privacy policy

As of: September 22, 2026

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website.

Personal data means any data that can be used to identify you personally.

For detailed information on privacy, please refer to the following privacy notice.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator.

You can find the contact details of the data controller in the "Notice of the Data Controller" section of this privacy notice.

How do we collect your data?

Your data is collected, on the one hand, when you provide it to us.

This may include, for example, data you enter into a contact form, provide when placing an order, submit when setting up a customer account, or send to us by email.

Other data is collected automatically or with your consent when you visit the website by our IT systems or the service providers we use.

This includes technical data such as your internet browser, operating system, device type, IP address, or the time of your visit to the website.

What do we use your data for?

Some data is collected to ensure that the website and our online shop are provided without technical errors.

Other data is used to process and fulfill orders, communicate with you, manage customer accounts, or—with your consent—statistically analyze usage of our website.

To the extent that contracts are concluded or initiated via the website, we also process the submitted data to fulfill the contract or carry out pre-contractual measures.

What rights do you have regarding your data?

Subject to legal requirements, you have the right at any time to receive free information about the origin, recipients, and purpose of your stored personal data.

You also have the right to have this data corrected or deleted.

If you have given your consent to data processing, you can withdraw this consent at any time with future effect.

In addition, under certain conditions, you have the right to request that the processing of your personal data be restricted.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

You can contact us at any time regarding this or any other questions about privacy.

Analytics Tools and Third Parties

When you visit this website, your usage behavior may be statistically analyzed with your consent.

For this purpose, we use Matomo Analytics in particular.

You can find more information about this in the relevant sections of this privacy notice.

2. Hosting, Shop Platform, and Technical Infrastructure

Shopify

We use the Shopify e-commerce platform to operate our online shop.

The provider for merchants based in the European Economic Area is generally:

Shopify International Limited
2nd Floor
1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides us with the technical infrastructure required to operate our online shop. This includes, in particular, the provision of the shop interface, cart and checkout functions, customer accounts, order management, and other technical functions of the online shop.

When using Shopify, the following data may be processed in particular:

IP address,
device and browser information,
pages visited and technical access data,
customer and contact data,
shipping and billing addresses,
order and contract data,
payment information or information about the selected payment method,
customer account and login information,
communications related to orders,
cookie and consent information.

To the extent that processing is necessary to provide the online shop and to fulfill a contract or carry out pre-contractual measures, it is carried out on the basis of Art. 6(1)(b) GDPR.

To the extent that processing is necessary to provide our online shop in a secure, stable, and economical manner, it is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is in the reliable and secure operation of our online offering.

To the extent that consent is required, processing is carried out on the basis of Art. 6(1)(a) GDPR and, if applicable, § 25(1) TDDDG.

For customers from the European Economic Area, personal data is initially processed by Shopify International Limited in Ireland.

Shopify uses affiliated companies and sub-processors to provide its services. In doing so, personal data may also be processed outside the European Economic Area.

As part of its contractual privacy terms and Data Processing Addendum, Shopify undertakes to comply with applicable data protection requirements and uses the necessary data protection mechanisms for international data transfers.

We have concluded the necessary data protection agreements with Shopify for the processing of personal data or use Shopify on the basis of the Data Processing Addendum provided by Shopify.

You can find more information about Shopify's processing of personal data in Shopify's privacy notice.

DomainFactory

We use the following for the registration and technical management of our domain and related technical domain services:

DomainFactory GmbH
c/o WeWork
Neuturmstraße 5
80331 Munich
Germany

DomainFactory is therefore not the actual e-commerce or shop platform of our online shop. The online shop itself is operated via Shopify.

Technical data may be processed as part of domain management to the extent necessary to provide and manage the domain and its related services.

Processing is carried out on the basis of Art. 6(1)(f) GDPR.

Our legitimate interest is in the reliable and secure provision of our domain and the associated technical infrastructure.

To the extent that DomainFactory processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

3. General Information and Mandatory Disclosures

Privacy

We take the protection of your personal data very seriously.

We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy notice.

When you use this website, various personal data are processed.

This privacy notice explains what data we process, for what purposes, and on what legal basis.

We point out that data transmission over the internet, for example when communicating by email, may have security vulnerabilities.

It is technically impossible to provide complete protection against unauthorized access by third parties.

