Privacy policy.
Updated: 19/09/2026 · Compliant with Regulation (EU) 2016/679 (GDPR), the amended French Data Protection Act of 6 January 1978 and Directive 2002/58/EC (ePrivacy).
1. Data controller
The controller for the processing of your personal data is:
— , , France
As a micro-enterprise with fewer than 250 employees, is not required to appoint a Data Protection Officer (DPO) within the meaning of article 37 of the GDPR. Any question relating to the processing of your data may be sent to the email address above.
2. Personal data collected
We collect and process the following categories of data:
| Category | Data | Origin |
|---|---|---|
| Identity | Title, last name, first name, date of birth (18+ verification) | Registration, order |
| Contact | Email, phone, postal address | Registration, order |
| Authentication | Password (bcrypt-hashed, never stored in plain text) | Registration |
| Transactions | Order history, amount, payment method (never card data) | Order |
| Loyalty | Points, tier, referral code, history | Loyalty programme |
| Preferences | Favourites, current cart, language, newsletter opt-in | Browsing, opt-in |
| Technical | IP address, user-agent, connection logs (security) | Automatic |
No sensitive data within the meaning of article 9 of the GDPR (health, political opinions, biometric data) is collected. CBD products are not marketed for a therapeutic purpose.
3. Purposes and legal bases (art. 6 GDPR)
| Purpose | Legal basis | Duration |
|---|---|---|
| Customer account management | Performance of the contract (art. 6.1.b) | Active account + 3 years after last login |
| Order processing & delivery | Performance of the contract (art. 6.1.b) | Duration of the contractual relationship |
| Invoicing and accounting | Legal obligation (art. 6.1.c) — French Commercial Code L123-22 | 10 years |
| Age verification (18+) | Legal obligation (art. 6.1.c) | Duration of the account |
| Loyalty and referral programme | Legitimate interest (art. 6.1.f) — customer retention | Active account + 3 years |
| Newsletter / marketing communications | Consent (art. 6.1.a) | Until withdrawn (unsubscribe) |
| Anonymous traffic statistics | Legitimate interest (art. 6.1.f) | 25 months max (CNIL) |
| Security, fraud prevention | Legitimate interest (art. 6.1.f) | 12 months |
4. Data recipients
Your data is never sold. It is accessible to:
- Authorised staff within the limits of their duties (order management, customer service);
- Technical subprocessors bound by a contract compliant with article 28 of the GDPR:
- SumUp Payments UAB (Lithuania, EU) — payment processor, licensed e-money institution. PCI-DSS Level 1 compliant.
- LWS (France, EU) — hosting provider, strictly technical processing of stored data.
- Carriers (La Poste, Colissimo, Mondial Relay) — name and delivery address only.
Transfers outside the EU: no data is transferred to a third country outside the European Economic Area (EEA). All subprocessors are established within the EU.
5. Your rights (art. 15 to 22 GDPR)
You have the following rights over your data at any time:
- Right of access — obtain a copy of the data concerning you;
- Right of rectification — correct inaccurate data;
- Right to erasure ("right to be forgotten") — subject to legal retention obligations (10-year invoicing);
- Right to restriction of processing;
- Right to data portability — retrieve your data in a structured, readable format;
- Right to object — to processing based on legitimate interest or for marketing purposes;
- Right to withdraw consent at any time (newsletter, cookies);
- Right to give post-mortem instructions (article 85 of the French Data Protection Act);
- Right to lodge a complaint with the CNIL (3 Place de Fontenoy, 75007 Paris, France).
To exercise any of these rights: send an email to contact@worldweed.fr specifying the nature of your request. A response will be provided within a maximum of 1 month (art. 12.3 GDPR).
6. Data security
implements appropriate technical and organisational measures to protect your data against destruction, loss, alteration, disclosure or unauthorised access:
- SSL/TLS encryption across the entire site (HSTS enabled);
- Passwords hashed with bcrypt (never in plain text);
- No banking data stored — payment processed directly by SumUp;
- Daily encrypted backups;
- Restricted server access (SSH keys, strong authentication);
- Complex password policy for administrator accounts.
7. Cookies and trackers
In accordance with CNIL decision no. 2020-091 of 17 September 2020 and article 82 of the French Data Protection Act, cookies are classified as follows:
| Cookie | Purpose | Duration | Consent |
|---|---|---|---|
wwsess | User session, cart | Session | Not required (essential) |
ww_lang | Remembers the chosen language | 1 year | Not required (essential) |
age_confirmed | 18+ age confirmation | 30 days | Not required (essential) |
ww_ref | Referral tracking | 30 days | Not required (essential to the contract) |
cookies_ok | Remembers your cookie banner choice | 6 months | Not required (essential) |
No third-party cookie or advertising tracker is set without your explicit consent. The site currently uses no external analytics tool (no Google Analytics, no Meta Pixel). Should this change, a prior consent banner would be displayed as required by law.
You can delete cookies at any time from your browser settings (Chrome, Firefox, Safari, Edge).
8. Profiling and automated decisions
No decision producing legal effects concerning you is made solely on the basis of automated processing, with the exception of anti-fraud measures during payment (3D-Secure, SumUp scoring). You have the right to obtain human intervention in the event of a dispute over these decisions.
9. Register of processing activities
maintains a register of processing activities in accordance with article 30 of the GDPR, available on request from supervisory authorities.
10. Changes to this policy
This policy may be amended at any time to reflect changes to the site, our practices or regulations. Any substantial change will be notified to you by email with reasonable notice.
11. Contact
For any question relating to this policy or the exercise of your rights:
Email: contact@worldweed.fr
Mail: — , , France
Supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL) — 3 Place de Fontenoy, 75007 Paris, France.