Privacy Policy — Cannabis Institute

English translation for convenience; the Polish version prevails.

§ 1 GENERAL PROVISIONS

1. The controller of personal data collected through the Cannabis Institute website at https://www.cannabis-institute.com, together with the Medical portal at https://www.cannabis-institute.com/medical (together the "Service"), is Carborating spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office in Poznań, operating under the Cannabis Institute brand (the "Controller" or "Provider"):
   • registration: the register of entrepreneurs of the National Court Register (KRS) kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register, KRS no. 0001049184;
   • share capital: PLN 5,000.00;
   • registered office and address for service: ul. Święty Marcin 29/8, 61-806 Poznań, Poland;
   • NIP: 7831884732, REGON: 525930681;
   • e-mail: info@cannabis-institute.com.
2. Through the Service the Controller offers (together the "Services"):
   • a cannabis news service (news, regulatory map);
   • the Knowledge Base, Digital Plant and Academy courses, in the Supporters' Zone with Support;
   • the Equipment Catalogue, with price comparison and order forwarding to Partner Shops;
   • the Patient Zone with personal tools, including the Diary;
   • the medicinal-products list and the doctor finder;
   • other content available in the Service.
3. Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, "GDPR") and Polish law.
4. Capitalised terms not defined here have the meaning given in the Terms of Service of Cannabis Institute (the "Terms"). "User" means a natural person using the Service, including one with an Account.
5. The Services are intended for adults. The Controller does not target minors and does not knowingly collect their data. If it learns of such a case, it deletes the data unless the law provides otherwise.

§ 2 ROLES IN THE PROCESSING

1. The Controller is the controller of Users' data needed to run the Service, conclude and perform contracts, bill, support, secure the Service and pursue claims. With the User's consent, it is also the controller of Diary data and of data processed for marketing.
2. For an order placed with a Partner Shop through the Service, the Controller forwards to the Partner Shop the data needed to fulfil it. The Partner Shop processes them as an independent controller, deciding on the purposes and means itself, under its own privacy policy.
3. The payment operators — PayPro S.A. (Przelewy24) and Stripe Payments Europe Ltd. — process payment data as independent controllers under their own privacy policies. The Controller does not store card data.
4. If the User signs in with a Google or Apple account, that provider processes the sign-in data as an independent controller. The Controller receives only the data needed to create and run the Account: an identifier, the e-mail address and, if the User shares it, their name.
5. The Controller does not sell Users' data. It may process usage data in aggregated, anonymised form that does not identify anyone, to develop and secure the Services. Diary data are never used for any analysis.

§ 3 PURPOSES, LEGAL BASES AND SCOPE OF PROCESSING

1. The Controller processes personal data for the following purposes and on the following legal bases:
   • 1.1. registering and running the Account, including remembering the chosen Profile and portal — Art. 6(1)(b) GDPR (performance of the electronic services contract);
   • 1.2. concluding and performing the Support contract, including access to Content — Art. 6(1)(b) GDPR. Where the contract is concluded by a Trader that is a legal person or organisational unit and the data concern its representatives or contact persons — Art. 6(1)(f) GDPR;
   • 1.3. verifying the licence to practise of a User who chose the doctor/healthcare-professional Profile, to give access to content reserved for persons authorised to prescribe or supply medicinal products — Art. 6(1)(b) and Art. 6(1)(c) GDPR, in connection with the Pharmaceutical Law rules on advertising of medicinal products;
   • 1.4. keeping the Diary in the Account — the User's explicit consent, Art. 9(2)(a) in connection with Art. 6(1)(a) GDPR (§ 4);
   • 1.5. forwarding an order to a Partner Shop and informing the User of its status — Art. 6(1)(b) GDPR (at the User's request);
   • 1.6. handling questions sent by e-mail or Service forms, including doctor-finder submissions, removal requests and reports of unlawful content. The bases are, as applicable:
     • Art. 6(1)(b) GDPR — pre-contractual steps at the person's request;
     • Art. 6(1)(c) GDPR — obligations under Regulation (EU) 2022/2065, the Digital Services Act;
     • Art. 6(1)(f) GDPR — the Controller's legitimate interest in replying;
   • 1.7. running the doctor and clinic finder from public registers (in particular the Register of Entities Performing Medical Activity) and data submitted by doctors — Art. 6(1)(f) GDPR (the legitimate interest of the Controller and patients in access to information about lawful treatment);
   • 1.8. technical support and keeping the Service running — Art. 6(1)(b) and (f) GDPR;
   • 1.9. issuing and keeping accounting and tax documents, including invoices sent to the National e-Invoice System, and meeting the Controller's other legal obligations under tax, accounting and business law — Art. 6(1)(c) GDPR;
   • 1.10. securing the Service: detecting abuse, preventing unauthorised access, keeping system logs, logging Experts' and administrators' access to non-public resources, and preventing breaches of the Terms — Art. 6(1)(f) GDPR (the legitimate interest in protecting the system, data and licensed content);
   • 1.11. establishing, pursuing and defending claims — Art. 6(1)(f) GDPR;

Withdrawal does not affect the lawfulness of earlier processing. Account notices, reminders about the end of a paid Support period, and notices about changes to the Terms, outages, maintenance and security concern performance of the contract and need no marketing consent.