Notice of the Data Controller

The data controller for data processing on this website is:

cannaseuse®
Owner: Thomas Goldyn
Fidicinstraße 6A
10965 Berlin
Germany

Telephone: +49 (0) 30 45099753
Email: info[at]cannaseuse.de

The data controller is the natural or legal person who alone or jointly with others decides the purposes and means of processing personal data.

Retention Period

Unless a more specific retention period is stated in this privacy notice, we only store personal data for as long as is necessary for the respective processing purpose.

If you assert a legitimate request for deletion or withdraw consent, the data concerned will be deleted unless there are other legally permissible reasons for continued storage.

This may include statutory commercial or tax retention requirements.

In such cases, deletion will take place after the respective statutory retention periods have expired.

General Information on the Legal Bases for Data Processing

If you have consented to the processing of personal data, processing is carried out on the basis of Art. 6(1)(a) GDPR.

If special categories of personal data within the meaning of Art. 9(1) GDPR are processed, processing may be carried out on the basis of explicit consent pursuant to Art. 9(2)(a) GDPR.

To the extent that consent is required to store information on your device or to access already stored information, this is also carried out on the basis of § 25(1) TDDDG.

If processing is necessary to fulfill a contract or carry out pre-contractual measures, it is carried out on the basis of Art. 6(1)(b) GDPR.

To the extent that we must process data due to legal obligations, processing is carried out on the basis of Art. 6(1)(c) GDPR.

In addition, processing may be carried out on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR.

We inform you about the respective legal bases in the relevant sections of this privacy notice.

Recipients of Personal Data

As part of our business activities, we work with various external service providers and companies.

This may require the transmission of personal data to external parties.

Personal data is passed on, in particular, when this is necessary to fulfill a contract, a legal obligation exists, consent has been given, or another legal basis permits the transmission of data.

When using data processors, personal data is processed on the basis of statutory requirements and corresponding data processing agreements.

Withdrawal of Your Consent

Many data processing activities are only permissible with your consent.

You can withdraw previously given consent at any time with future effect.

The lawfulness of processing carried out up to the time of withdrawal remains unaffected.

Right to Object Pursuant to Art. 21 GDPR

IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6(1)(e) OR (f) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS.

IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPULSORY PROTECTIVE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING IS NECESSARY FOR THE INSTITUTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING FOR SUCH MARKETING PURPOSES.

THIS ALSO APPLIES TO PROFILING, TO THE EXTENT IT IS LINKED TO SUCH DIRECT MARKETING.

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of a violation of the GDPR, data subjects have the right to lodge a complaint with a data protection supervisory authority.

This applies in particular to the supervisory authority of the Member State where the data subject has their habitual residence, place of work, or where the alleged violation occurred.

The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.

Right to Data Portability

You have the right to receive personal data that we process automatically on the basis of your consent or to fulfill a contract in a commonly used, machine-readable format or—where technically possible—to have it transmitted to another data controller.

Information, Correction, and Deletion

Subject to applicable legal provisions, you have the right to receive information about the personal data stored about you.

In addition, you may have the right to have inaccurate data corrected and personal data deleted.

You can contact us at any time regarding this or any other questions about privacy.

Right to Restriction of Processing

Subject to legal requirements, you have the right to request that the processing of your personal data be restricted.

This applies in particular:

if you contest the accuracy of the personal data we have stored and we need time to verify it,
if processing is unlawful and you request restriction of processing instead of deletion,
if we no longer need the personal data, but you need it to establish, exercise, or defend legal claims,
if you have objected pursuant to Art. 21(1) GDPR and it has not yet been established whose interests prevail.

SSL or TLS Encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content.

You can generally recognize an encrypted connection by the fact that your browser's address bar begins with "https" and a lock symbol is displayed.

When SSL or TLS encryption is enabled, data transmitted to us cannot be easily read by third parties.

Encrypted Payment Transactions

For paid orders, payment information is processed to the extent necessary to process the payment.

Payment information is transmitted via encrypted connections.

Depending on the selected payment method, personal data may also be processed by the respective payment service provider.

Objection to Promotional Emails

We object to the use of contact details published as part of statutory information requirements to send unsolicited advertising and promotional materials.

