I removed the Who We Are section, updated the numbering, used Canna Shops as the company name, added [email protected], and removed all telephone number and address fields.

Privacy Policy

1. Introduction

Canna Shops respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you:

  • Visit https://cannashops.co.uk
  • Create or manage a customer account
  • Place or attempt to place an order
  • Contact our customer support team
  • Subscribe to our marketing communications
  • Participate in promotions, surveys, or loyalty programmes
  • Interact with us through social media or other communication channels

This policy also explains your rights under UK data protection law and how you can exercise those rights.

For the purposes of this Privacy Policy, “Canna Shops”, “we”, “us”, and “our” refer to Canna Shops.

Website: https://cannashops.co.uk
Email: [email protected]

2. Laws That Apply to Us

We process personal information in accordance with applicable UK privacy and electronic communications laws, including:

  • The UK General Data Protection Regulation
  • The Data Protection Act 2018
  • The Privacy and Electronic Communications Regulations 2003
  • The Data (Use and Access) Act 2025
  • Other applicable UK laws, regulations, and regulatory guidance

3. Information We Collect

The information we collect depends on how you interact with our website and services.

3.1 Identity Information

This may include:

  • Full name
  • Date of birth
  • Age confirmation
  • Username or account identifier
  • Copies or details of identification documents, where legally required
  • Results of age or identity verification checks

We may use third-party verification providers to confirm that customers meet applicable age and legal eligibility requirements.

3.2 Contact Information

This may include:

  • Billing address
  • Delivery address
  • Email address
  • Telephone number provided for order or delivery purposes
  • Communication preferences

3.3 Account Information

This may include:

  • Login details
  • Encrypted password
  • Account preferences
  • Saved addresses
  • Wishlist information
  • Order history
  • Loyalty or reward information

You are responsible for keeping your login details confidential.

3.4 Order and Transaction Information

This may include:

  • Products ordered
  • Order value
  • Order date and time
  • Billing and delivery information
  • Payment status
  • Refund and return information
  • Discount codes used
  • Delivery tracking information
  • Communications concerning an order

3.5 Payment Information

Payments may be processed by independent payment service providers.

Depending on the payment method used, we may receive:

  • Payment confirmation
  • Transaction reference
  • Payment method type
  • Billing name and address
  • Limited card information, such as the card type and final digits
  • Fraud prevention results

We do not normally receive or store complete payment card numbers or security codes when payments are processed directly by an authorised payment provider.

Each payment provider processes personal information in accordance with its own privacy notice.

3.6 Technical Information

When you use our website, we may automatically collect:

  • Internet Protocol address
  • Browser type and version
  • Device type
  • Operating system
  • Screen resolution
  • Time zone
  • Language settings
  • Website navigation information
  • Pages viewed
  • Links clicked
  • Login records
  • Referral source
  • Session duration
  • Cookie identifiers
  • Approximate location based on an IP address
  • Error logs and security records

3.7 Communication Information

We may retain information you provide when you contact us, including:

  • Contact form submissions
  • Emails
  • Live chat messages
  • Customer service notes
  • Complaints
  • Reviews and feedback
  • Social media communications
  • Customer service history

Please do not send unnecessary medical information, full payment card details, account passwords, or other highly sensitive information through our contact form.

3.8 Marketing Information

This may include:

  • Whether you have subscribed to marketing
  • Your email or SMS preferences
  • Records of consent
  • Marketing messages opened or clicked
  • Products or categories in which you have shown an interest
  • Records of unsubscribing or objecting to marketing

3.9 Fraud Prevention and Compliance Information

Where appropriate and lawful, we may process information relating to:

  • Suspected fraudulent transactions
  • Chargebacks
  • Account misuse
  • Security incidents
  • Delivery disputes
  • Compliance checks
  • Age or identity verification
  • Requests from regulators, courts, or law enforcement authorities

3.10 Information You Choose to Provide

You may provide additional information when contacting us, leaving a review, completing a survey, or participating in a promotion.