1. The Controller does not profile Users for marketing. The chosen Profile and the connection country are used only to choose the content, portal and currency shown. The User can change them, and they do not lead to decisions with legal or similarly significant effects.
2. The Controller ensures that data are processed lawfully, fairly and transparently; collected for specified, legitimate purposes; adequate and accurate; and kept in identifiable form no longer than necessary.

§ 4 HEALTH DATA — THE DIARY

1. By default the Diary works only in the User's browser local storage. In this mode, entries are not sent to the Controller.
2. Saving entries in the Account requires a separate, explicit consent: the User ticks an unticked box after reading the full consent text. The Controller records the date, text version and language of the consent.
3. Consent can be withdrawn at any time in the Diary. Withdrawal deletes all entries from the Account and then marks the consent as withdrawn. Before withdrawing, the User can download a copy of the entries.
4. Only the User can access the entries. Database safeguards prevent access by Service administrators and by the Service's server-side mechanisms. The Controller does not share entries with doctors, Partner Shops or anyone else. It does not use them for profiling, marketing or model training.
5. The Controller has carried out a data protection impact assessment for the Diary.
6. The Controller does not use Diary entries or any other User data for scientific research. Concluding a Support contract does not mean consent to such use. If the Controller intends to conduct or support scientific research using User data in the future, it will first provide separate information about the purpose, the data involved, the recipients, the safeguards (including pseudonymisation or anonymisation) and the retention period. Data may then be used only on the basis of a separate, voluntary and explicit consent (Article 9(2)(a) GDPR) and only for the Users who gave it. Not giving that consent does not affect the use of the Service or the Diary.

§ 5 RETENTION

1. Data processed to perform a contract are kept for its duration and then for the limitation period of claims related to it. Unless a specific provision states otherwise, the limitation period is six years. For periodic claims and claims related to business activity it is three years, ending at the end of the calendar year.
2. Data in accounting and tax documents are kept for the period required by tax and accounting law.
3. Data processed on the basis of consent are kept until consent is withdrawn, and then for as long as needed to prove that consent was given and withdrawn and to defend against claims. Diary entries are deleted immediately when consent is withdrawn or the Account is deleted.
4. Data processed on the basis of legitimate interest are kept until an effective objection or until the interest ceases, including expiry of the limitation period.
5. Data from questions, reports and correspondence are kept as long as needed to handle the matter and then for the limitation period of any claims.
6. Doctor-finder data are kept until the entry is removed at the data subject's request or the data are no longer current in the public register.
7. Retention of logs and access records:
   • system logs are kept as long as needed for security and diagnostics, no longer than [30 days];
   • the record of Experts' and administrators' access to non-public resources is kept for [24 months].

Both periods may be extended where the data are needed to investigate an incident or pursue claims.

1. After an Account is deleted, data are removed from production systems immediately and from backups as they are cyclically overwritten, unless the law requires longer retention.

§ 6 RECIPIENTS AND TRANSFERS OUTSIDE THE EEA

1. Personal data may be entrusted or disclosed to entities whose services the Controller uses to run the Service and provide the Services, in particular:
   • 1.1. the database, authentication and file-storage provider — Supabase, Inc. Data are stored in the European Union, in a data centre in Frankfurt am Main (region eu-central-1);
   • 1.2. the application hosting and content-delivery provider — Vercel, Inc.;
   • 1.3. the e-mail delivery provider — Resend, Inc.;
   • 1.4. payment operators — PayPro S.A. (Przelewy24) and Stripe Payments Europe Ltd. (§ 2(3));
   • 1.5. sign-in providers — Google Ireland Ltd. / Google LLC and Apple Distribution International Ltd. / Apple Inc., if the User chooses that sign-in method (§ 2(4));
   • 1.6. Partner Shops, for orders placed by the User (§ 2(2));
   • 1.7. an accounting firm, law firms and advisers;
   • 1.8. public bodies processing data in connection with the Controller's legal obligations, including the Minister of Finance, which runs KSeF (the National e-Invoice System);
   • 1.9. competent state authorities where the law requires disclosure.
2. Depending on the contract and circumstances, service providers act either as processors on the Controller's instructions or as independent controllers:
   • processors: Supabase, Vercel, Resend and the accounting firm;
   • independent controllers: payment operators, sign-in providers and Partner Shops.
3. Public content (in particular articles and scientific publications) is translated and classified with the help of language-model providers. The Controller does not send Users' personal data to them.
4. As a rule, personal data are stored in the European Economic Area (EEA). Data may be transferred outside the EEA, in particular to the United States, where the parent company or infrastructure of a provider is outside the EEA:
   • Vercel — edge network and content delivery;
   • Stripe;
   • Resend;
   • Google and Apple — sign-in;
   • Supabase — a US entity, as regards service access.