We reserve the right to take legal action in the event of unsolicited promotional information, such as spam emails.

4. Data Collection on This Website

Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Cookies are small data files that can be stored on your device.

Some cookies are stored only for the duration of a session and are deleted after your visit ends. Other cookies may remain on your device for a longer period.

Cookies may come from us or from embedded third-party providers.

Technically necessary cookies are used in particular to provide basic functions of the online shop, for example:

cart functions,
checkout functions,
login and customer account functions,
security and fraud prevention,
storage of privacy and consent settings.

To the extent that cookies or similar technologies are technically necessary, they are used subject to legal requirements.

Non-essential cookies and similar technologies, in particular for analytics or marketing purposes, are used only if the necessary consent has been given.

To the extent that consent is required, processing is carried out on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG.

You can change or withdraw your given consents at any time with future effect via the cookie or privacy settings on our website.

Cookie Consent and Privacy Settings via Shopify

We use the privacy features provided by Shopify to manage cookie consents and privacy settings.

Through the cookie banner displayed on our website, visitors can make settings in particular regarding non-essential technologies and data processing.

Shopify stores information about the privacy and consent decision made so that the respective settings can be technically taken into account.

Processing of consent information is carried out on the basis of Art. 6(1)(c) GDPR to fulfill our statutory privacy obligations.

Where information is stored on or accessed from the end device, the requirements of Section 25 TDDDG also apply.

You can change your settings at any time using the cookie and privacy settings provided on our website.

The Shopify cookie banner controls Shopify-specific cookies and Shopify pixels in particular. For any additional third-party services used, we ensure through our technical configuration that the consent requirements applicable to the respective service are taken into account.

Matomo Analytics

We use the Matomo Analytics web analytics service on this website to statistically evaluate the use of our online offer and to improve our offer technically and in terms of content.

The provider of our Matomo cloud solution is:

InnoCraft Limited
7 Waterloo Quay
PO Box 625
6140 Wellington
New Zealand

Matomo enables us, in particular, to evaluate how our website is used.

The following information may be processed, among other things:

pages and URLs visited,
time of page visits,
duration of stay,
entry and exit pages,
source page or referrer,
browser type,
operating system,
device type,
screen resolution,
language settings,
technical access information,
IP address or information derived therefrom,
actions and events within our website,
if applicable, information about cart and e-commerce events.

The data is used to create statistical reports on the use of our website and to optimize our offer.

To the extent that Matomo uses cookies or comparable technologies or stores or accesses information on the user's end device, this is done on the basis of your consent pursuant to Section 25 (1) TDDDG.

The processing of personal data for analysis purposes is carried out on the basis of your consent pursuant to Art. 6 (1) (a) GDPR.

You can change or revoke your consent at any time with future effect via the cookie or privacy settings on our website.

The lawfulness of the processing carried out up to the revocation remains unaffected.

Storage of Matomo Data

The data from our Matomo cloud instance is stored within Europe.

The production systems are operated in Frankfurt am Main, Germany.

Backups are stored in Dublin, Ireland.

According to the provider, Matomo Cloud uses European infrastructure from Amazon Web Services EMEA SARL for this purpose.

Provider in New Zealand

InnoCraft Limited is headquartered in New Zealand.

For New Zealand, there is an adequacy decision by the European Commission, so that for transfers of personal data to New Zealand, there is an adequate level of data protection recognized by the European Commission.

Data Processing Agreement

InnoCraft processes the data stored in our Matomo cloud instance as a data processor.

The processing is carried out on the basis of the Matomo Cloud Data Processing Agreement pursuant to Art. 28 GDPR.

The data is processed according to our instructions and in accordance with the Matomo configuration we have made.

Retention Period

The retention period of the analysis data collected with Matomo is based on the retention period we have configured in Matomo.

Data is deleted or anonymized as soon as it is no longer required for the stated analysis purposes and there are no legal reasons for further storage.

Further information on the processing of personal data by Matomo or InnoCraft can be found in the privacy notice and the Data Processing Agreement of Matomo.

Technical Integration of Matomo via Matomo Connect

To technically integrate Matomo into our Shopify store, we use the Shopify app "Matomo Connect".

The app is provided by the provider Auremist.