Please provide only information that is relevant and necessary.

4. Information We Do Not Intentionally Request

We do not ask customers to provide health or medical information as part of an ordinary retail transaction.

Information about health, medical conditions, prescriptions, ethnicity, religion, sexual orientation, political opinions, or biometric identifiers may be considered special category information under UK data protection law.

Please do not send this information unless we have specifically requested it for a lawful and clearly explained purpose.

Where we intentionally process special category information, we will identify both an appropriate lawful basis and an additional legal condition for processing it.

5. How We Collect Information

We collect information in the following ways.

5.1 Directly From You

This includes information supplied when you:

  • Create an account
  • Complete checkout
  • Contact us
  • Subscribe to marketing
  • Submit a review
  • Request a return or refund
  • Enter a promotion
  • Complete an age or identity check

5.2 Automatically

We may collect technical and usage information through:

  • Cookies
  • Pixels
  • Website logs
  • Analytics tools
  • Security systems
  • Similar storage and access technologies

Non-essential technologies are used only where the required consent has been obtained.

5.3 From Third Parties

We may receive information from:

  • Payment providers
  • Delivery and fulfilment providers
  • Age and identity verification services
  • Fraud prevention services
  • Website hosting providers
  • Analytics providers
  • Marketing platforms
  • Customer service platforms
  • Publicly available sources
  • Regulators and law enforcement authorities

6. How We Use Your Information and Our Lawful Bases

UK data protection law requires us to have a valid lawful basis for each use of personal information.

6.1 To Create and Manage Your Account

We use account and contact information to:

  • Register your account
  • Authenticate your login
  • Maintain account settings
  • Display your order history
  • Provide account-related support

Lawful basis: Performance of a contract and our legitimate interests in administering our services securely.

6.2 To Process and Deliver Orders

We use identity, contact, transaction, and delivery information to:

  • Process orders
  • Take or confirm payment
  • Arrange fulfilment
  • Provide delivery updates
  • Manage returns and refunds
  • Contact you about an order

Lawful basis: Performance of a contract.

Some information may also be processed to comply with tax, accounting, consumer protection, and other legal obligations.

6.3 To Verify Age or Identity

We may use identity information to:

  • Confirm that you meet applicable age restrictions
  • Prevent access by underage users
  • Meet legal, licensing, payment, or risk-management requirements
  • Reduce fraud and misuse

Lawful basis: Legal obligation, performance of a contract, recognised legitimate interests where applicable, and our legitimate interests in operating a lawful and responsible service.

Where a verification provider acts as an independent controller, its own privacy notice will also apply.

6.4 To Provide Customer Support

We use contact, order, account, and communication information to:

  • Answer enquiries
  • Resolve complaints
  • Assist with delivery issues
  • Process returns and refunds
  • Maintain customer service records

Lawful basis: Performance of a contract and our legitimate interests in providing effective customer service and resolving disputes.

6.5 To Prevent Fraud and Protect Our Website

We may use identity, payment, transaction, device, and technical information to:

  • Detect fraudulent transactions
  • Protect customer accounts
  • Prevent unauthorised access
  • Investigate suspicious behaviour
  • Enforce our terms
  • Defend legal claims
  • Protect our business and customers

Lawful basis: Legal obligation, recognised legitimate interests where applicable, and our legitimate interests in preventing fraud, securing our services, and protecting legal rights.

6.6 To Comply With the Law

We may use or disclose information where necessary to:

  • Keep accounting and tax records
  • Respond to lawful requests
  • Meet regulatory requirements
  • Comply with court orders
  • Assist law enforcement authorities
  • Establish, exercise, or defend legal claims

Lawful basis: Legal obligation and legitimate interests in protecting our legal rights.

