Privacy Policy

The data controller for personal data collected through cbditaly.store is Organic CBD ITALY Kft., trading as CBDITALY (“CBDITALY”, “we”, “us”, “our”).

Registered address: 1068 Budapest, Király utca 80. fszt. 11., Hungary. VAT number: 27323854-2-42.

Contact: biz@cbditaly.store

cbditaly.store is a read-only brand showcase. We collect personal data at two points: the Partner / Wholesale enquiry form and the support chat (see Support Chat). When you submit the partner form, we collect:

• First name and last name
• Business email address
• Business name
• Date of business registration
• Business tax number
• EU VAT number
• Business address (optional)

We do not collect payment data or browsing history through this site, and no device identifiers apart from the anonymous chat session described below.

Our support chat may be answered by an automated assistant (Skunky). It helps you find CBDITALY products and the CBDITALY shop that sells them and delivers to your country. Replies generated by the assistant are labelled as AI. A member of our team can take over at any time. cbditaly.store has no accounts, so you always chat as a guest.

We store the conversation on our servers in the EU (Supabase). When you send your first message we create a temporary anonymous session in your browser so the thread can continue, and Cloudflare Turnstile checks that you are not a bot. When the chat starts we record the country your connection appears to come from (the country only, not your IP address), so the assistant can ask whether that is where you want the order delivered. If a teammate takes over, we may ask for an email so we can reply if you close the window. That address is stored for our team; it is not sent to the assistant.

To generate a reply we send only the following to our AI provider, Anthropic (Claude), or, only when that service is unavailable, to Google's Gemini model:

• The public messages in this conversation (up to the last 20), including our replies. Internal staff notes are not sent.
• The language to reply in.
• Your first name, if you typed one in the optional name field. Not your surname.
• The page path you were on (for example /en/shop/…), without any query string.
• The two-letter code of the country your connection appears to come from, as a guess for the assistant to confirm with you.
• When relevant: public catalogue facts (product name, formula, which CBDITALY shops sell it and whether it is in stock), which CBDITALY shops deliver to the country you confirm, and short help-centre answers — the same information already published on our websites.

We do not send your email address, IP address, user id, or staff internal notes. We do not use chat transcripts for advertising or profiling, and we do not sell them.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in answering support questions. Anthropic, PBC (USA) and Google LLC (USA) process the request as our processors under Standard Contractual Clauses.

We process the data you submit for the following purposes:

• Partner evaluation — to assess your wholesale application and contact you about the outcome.
• Legitimate business communication — to answer questions and follow up on your enquiry.

Legal basis: Article 6(1)(b) GDPR — processing necessary for taking steps prior to entering into a contract at your request.

Partner application records are kept for a maximum of 2 years from the date of submission. If we enter a business relationship with you, your data is retained for the duration of that relationship plus any mandatory legal retention period (typically 8 years for accounting records under Hungarian law). If your application is unsuccessful we delete or anonymise your data within 12 months. Support chats: closed conversations are deleted after 90 days; unused anonymous chat sessions are deleted after 24 hours.

We share your data only with:

• Supabase Inc. — our database and hosting provider (EU region, GDPR-compliant data processor).
• Brevo (Sendinblue SAS) — our transactional email provider, used only to deliver the internal notification email. Your data is not used for Brevo marketing.
• Anthropic, PBC — generates support-chat replies (see Support Chat). Google LLC (Gemini) is used only as a backup when Anthropic is unavailable.
• Cloudflare Turnstile (Cloudflare, Inc.) — bot protection on the partner form and the support chat. Cloudflare processes your IP address and technical browser signals and does not set tracking cookies, per Cloudflare's Privacy Policy.

We do not sell, rent or trade your personal data to third parties.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (right to be forgotten).
• Object to processing or request restriction of processing.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or the supervisory authority in your country of residence.

To exercise any of these rights, email biz@cbditaly.store. We will respond within 30 days.

Data is stored in a Supabase Postgres database with row-level security enabled. All data in transit is encrypted via TLS. Access to partner application records is restricted to authorised CBDITALY staff via role-based access control.

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Continued use of cbditaly.store after an updated policy is published constitutes acceptance of the changes.