Information on how we handle your data

General Notes

The following notes provide a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to personally identify you. For detailed information on data protection, please refer to our privacy policy listed below.

Data Collection on this Website

Who is responsible for data collection on this website?

The data processing on this website is carried out by the website operator. You can find their contact details in the “Responsible Body” section of this privacy policy.

How do we collect your data?

Your data are collected partly through the information you provide, for example in a contact form. Other data are recorded automatically or after your consent when you visit the website by our IT systems. These are mainly technical data (e.g. internet browser, operating system or time of page access). The collection of this data takes place automatically as soon as you open canna-me.de.

What do we use your data for?

Part of the data is collected to ensure the error-free provision of the website. Other data may be used to analyse your user behaviour.

What rights do you have regarding your data?

You have the right at any time to obtain free information about the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you may revoke this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

For this and any other questions regarding data protection, you can contact us at any time: [email protected]

Analytics Tools and Third-Party Tools

When visiting canna-me.de, your surfing behaviour may be statistically analysed, mainly by so-called analytics programmes. Detailed information on these programmes can be found in the following privacy policy.

Note on external hosting

canna-me.de is hosted by an external service provider. The personal data collected on this website are stored on the hosts servers. These may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access logs and other data generated via a website.

The use of this host is for the purpose of fulfilling the contract with our prospective and existing customers (Art. 6 (1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1)(f) GDPR). Our host will process your data only to the extent necessary to fulfil its performance obligations and will follow our instructions regarding these data. We use the following host:

HOSTINGER operations, UAB
Švitrigailos g. 34
LT-03230 Vilnius
Lithuania

Conclusion of a Data Processing Agreement

To ensure GDPR-compliant processing, Canna:Me has concluded a data processing agreement with HOSTINGER.

Official statement from HOSTINGER to Canna:Me

“We cannot easily access the majority of our customers' server systems and therefore the personal data stored there. From our perspective, there is no GDPR-derived obligation for many of our customers to conclude a data processing agreement. Nevertheless, we understand your need for legal certainty in this matter and therefore conclude a data processing agreement pursuant to Art. 28 EU-GDPR regardless of whether there is a mandatory legal obligation.”

General Notes

Data Protection

Canna:Me takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with legal data protection regulations as well as this privacy policy.

When you visit canna-me.de, various personal data are collected. Personal data is data that can be used to personally identify you. This privacy policy explains which data we collect and what we use it for, and how and for what purpose this is done.

We point out that data transmission over the Internet (e.g. via email) may have security vulnerabilities. Complete protection of data against third-party access is not possible.

Mandatory Information

Responsible Body

The body responsible for data processing on this website is:

Lorenz GmbH
Karl-Liebknecht-Straße 27
06862 Dessau-Roßlau
Germany

[email protected]

The responsible body is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, email addresses, etc.).

Storage Duration

Unless a more specific storage period is specified within this privacy policy, your personal data will remain with us until the purpose of processing ceases to exist. If you assert a legitimate deletion request or revoke consent to data processing, we will delete your data unless we have other legally permissible reasons to retain it (e.g. tax or commercial retention periods); in the latter case, deletion will occur after these reasons have ceased to exist.

Your Rights

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You can withdraw consent you have given at any time. The legality of processing carried out until withdrawal remains unaffected.

Right to object to data collection in specific cases and to direct advertising (Art. 21 GDPR).

If processing is based on Art. 6 (1)(e) or (f) GDPR, you have the right at any time to object for reasons arising from your particular situation; this also applies to profiling. The respective legal basis for processing can be found in this privacy policy. If you object, Canna:Me will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims (objection under Art. 21 (1) GDPR). If your personal data is processed for direct marketing, you have the right to object at any time to such processing, including profiling. If you object, your personal data will no longer be used for direct marketing purposes (objection under Art. 21 (2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of GDPR violations, individuals have the right to lodge a complaint with a supervisory authority, especially in their Member State of habitual residence, place of work or location of the alleged infringement. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedy.

Right to Data Portability

You have the right to receive data we process automatically based on your consent or in fulfilment of a contract in a structured, commonly used and machine-readable format. If you request direct transmission of the data to another controller, this will only be carried out where technically feasible.