6.7 To Improve Our Website and Services

We may analyse technical and usage information to:

  • Understand how the website is used
  • Diagnose technical problems
  • Improve navigation and performance
  • Measure service effectiveness
  • Develop new features
  • Maintain website security

Lawful basis: Consent where non-essential cookies or similar technologies are used. Legitimate interests may apply to strictly necessary security, diagnostics, and service administration that do not require consent under applicable law.

6.8 To Send Marketing Communications

Where permitted, we may use your contact and marketing information to send:

  • Product updates
  • Promotions
  • Discount offers
  • Newsletters
  • Stock notifications
  • Loyalty communications

Lawful basis: Consent or the limited existing-customer marketing exception permitted by applicable electronic marketing law, where all legal conditions are met.

You can unsubscribe at any time by:

  • Clicking the unsubscribe link in an email
  • Using the instructions contained in an SMS
  • Changing your account preferences
  • Contacting us at [email protected]

You have an absolute right to object to the use of your personal information for direct marketing.

6.9 To Request Reviews or Feedback

We may contact customers to request feedback about an order or service.

Lawful basis: Our legitimate interests in understanding customer satisfaction and improving our services, subject to applicable direct marketing rules.

7. Where We Rely on Legitimate Interests

Where we rely on legitimate interests, we consider:

  • Whether the processing has a clear and genuine purpose
  • Whether the processing is necessary
  • Whether the same purpose could be achieved in a less intrusive way
  • The likely impact on your privacy
  • Your reasonable expectations
  • The safeguards available to protect your rights

You may contact us for more information about a legitimate interests assessment relevant to your information.

8. When Providing Information Is Required

Certain information is required to create an account, verify eligibility, process payment, complete an order, or meet legal obligations.

Where required information is not provided, we may be unable to:

  • Create or maintain an account
  • Verify your age or identity
  • Accept or fulfil an order
  • Process a refund
  • Provide particular services

Optional fields will be identified where appropriate.

9. Who We Share Information With

We do not sell your personal information.

We may share information with carefully selected recipients where necessary for the purposes described in this policy.

9.1 Service Providers

These may include providers of:

  • Website hosting
  • Cloud storage
  • Ecommerce software
  • Payment processing
  • Order fulfilment
  • Delivery and courier services
  • Age or identity verification
  • Fraud prevention
  • Customer support
  • Email delivery
  • SMS delivery
  • Analytics
  • Cookie consent management
  • Cybersecurity
  • Accounting
  • Professional advice

Service providers acting on our behalf are permitted to use personal information only for agreed purposes and must protect it appropriately.

9.2 Payment Providers

Payment providers receive the information necessary to authorise, process, verify, or refund payments.

They may conduct their own fraud, sanctions, identity, and compliance checks.

9.3 Delivery and Fulfilment Partners

We may share your name, delivery address, contact details, order reference, and delivery instructions with fulfilment providers and couriers.

We share only the information reasonably required to complete and manage delivery.

9.4 Professional Advisers

We may share information with:

  • Lawyers
  • Accountants
  • Auditors
  • Insurers
  • Compliance consultants
  • Tax advisers

This may occur where necessary to obtain professional advice, maintain records, or establish and defend legal claims.

9.5 Regulators and Authorities

We may disclose information to:

  • The Information Commissioner’s Office
  • HM Revenue and Customs
  • Courts and tribunals
  • Police and law enforcement authorities
  • Trading standards authorities
  • Licensing or regulatory bodies
  • Other public authorities

Disclosure will occur only where required or permitted by law.

9.6 Business Transfers

Information may be shared as part of a genuine:

  • Merger
  • Acquisition
  • Restructuring
  • Investment
  • Sale of assets
  • Insolvency process

Recipients will be required to protect the information and use it only for lawful purposes.

10. International Transfers

Some service providers may process personal information outside the United Kingdom.

