• ·Account & authentication — email address and password (stored as a secure hash) when you create an account.
• ·Order & delivery — first name, last name, email address and delivery address (street, city, postal code, country).
• ·Order records — products ordered, quantities, prices, order status, timestamps and bank transfer payment reference.
• ·Transaction origin — the IP address from which your order was submitted. This is stored only for fraud prevention and legal dispute resolution, and is never used for analytics, advertising or profiling.
• ·Usage & security — IP address, browser signals, the pages you view and which products you view, add to cart and order, collected by Google Analytics 4 (with your consent) and Google reCAPTCHA (bot protection). Google Analytics 4 never receives your name, email address, postal address, order reference, product prices or order totals.
• ·Cookie preferences — your consent choices stored in your browser.
• ·Recently viewed products — for logged-in users who have not opted out, we save the last 20 products you viewed (product ID, domain and timestamp) so you can quickly navigate back to them. This is stored in your account solely for your convenience and is never used for advertising or profiling.
• ·Support chat — the messages you send, an optional first name, and (for guests, only after a teammate takes over) a reply-to email. See Support chat below for what is sent to the assistant.

• ·Contract performance (Art. 6(1)(b)) — processing your order, managing your account, arranging delivery, and answering an account holder’s questions about their own order in support chat.
• ·Legal obligation (Art. 6(1)(c)) — retaining accounting and tax records for 7 years as required by applicable EU law.
• ·Legitimate interest (Art. 6(1)(f)) — (a) protecting our website against bots and fraud using Google reCAPTCHA; (b) saving your last 20 viewed products so you can quickly navigate back to them (never used for advertising); (c) recording your IP address at the time of purchase to prevent fraud and to retain verifiable evidence in the event of a legal or regulatory dispute relating to your order; (d) operating in-app support chat, including an automated assistant, to answer questions about the shop and products.
• ·Consent (Art. 6(1)(a)) — Google Analytics 4 cookies. You may withdraw consent at any time via our cookie banner.

Our in-app support chat may be answered by an automated assistant (Skunky). Replies generated by the assistant are labelled as AI. A member of our team can take over at any time. You can use the chat with or without an account.

We store the conversation on our servers in the EU (Supabase). If you chat without an account we create a temporary anonymous session in your browser so the thread can continue. Opening chat as a guest also uses Google reCAPTCHA, the same bot check as login. If a teammate takes over and you are a guest, we may ask for an email so we can reply if you close the window. That address is stored for our team; it is not sent to the assistant.

To generate a reply we send only the items listed below to Google’s Gemini model. We do not send your email address, password, postal address, payment details (including IBANs), phone number, IP address, user id, or staff internal notes.

Legal basis: legitimate interest (Art. 6(1)(f)) in answering support questions; and, when you have an account and ask about an order, contract performance (Art. 6(1)(b)). We do not use chat transcripts for advertising or profiling, and we do not sell them. Google LLC (USA) processes the request as our processor under Standard Contractual Clauses.

• ·The public messages in this conversation (up to the last 20), including our replies. Internal staff notes are not sent.
• ·The language to reply in, and whether you have a shop account (yes or no) — not your user id.
• ·Your first name, if we have one (from your profile, or the optional name you typed). Not your surname.
• ·The page path you were on (for example /en/shop/…), without any query string.
• ·If you have an account: product names and quantities in your saved cart (not prices). Without an account we do not send a cart — a guest cart lives only in your browser.
• ·Only if you ask about an order, and only if you have an account on this shop: order reference, status, how many days ago it was placed, unpaid waiting time if still pending, and a tracking link once dispatched. We do not send the delivery address or what was in the order. Without an account the assistant only learns that a sign-in is needed.
• ·When relevant: public catalogue facts for this shop (product name, starting price, stock, formula) and short help-centre answers — the same information already on the website.

When you are logged in to your account, we save the last 20 products you viewed so you can quickly navigate back to them. This list is shown in the 'Recently Viewed' strip across the store and on your account page, and syncs across your devices.

This feature exists entirely for your benefit — to help you find products you were interested in without having to search again. The data is never used for advertising, profiling, or shared with third parties.

Specifically, we store: your user ID, the product ID, the store domain (e.g. cbditaly.ee) and the date and time of the visit. The list is capped at 20 entries; older entries are automatically replaced. We do not store your IP address or any other data in connection with this feature.

The legal basis is our legitimate interest (GDPR Art. 6(1)(f)). You have the right to object at any time.

You can disable this feature and immediately erase all stored entries by going to Account → Marketing & Privacy and turning off 'Remember my recently viewed products'.

When you place an order, we record the IP address of the device used to submit the order. We do this for two specific purposes only: (1) fraud prevention — to detect and investigate fraudulent or disputed transactions; and (2) legal dispute evidence — to provide a verifiable record of the transaction's origin in the event of a chargeback, identity fraud claim or regulatory inquiry.

Legal basis: Legitimate interest under GDPR Art. 6(1)(f). As a seller of regulated hemp and CBD products, we have a legitimate interest in being able to verify that an order was genuinely submitted by the account holder. This interest has been assessed in an internal Legitimate Interest Assessment and found to be proportionate and necessary, taking into account your right to privacy.

The IP address is not used for advertising, behavioural profiling or any purpose other than those stated above. It is never sold or shared with third parties, except where required by a court order or a lawful request from a regulatory or law enforcement authority.

Retention: 3 years from the date of purchase, after which the IP address is permanently and irreversibly deleted (the field is set to null). The 3-year period reflects the standard statute of limitations for contractual disputes under the laws of Estonia, Latvia, Lithuania and Italy — the countries in which CBDITALY operates. After deletion, only the order record itself (without the IP address) is retained for the 7-year accounting obligation.

We share personal data with the following processors under data processing agreements:

• ·Account data — retained until you delete your account.
• ·Order records — retained for 7 years from purchase date (legal/tax obligation).
• ·Support chat (account holders) — retained until you delete your account.
• ·Support chat (guests, no account) — closed conversations are deleted after 90 days; unused anonymous sessions are deleted after 24 hours.
• ·Recently viewed browsing history — retained until you disable the feature in Account → Marketing & Privacy, or until you delete your account.
• ·Google Analytics data — user-level data retained for 2 months (GA4 default).
• ·Cookie preferences — stored in your browser until you clear them.
• ·reCAPTCHA data — subject to Google's own retention policy.
• ·Transaction IP address — 3 years from the date of purchase, then permanently deleted (field set to null). The order record without the IP is retained for 7 years for accounting purposes.

As a data subject you have the following rights. To exercise any of them, email dpo@cbditaly.store. We will respond within 30 days.

Art. 15

Right of access— Request a copy of your personal data.

Art. 16

Right to rectification— Correct inaccurate or incomplete personal data.

Art. 17

Right to erasure— Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.

Art. 18

Right to restriction— Ask us to limit processing of your data.

Art. 20

Right to data portability— Receive your data in a structured, machine-readable format.

Art. 21

Right to object— Object to processing based on legitimate interest.

Art. 7(3)

Right to withdraw consent— Withdraw consent for analytics cookies at any time via the cookie banner.

We use cookies for essential functionality (cart, authentication) and, with your consent, for analytical purposes (Google Analytics 4). For full details please read our Cookie Policy.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. We will notify you of significant changes by posting a notice on our website.

For privacy-related questions or to exercise your rights:

Email: dpo@cbditaly.store

Post: INK AND CHILL LATVIJA, SIA, Rīga, Audēju iela 5, LV-1050