Data Security, SSL/TLS Encryption

Canna:Me has implemented both technical and organisational measures to protect the personal data you provide from loss, destruction, manipulation and unauthorised access. Our employees and all persons involved in data processing are bound to comply with data protection laws and to handle personal data confidentially.

canna-me.de uses SSL/TLS encryption for security and to protect the transmission of confidential content, such as orders or requests you send us as the site operator. An encrypted connection can be recognised by the change in the browsers address line from http:// to https:// and by the lock symbol in your browser.

When SSL/TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Encrypted Payment Transactions on this Website

If you are required to provide payment data (e.g. account number for direct debit) after entering into a paid contract, this data is needed for payment processing.

Payment transactions via common methods (PayPal, Visa or MasterCard and direct debit) are carried out exclusively over an encrypted SSL/TLS connection. An encrypted connection can be recognised by the change from http:// to https:// and the lock symbol in your browser. With encrypted communication, your payment data cannot be read by third parties.

Information, Deletion and Correction

You have the right under applicable law at any time to obtain free information about your stored personal data, its origin and recipients and the purpose of processing, and, where applicable, the right to rectification or deletion of this data. For this and any further questions regarding personal data, you can contact us at any time. You also have the right to request the restriction of processing of your personal data. You can contact us at any time for this. The right to restrict processing exists in the following cases:

• If you contest the accuracy of your personal data stored with us, we usually need time to verify this. During the verification, you have the right to request restriction of processing of your personal data.
• If processing of your personal data was/is unlawful, you can request restriction of processing instead of erasure.
• If we no longer need your personal data, but you do for establishing, exercising or defending legal claims, you have the right to request restriction of processing instead of erasure.
• If you have filed an objection under Art. 21 (1) GDPR, a balance must be made between your interests and those of Canna:Me. As long as it is unclear whose interests prevail, you have the right to request restriction of processing of your personal data.

If you have restricted the processing of your personal data, such data — except for its storage — may only be processed with your consent or for establishing, exercising or defending legal claims or to protect the rights of another natural or legal person or for an important public interest of the EU or a Member State.

You also have the right to lodge a complaint with the competent supervisory authority

The competent supervisory authority for us is:

Saxon Data Protection Commissioner
Devrientstraße 5
01067 Dresden
Germany

www.saechsdsb.de

No automated individual decision-making

We do not use your personal data for automated individual decision-making within the meaning of Art. 22 (1) GDPR.

Objection to Marketing Emails

The use of contact data published in the imprint to send unsolicited advertising and informational materials is hereby objected to. Canna:Me expressly reserves the right to take legal action in the event of unsolicited promotional material such as spam emails.

Cookies

canna-me.de uses so-called “cookies”. Cookies are small text files and do not harm your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted at the end of your visit. Persistent cookies remain on your device until you delete them or your browser does so automatically.

In some cases, cookies from third-party companies may also be stored on your device when you visit canna-me.de (third-party cookies). These enable Canna:Me or you to use certain services of the third party (e.g. cookies for payment processing). Cookies have various functions; many are technically necessary because certain website features would not work without them (e.g. shopping cart or video display). Other cookies are used to analyse user behaviour or display advertising. Cookies required for electronic communication (necessary cookies), for providing certain features you request (functional cookies, e.g. shopping cart), or for optimising the website (e.g. audience measurement cookies) are stored under Art. 6 (1)(f) GDPR, unless another legal basis is specified. Canna:Me has a legitimate interest in storing cookies for technically error-free and optimised provision of its services. If consent for cookie storage has been obtained, these cookies are stored exclusively on the basis of this consent (Art. 6 (1)(a) GDPR); consent can be withdrawn at any time.

You can set your browser to inform you about cookie placement and only allow cookies on a case-by-case basis, block cookies for certain or all cases, and enable automatic deletion of cookies when closing the browser. Disabling cookies may limit functionality on canna-me.de.

Where third-party or analytics cookies are used, we will inform you separately in this privacy policy and, if necessary, obtain consent.

Enabling, Disabling and Deleting Cookies

You can use your browser to delete cookies automatically or manually. You can also set it to notify you each time a cookie is set. For more information, see your browser's instructions or help section.