Transfers are based on a European Commission adequacy decision (the EU-US Data Privacy Framework, for recipients participating in it) or on the Standard Contractual Clauses approved by the European Commission under Art. 46(2)(c) GDPR, with supplementary measures where needed. A copy of the safeguards can be requested at the address in § 1(1).

1. The Controller does not sell personal data.

§ 7 DATA SUBJECTS' RIGHTS

1. Data subjects have the right to:
   • access their data;
   • rectify their data;
   • erase their data;
   • restrict processing;
   • data portability;
   • object to processing;
   • withdraw consent at any time, without affecting the lawfulness of earlier processing.
2. Legal bases of requests:
   • 2.1. access — Art. 15 GDPR,
   • 2.2. rectification — Art. 16 GDPR,
   • 2.3. erasure — Art. 17 GDPR,
   • 2.4. restriction — Art. 18 GDPR,
   • 2.5. portability — Art. 20 GDPR,
   • 2.6. objection — Art. 21 GDPR,
   • 2.7. withdrawal of consent — Art. 7(3) GDPR.
3. An objection to processing based on the Controller's legitimate interest will be upheld unless the Controller demonstrates compelling legitimate grounds that override the data subject's interests, rights and freedoms, or grounds for establishing, pursuing or defending claims. An objection to direct marketing is always upheld.
4. Requests can be e-mailed to info@cannabis-institute.com. Some rights can be exercised directly in the Service:
   • exporting and deleting Diary entries, and withdrawing consent — in the Diary;
   • changing Account data and deleting the Account — in the Account settings;
   • removing a doctor-finder entry — through the "Remove listing" form.

The Controller may ask for information needed to confirm the requester's identity. Where there is reasonable doubt, it may decline the request until identity is confirmed.

1. The Controller fulfils or refuses a request without undue delay and within one month of receipt. Where the request is complex or requests are numerous, it may extend this by two further months. In that case it informs the requester of the extension and the reasons within one month of receipt.
2. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, the Controller may charge a reasonable fee or refuse to act, in accordance with the GDPR.
3. Where a request concerns data processed by a Partner Shop, payment operator or sign-in provider as an independent controller, the Controller will point the requester to the right entity.
4. A data subject who considers that processing infringes the GDPR may lodge a complaint with the supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO).

§ 8 COOKIES AND SIMILAR TECHNOLOGIES

1. The Service uses cookies and similar technologies, in particular browser local storage. They are governed by Art. 399 of the Polish Electronic Communications Law, which requires clear and comprehensible information about the purpose of storing or accessing information on the user's terminal equipment.
2. Details of the cookies used, their categories, purposes and lifetimes, and how to manage consent, are in the Cookie Policy available in the Service.
3. The Controller keeps proof of cookie consent (date, scope and version) to demonstrate compliance, under Art. 6(1)(c) and (f) GDPR.

§ 9 THIRD-PARTY TOOLS AND LINKS

1. The Service uses no social-media plug-ins or remarketing tools.
2. Article thumbnails and product pictures may be loaded directly from the servers of publishers, producers and shops, with the source credited. When such an image loads, the User's browser connects to that server, which receives the User's IP address. Those entities are responsible for their own processing.
3. The Service links to third-party websites, in particular publishers, Partner Shops, public registers and payment operators. The Controller is not responsible for their privacy policies or content.

§ 10 SECURITY AND DATA BREACHES

1. The Controller applies technical and organisational measures appropriate to the risk to the rights and freedoms of natural persons and to the categories of data, taking into account the state of the art and the cost of implementation, in accordance with Art. 32 GDPR. These include in particular:
   • encryption of data in transit;
   • permission-based access control at database level;
   • mandatory two-factor authentication for administrators and Experts;
   • encryption of Partner Shops' access keys;
   • backups;
   • event logging;
   • confidentiality obligations for authorised persons;
   • incident-response procedures.
2. In the event of a personal data breach, the Controller performs its GDPR obligations. It notifies the supervisory authority where required, and notifies data subjects where the breach is likely to result in a high risk to their rights and freedoms.
3. The User is responsible for properly securing their own login data and the devices they use, including devices on which they keep the Diary in local mode. The Controller is not liable for:
   • the consequences of login data being disclosed to unauthorised persons for reasons on the User's side;
   • force majeure;
   • acts of third parties that the Controller could not prevent despite due diligence.

These exclusions do not apply to liability that cannot be excluded or limited under mandatory law.

§ 11 FINAL PROVISIONS

1. Matters not covered by this Policy are governed by the GDPR and other applicable Polish law.
2. The Controller updates the Policy in response to legal or technical changes or the development of its business. Notice of a change is posted in the Service at least 7 days before it takes effect, or sent electronically to Users with an Account. Changes required by mandatory law may take effect sooner. Earlier versions are available on request.
3. The Policy applies from the date of its publication in the Service.
4. Questions about personal data protection can be sent to info@cannabis-institute.com or in writing to the Controller's registered office given in § 1(1).