Privacy Policy

Data controller

The controller responsible for your personal data is the operator of the Website.

Kratas Pro s.r.o., operating the Cannalogistics website.
Registered office: Petržílkova 2583/15, Stodůlky, 158 00 Praha 5, Czech Republic.
Company ID (IČO): 23695340. VAT ID (DIČ): CZ23695340.
Legal form: Limited liability company (společnost s ručením omezeným).
Commercial Register: Municipal Court in Prague (Městský soud v Praze).
Email: info@cannalogistics.eu. Phone: +420 725 346 419.

We have not appointed a statutory Data Protection Officer, as we are not required to do so. For any data-protection matter you can contact us using the details above with the subject line “Data protection”.

Categories of personal data we process

We process identification and contact data such as your name, job role, company name, email address, telephone number and postal or delivery address. We process business and transaction data such as company registration and VAT details, the content of your enquiries and quotations, your product and volume requirements, and records of our communication with you. We also process technical and usage data such as your IP address, browser and device type, operating system, referring pages, the pages you view and the date and time of access, collected through server logs and cookies. Finally, some preference data, such as a list of products you save as favourites, is stored locally in your browser and is not transmitted to us unless you send it in an enquiry.

We do not intentionally collect special categories of personal data, and we ask that you do not send us such data through the Website.

Purposes and legal bases for processing

We process personal data to respond to enquiries and prepare quotations, which relies on the performance of a contract or steps taken at your request before entering into a contract under Article 6(1)(b) GDPR, together with our legitimate interest in responding to business enquiries under Article 6(1)(f) GDPR. We process data to provide and administer our services, including logistics, documentation and delivery coordination, on the basis of performance of a contract under Article 6(1)(b) GDPR. We process data to comply with legal obligations, such as accounting, tax, customs and record-keeping duties, under Article 6(1)(c) GDPR. We process data to operate, secure and improve the Website, including essential cookies and server logs, on the basis of our legitimate interest under Article 6(1)(f) GDPR. Optional analytics and non-essential cookies are used only with your consent under Article 6(1)(a) GDPR and Section 89 of Czech Act No. 127/2005 Coll. on electronic communications, which you can withdraw at any time. Where necessary, we also process data to establish, exercise or defend legal claims on the basis of our legitimate interest under Article 6(1)(f) GDPR.

Where the data comes from

We obtain personal data directly from you when you contact us, request a quotation or correspond with us, and automatically from your device when you use the Website. We may also receive business contact details from public registers, such as the Commercial Register or the VAT register, when verifying a business customer.

Recipients and processors

We do not sell your personal data. We share it only where necessary and under appropriate contractual safeguards. This may include providers of website hosting, infrastructure and email services who process data on our behalf as processors under Article 28 GDPR, transport and logistics partners where delivery of goods or documents requires it, professional advisers such as accountants, auditors and lawyers, and public authorities where we are required to disclose data by law.

International transfers

We aim to keep personal data within the European Economic Area. Where a processor or partner is located outside the European Economic Area, we transfer personal data only if an adequate level of protection is ensured, for example on the basis of an adequacy decision of the European Commission or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. You may request a copy of the relevant safeguards using the contact details above.

Retention periods

We keep enquiry and quotation correspondence for the duration of the business relationship and for up to three years after our last contact where no contract is concluded. We keep contract, accounting and tax records for the periods required by Czech law, generally up to ten years. Website server logs are typically kept for up to twelve months unless retained longer for a security investigation, and consent records and analytics data are kept until consent is withdrawn or the data is no longer needed. When personal data is no longer required, we securely delete or anonymise it.

Your rights

Subject to the conditions in the GDPR, you have the right to access your personal data and obtain a copy of it, to request rectification of inaccurate or incomplete data, to request erasure of your data, to request restriction of processing, to object to processing based on our legitimate interests, to receive your data in a structured, commonly used and machine-readable format and have it transmitted to another controller, to withdraw consent at any time without affecting the lawfulness of processing before withdrawal, and to lodge a complaint with a supervisory authority.

To exercise any right, contact us at info@cannalogistics.eu. We will respond within one month, which may be extended by two further months for complex requests. We may ask you to verify your identity before acting on a request.

Supervisory authority

If you believe we have processed your personal data unlawfully, you may lodge a complaint with the Czech supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz.

Automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on you.

Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction, including encrypted transport over HTTPS, access controls and the principle of data minimisation.

Cookies

The Website uses cookies and similar technologies. Details of each category, its purpose and how to manage your preferences are set out in our Cookie Policy.

Children

The Website is intended for business users and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18.

Changes to this Policy

We may update this Privacy Policy from time to time. The current version is always available on this page, with the date of the last update shown above. Material changes will be highlighted where appropriate.