, the Club acts as the Data Controller, and WeedPOS acts as the Data Processor. Clubs are responsible for obtaining proper consent from their members for the collection and use of this data.
4. Use of Data
4.1 How We Use Visitor Information
We use information collected from website visitors to:
- Provide, maintain, and improve our website
- Understand how our website is used to make improvements
- Respond to inquiries and provide customer support
- Send marketing communications (with consent where required)
- Protect against fraudulent, unauthorized, or illegal activity
- Enforce our terms of service and other legal rights
4.2 How We Use Club Administrator and Staff Information
We use information collected from Club administrators and staff to:
- Provide access to and functionality of our Services
- Process payments and manage subscriptions
- Send administrative notices, updates, and security alerts
- Provide customer support and technical assistance
- Communicate about new features and offerings
- Analyze usage patterns to improve our Services
- Maintain the security and integrity of our Services
4.3 How Clubs Use Member Information
Clubs use our Services to process their members' information to:
- Manage membership registration and verification
- Process transactions and track purchase history
- Generate membership cards and manage check-ins
- Communicate with members about club activities
- Track membership renewal dates and status
- Analyze member behavior and preferences
- Maintain compliance with applicable regulations
Clubs are responsible for ensuring they have a lawful basis for processing their members' personal data, including obtaining proper consent where required.
5. Legal Basis for Processing
Under the GDPR and similar laws, we process personal data on the following legal bases:
- Contract: Processing necessary for the performance of our contract with you when you use our Services.
- Legitimate Interests: Processing necessary for our legitimate interests, such as improving and marketing our Services, preventing fraud, and ensuring the security of our Services.
- Consent: Processing based on your specific consent, such as sending marketing communications or processing certain types of cookies.
- Legal Obligation: Processing necessary to comply with a legal obligation, such as retaining records for tax purposes.
For Clubs processing their members' data through our Services, the Club (as the Data Controller) is responsible for establishing and documenting the legal basis for their data processing activities.
6. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for satisfying legal, accounting, or reporting requirements.
6.1 Visitor Information
We retain website visitor information for up to 26 months before anonymizing or deleting it.
6.2 Club Administrator and Staff Information
We retain account information for as long as your account is active. If you cancel your subscription, we retain your information for 90 days to allow for reactivation, after which it will be deleted or anonymized, except for information we need to retain for legal purposes.
6.3 Member Information
Clubs determine the retention period for their members' data. Our system allows Clubs to set retention policies in accordance with their legal obligations and internal policies. By default, we provide tools for Clubs to anonymize or delete member data after the membership has been inactive for a specified period, which can be configured by the Club.
8. Data Security
We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:
- Encryption: All data is encrypted in transit using TLS/SSL protocols and at rest using AES-256-GCM encryption.
- Access Controls: Role-based access controls limit access to personal data to authorized personnel only.
- Authentication: Multi-factor authentication for accessing our systems.
- Monitoring: Continuous monitoring for unauthorized access or data breaches.
- Backups: Regular backups of data with secure storage and transportation.
- Security Testing: Regular security assessments and penetration testing.
- Emergency Features: Emergency lock capabilities to prevent unauthorized access in critical situations.
While we implement safeguards, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your personal data.
9. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
9.1 For Website Visitors and Club Administrators/Staff
You have the right to:
- Access: Request information about the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete personal data.
- Erasure: Request deletion of your personal data in certain circumstances.
- Restriction: Request restriction of processing of your personal data.
- Data Portability: Receive your personal data in a structured, commonly used format.
- Objection: Object to processing of your personal data in certain circumstances.
- Withdraw Consent: Withdraw consent where processing is based on consent.
- Lodge a Complaint: File a complaint with a supervisory authority.
To exercise these rights, please contact us using the information provided in the "Contact Information" section below.
9.2 For Cannabis Club Members
If you are a member of a Cannabis Social Club that uses our Services, the Club is the Data Controller for your personal data. To exercise your rights regarding your personal data, please contact the Club directly. If you contact us, we may forward your request to the relevant Club and assist them in responding to your request as appropriate.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by:
- Posting the updated policy on our website with a "Last Updated" date
- Sending an email to registered users (for significant changes)
- Displaying a notice on our website before the changes take effect
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
12. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
WeedPOS Data Protection Officer
Email: privacy@weedpos.xyz
Address: Carrer de Barcelona 123, 08001 Barcelona, Spain
For data protection inquiries, you can also contact our EU representative:
EU Representative
Email: eu-rep@weedpos.xyz
Address: Keizersgracht 555, 1017 DR Amsterdam, Netherlands
We will respond to your request within 30 days.