Where a restricted international transfer takes place, we will use an approved legal transfer mechanism where required, such as:

  • UK adequacy regulations
  • The UK International Data Transfer Agreement
  • The UK Addendum to approved standard contractual clauses
  • Another safeguard permitted under UK data protection law
  • A lawful exception that applies in limited circumstances

Where required, we will also assess the laws and practices of the destination country and apply supplementary safeguards.

You may contact us for further information about the transfer mechanism used for your personal information.

11. Cookies and Similar Technologies

Our website may use cookies and similar technologies, including pixels, scripts, local storage, tags, and device identifiers.

These technologies may be used to:

  • Keep the website functioning
  • Maintain your shopping basket
  • Remember account sessions
  • Store privacy choices
  • Protect the website from fraud
  • Analyse website performance
  • Personalise content
  • Measure marketing effectiveness

11.1 Strictly Necessary Cookies

These cookies are required for functions such as:

  • Secure login
  • Shopping basket operation
  • Checkout
  • Fraud prevention
  • Network security
  • Cookie preference storage

Consent is not normally required where a technology is strictly necessary to provide a service requested by you.

11.2 Analytics, Preference, and Advertising Cookies

We will request your consent before placing non-essential cookies or activating equivalent technologies where consent is legally required.

Rejecting optional cookies must be as easy as accepting them.

You can change your choices through the Cookie Settings control on our website.

Further details may be provided in a separate Cookie Policy, including:

  • Cookie names
  • Providers
  • Purposes
  • Expiration periods
  • Whether information is transferred outside the UK

Browser settings may also allow you to remove or block cookies. Blocking necessary cookies may affect website functionality.

12. Social Media and External Links

Our website may contain links to social media platforms, payment providers, delivery providers, or other third-party websites.

These organisations may collect information independently and operate under their own privacy policies.

We are not responsible for the privacy practices, content, or security of independent third-party websites.

13. Automated Decision-Making

Fraud prevention, payment, identity verification, or security providers may use automated systems to assess transactions or account activity.

These systems may consider factors such as:

  • Transaction patterns
  • Device information
  • Payment results
  • Location inconsistencies
  • Previous fraudulent activity
  • Identity verification results

Where a decision based solely on automated processing produces a legal or similarly significant effect, we will provide the protections required by law.

These may include the ability to request human review, provide your point of view, and challenge the decision.

Contact us if you believe an automated decision has affected you unfairly.

14. How Long We Keep Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, fraud prevention, and dispute-resolution requirements.

Our expected retention periods include:

  • Customer account information: For as long as the account remains active and for a reasonable period after closure
  • Orders, invoices, and transaction records: Normally six years after the end of the relevant financial year or contractual relationship
  • Payment confirmation records: For as long as necessary to meet financial and payment-processing requirements
  • Customer service communications: For a reasonable period after the enquiry is resolved
  • Age and identity verification results: For as long as required by law or necessary to demonstrate that a check occurred
  • Identification document copies: Deleted promptly after verification unless continued retention is legally required and justified
  • Marketing consent records: For as long as marketing continues and for an appropriate period afterwards to demonstrate compliance
  • Marketing suppression records: Retained where necessary to ensure we respect an unsubscribe or objection
  • Fraud and security records: For a period appropriate to the nature and seriousness of the incident
  • Cookie consent records: For as long as necessary to demonstrate and manage consent
  • Website security logs: For a reasonable period necessary to maintain security and investigate incidents

We may retain information for longer where:

  • A complaint or dispute is ongoing
  • Legal proceedings are anticipated or active
  • A regulator or authority requires retention
  • Fraud or security concerns exist
  • A legal preservation obligation applies

Information that is no longer required will be deleted, anonymised, or securely destroyed.

15. How We Protect Information

We use appropriate technical and organisational measures designed to protect personal information against:

  • Unauthorised access
  • Accidental loss
  • Destruction
  • Alteration
  • Misuse
  • Unlawful disclosure

Measures may include:

  • Encryption in transit
  • Access controls
  • Strong authentication
  • Password hashing
  • System monitoring
  • Security updates
  • Restricted administrative access
  • Staff confidentiality obligations
  • Secure backups
  • Incident-response procedures
  • Service-provider reviews

No internet transmission or storage system can be guaranteed to be completely secure.