According to the Shopify App Store, the app may receive access to device and activity data to provide its features. This may include, in particular, the following information:

IP address,
browser,
operating system,
browsing behavior,
client ID or corresponding technical identifiers.

In addition, the app receives the access rights necessary for its integration within our Shopify store.

The technical integration serves to provide the Matomo web analytics we use.

To the extent that personal data is processed for analysis purposes in this context, this is done on the basis of your consent pursuant to Art. 6 (1) (a) GDPR as well as – where required – Section 25 (1) TDDDG.

Inquiry via Email or Telephone

If you contact us by email or telephone, we process your inquiry including the personal data arising therefrom for the purpose of handling your request.

We only pass on this data if there is a legal basis for doing so.

If your inquiry is related to a contract or pre-contractual measures, the processing is carried out on the basis of Art. 6 (1) (b) GDPR.

In other cases, the processing is carried out on the basis of our legitimate interest in efficiently handling your inquiry pursuant to Art. 6 (1) (f) GDPR or on the basis of your consent pursuant to Art. 6 (1) (a) GDPR, provided that this has been obtained.

The submitted data will be stored until the processing purpose no longer exists, you request deletion on legitimate grounds, or you revoke your consent.

Legal retention obligations remain unaffected.

Customer Account and Registration

You can set up a customer account on our website, provided this function is offered.

The data provided during registration is used to provide the customer account and enable the associated functions.

The processing is carried out on the basis of Art. 6 (1) (b) GDPR, insofar as it is necessary for the performance of a contract, the preparation of orders, or the management of the customer account.

The data stored in the customer account is generally processed as long as the customer account exists.

Legal retention obligations for order and contract data remain unaffected.

5. Newsletter

Newsletter Data

If you wish to subscribe to our newsletter, we process, in particular, your email address and, if applicable, other voluntarily submitted data.

We use this data exclusively for sending the newsletter you requested and related purposes.

The processing is carried out on the basis of your consent pursuant to Art. 6 (1) (a) GDPR.

You can revoke a given consent at any time with future effect, in particular via the unsubscribe link included in our newsletter emails.

The lawfulness of the processing carried out up to the revocation remains unaffected.

The data stored for newsletter delivery is generally stored until you unsubscribe or the processing purpose no longer exists.

After you unsubscribe, your email address may be stored in a suppression list, insofar as this is necessary to prevent further newsletter delivery and to comply with our legal obligations.

The use of such a suppression list serves exclusively this purpose.

Other data that we have stored for other legal reasons remains unaffected.

6. E-Commerce, Orders and Payment Processing

Processing of Customer and Contract Data

We collect and process personal customer and contract data insofar as this is necessary to establish, perform, substantively design, or amend our contractual relationships.

This may include, in particular:

name,
billing and delivery address,
email address,
telephone number, insofar as provided or required,
ordered items,
order value,
order number,
payment method,
shipping information,
communication in connection with the order.

The legal basis for this is Art. 6 (1) (b) GDPR.

The data collected in connection with a contract is deleted upon termination of the business relationship, as soon as legal retention periods and other legitimate reasons for storage no longer exist.

Data Transmission for Orders and Goods Shipment

When you order goods from us, we transmit personal data to the shipping company commissioned with the delivery insofar as necessary.

Only information required for the performance of the delivery is transmitted.

The legal basis is Art. 6 (1) (b) GDPR.

Insofar as the transmission of an email address or telephone number to a shipping service provider is exclusively for shipping notification or shipment tracking and consent is required for this, the processing is carried out on the basis of Art. 6 (1) (a) GDPR.

Consent can be revoked at any time with future effect.

Payment Processing

To process payments, personal data may be transmitted to the payment service provider you have selected, involved credit institutions, or technical payment processors.

The specific data processed depends on the payment method you have selected.

This may include, in particular:

name,
billing address,
order number,
order amount,
payment method,
transaction information,
if applicable, the payment data required for the payment.

The processing is generally carried out on the basis of Art. 6 (1) (b) GDPR, insofar as it is necessary for the performance of the payment you requested and thus for the fulfillment of the contract.

Payment service providers may process personal data beyond this under their own data protection responsibility, insofar as this is necessary, for example, due to legal obligations for fraud prevention, identity verification, or to comply with financial supervisory requirements.

The privacy notices of the respective payment service provider also apply to these processing activities.