Please note that canna-me.de may not function properly if all cookies are disabled. If you delete cookies in your browser, they will be placed again when you revisit our site.

Consent can be withdrawn at any time by clicking on the cookie settings, so cookies are immediately deactivated.

Contact Details

For questions and/or comments about our cookie policy and usage, please contact us using the following contact details:

Lorenz GmbH
Karl-Liebknecht-Straße 27
06862 Dessau-Roßlau
Germany

[email protected]

Server Log Files

Our host — HOSTINGER — automatically collects and stores information in so-called server log files, which your browser automatically transmits. These include:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

A merger of these data with other data sources does not take place.

The collection of this data is based on Art. 6 (1)(f) GDPR. Canna:Me has a legitimate interest in the technically error-free presentation and optimisation of canna-me.de — for this purpose, the server log files must be recorded.

Inquiries via Email, Telephone and Fax

When you contact us by email, telephone or fax, your inquiry including all resulting personal data (name and content of the inquiry) is stored and processed by our host — HOSTINGER — for the purpose of handling your request. We do not pass on this data without your consent.

The processing of this data is based on Art. 6 (1)(b) GDPR if your inquiry is related to contract performance or necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively handling inquiries addressed to us (Art. 6 (1)(f) GDPR) or on your consent (Art. 6 (1)(a) GDPR) if this has been obtained.

The data you send us via contact inquiries will remain with us until you request deletion, revoke consent for storage or the purpose of storage ceases (e.g. after your inquiry has been completed). Mandatory statutory provisions — in particular retention periods under tax or commercial law — remain unaffected.

Matomo

Use of the Matomo Analytics Service

canna-me.de uses features of the Matomo web analytics service:

InnoCraft Ltd.
150 Willis St
6011 Wellington
New Zealand

www.matomo.org

This enables Canna:Me to analyse the behaviour of website visitors.

The use of this analytics tool is based on your consent to cookie storage and on Art. 6 (1)(a) GDPR; consent can be withdrawn at any time.

These are stored on your computer and enable us to analyse your visit to canna-me.de.

The cookies contain usage information and are transmitted to the servers of Canna:Me or HOSTINGER, where they are stored for usage analysis purposes and help us optimise canna-me.de. The usage information also includes your IP address, but this is truncated so that it remains anonymous.

We do not share the information generated by the cookie with third parties. Details of Matomos data protection can be found here: {1}.

Right of Withdrawal

You have the right to withdraw consent. You can change your cookie settings at any time and withdraw your consent to the use of Matomo without giving a reason.

CloudFlare

This website uses CloudFlares services. The provider is:

{0}

CloudFlare provides a globally distributed content delivery network with DNS. Technically, the transfer of information between your browser and {2} is routed through CloudFlares network. CloudFlare can analyse traffic between user and canna-me.de to detect and mitigate attacks. This serves to protect our service in the context of a balancing of interests and to defend against harmful cyberattacks. This constitutes a legitimate interest under Art. 6 (1)(f) GDPR.

We have concluded a GDPR-compliant data processing agreement with CloudFlare. CloudFlare is a certified participant in the EU-US Privacy Shield Framework. CloudFlare commits to handle any personal data from EU Member States in accordance with the Privacy Shield principles. For more information, please consult the U.S. Privacy Shield list of the U.S. Department of Commerce at www.privacyshield.gov. CloudFlare collects statistical data about visits to canna-me.de. Access data includes: page name, file name, date and time of access, amount of data transferred, success message, browser type and version, users operating system, referrer URL, IP address and provider. CloudFlare uses log data for statistical analyses for operation, security and optimisation.

Processing of Data (Customer and Contract Data)

Transmission of data upon contract conclusion for the use of our services and apps.

Canna:Me transmits personal data to third parties only if this is necessary for contract execution, e.g. to companies involved in service delivery or the financial institution handling payment processing. Further transfer of data only occurs if you have expressly consented.

Personal data will not be passed on to third parties for advertising purposes without your express consent.

The legal basis for data processing is Art. 6 (1)(b) GDPR, which permits processing for the fulfilment of a contract or pre-contractual measures.