You should use a unique password and contact us immediately if you suspect unauthorised access to your account.

16. Personal Data Breaches

We maintain procedures for identifying, assessing, and responding to personal data breaches.

Where legally required, we will notify the Information Commissioner’s Office and affected individuals within the applicable time limits.

17. Your Data Protection Rights

Depending on the circumstances, you may have the following rights.

17.1 The Right to Be Informed

You have the right to receive clear information about how your personal information is used.

17.2 The Right of Access

You may request confirmation that we process your information and obtain a copy of it.

17.3 The Right to Rectification

You may ask us to correct inaccurate information or complete incomplete information.

17.4 The Right to Erasure

You may ask us to delete your personal information in circumstances where the right to erasure applies.

This right is not absolute. We may retain information where continued processing is required by law or justified under an applicable exemption.

17.5 The Right to Restrict Processing

You may ask us to restrict the use of your information in certain circumstances.

17.6 The Right to Object

You may object to processing based on legitimate interests or certain other lawful bases.

Your right to object to direct marketing is absolute.

17.7 The Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you may request eligible information in a structured, commonly used, machine-readable format.

17.8 The Right to Withdraw Consent

Where we rely on consent, you may withdraw it at any time.

Withdrawal will not affect processing that took place before consent was withdrawn.

17.9 Rights Relating to Automated Decisions

Where applicable, you may request human intervention and challenge a decision made solely through automated processing that significantly affects you.

17.10 The Right to Complain

You may complain to the Information Commissioner’s Office if you believe your information has been processed unlawfully.

18. How to Exercise Your Rights

To exercise a data protection right, contact us at:

Email: [email protected]

Please describe:

  • The right you wish to exercise
  • The information or activity concerned
  • Any relevant account, order, or contact details

We may request reasonable information to verify your identity before acting on a request. This helps prevent unauthorised disclosure.

We normally respond without undue delay and within one month after receiving a valid request.

A longer period may be permitted for complex or multiple requests. We will explain any extension where required.

We do not usually charge a fee. A reasonable fee may be charged, or a request may be refused, where permitted by law and where the request is manifestly unfounded or excessive.

19. Marketing Preferences

You may stop direct marketing by:

  • Clicking “unsubscribe” in an email
  • Following the opt-out instructions in an SMS
  • Updating your account settings
  • Contacting us at [email protected]

Stopping marketing will not prevent us from sending essential service communications, such as:

  • Order confirmations
  • Payment notices
  • Delivery updates
  • Account security alerts
  • Changes to contractual terms
  • Responses to customer service enquiries

20. Children and Age-Restricted Services

Our products and services are intended only for persons who meet the minimum legal age applicable to the product or service concerned.

We do not knowingly offer age-restricted products to children or intentionally collect children’s personal information for that purpose.

Age-gating alone may not be sufficient for every regulated activity. We may use additional age or identity verification measures where required.

Contact us immediately if you believe a child has provided personal information improperly. We will investigate and take appropriate action.

21. Complaints

Please contact us first if you have a concern about how we use your personal information.

Email: [email protected]

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Telephone: 0303 123 1113
Website: ico.org.uk

You may complain to the Information Commissioner’s Office without contacting us first, although we welcome the opportunity to address your concern directly.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

  • Changes to our services
  • Changes to our providers
  • New legal requirements
  • Regulatory guidance
  • Changes to our data-processing activities

The latest version will be published on this page with a revised “Last updated” date.

Where a change materially affects how we use your personal information, we will provide an additional notice where appropriate.

23. Contact Us

Questions about this Privacy Policy or our handling of personal information should be sent to:

Canna Shops
Email: [email protected]
Website: https://cannashops.co.uk