What personal data are?
Personal data means any information relating to an identified or identifiable natural person. Personal data are in particular name, surname and e-mail address.
What personal data do we collect?
1. On our website
We collect your personal data primarily in connection with your visit to our website. Including: the IP address, the domain used to access our website, the type and version of your browser, the website you came from to access our website, the page you entered and exited at, any website page within our website that is viewed and what country are you in during visit to our website.
We process abovementioned data in order to monitor our website’s performance according to parameters such as: number of visits, average time spent, page views, and for business purposes sich as working to continually upgrade our website (art. 6(1)(f) GDPR).
In order to achieve abovementioned goals we may place a “cookie” on the hard drive of your computer to track your visit. A cookie is a small data file that is transferred to your hard drive through your web browser that can only be read by the website that placed the cookie on your computer. The cookie acts as an identification card and allows our website to identify you and to record your passwords and preferences. The cookie allows us to track your visit to the website so that we can better understand your use of our website and so we can customize and tailor the website to better meet your needs. You may disable cookies at any time. In your browser settings you can chose: 1) to have your browser notify you prior to a website placing a cookie on your hard drive so that you can decide whether or not to accept the cookie or 2) to have your browser automatically prevent the placing of a cookie on your computer. Please note that should you refuse the cookies, you might not be able to access a number of web pages found on the website.
Our website allows and encourages you to contact us by using “Contact us” form on the website. Should you use that form, we will collect your personal data, such as your name, surname and city you live in, as well as other data your chose to entrust us with (including phone number), on the basis of art. 6(1)(f) GDPR and art. 6(1)(a) GDPR (in case of personal data which are not mandatory to provide in the form).
Our websites may contain also links to other websites that may be subject to less stringent privacy standards. The controllers of these websites are sole liable for the conducting privacy practices. We are not responsible for how such third parties collect, use or disclose your personal data.
2. In other situations
Depending on the circumstances, your personal data may also be processed by us in the following cases:
A. if you are a job applicant to Canopy Growth Polska, we will collect your personal data referred to in art. 221 of the labour code, i.e. name and surname, date of birth, contact data and – depending on the type of work – education, professional qualification and the course of previous employment, on the basis of art. 6(1)(c) of GDPR,
B. if you are a doctor or pharmacist, we will collect your personal data such as name and surname, phone number, e-mail address (on the basis of art. 6(1)(f) of GDPR and other data provided voluntarily by you, in particular data on the completed specialization and place of performing the profession (on the basis of art. 6(1)(a) of GDPR),
C. if you are or want to become our contractor, we will collect your personal data such as name and surname, address, phone number, e-mail address and REGON number (art. 6(1)(b) of GDPR) and other data which are obligatory to provide (art. 6(1)(c) GDPR), in particular the tax identification number (NIP),
D. if you participant or want to participate on our educational events about the benefits of medical cannabis, including whether as a patient, doctor or pharmacist, we will collect your personal data such as name and surname, address, phone number, type of specialization completed, the place of performing the profession and other data provided voluntarily by you based on your consent (art. 6(1)(a) GDPR.
How do we collect your personal data?
We collect your personal data directly from you, for example when you visit our website or when you contact us by using contact form. If we receive your personal data from a third party in the course of the performance of its services for us or otherwise, we take reasonable steps to ensure that such third parties have collected your personal data lawfully and that they have the right to share that data with us.
How long do we keep your personal data?
We will process your personal data only as long as it will be necessary to achieve the goals for which data was collected or received, that are mentioned above.
Why do we collect your personal data?
In case your visit to our website we collect and process your personal data in order to develop our operations, including for example in order to establish, maintain and manage our relationship with you. In case of other relations with you, we collect and process your personal data in other purposes to which data was collected.
To whom do we disclose your personal data?
Your personal data may be disclosed to entities with whom we cooperate with as part of our business, including consultants or contractors, in particular entities providing IT solutions as well as entities providing accounting and HR services. Your personal data may also be disclosed to other entities within the Canopy Group. Your personal data may also be made available to law enforcement or government administration authorities to the extent resulting from the law.
Will your personal data be transferred to the countries outside of the European Economic Area or to international organizations?
One of the controllers of your personal data is Canopy Growth Corporation with its registered seat in Smiths Falls, Ontario, Canada. Due to that your personal data will be transferred to Canada. Based on the decision of 20th December 2011 r. European Commission recognized Canadian personal data protection as equivalent EU system. (see more on: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002D0002).
Also due to our use of several IT solutions that are provided, serviced or maintained by entities whose headquarters or branches are located in countries outside the European Economic Area, your personal data may be transferred to such countries, in particular to the United States of America. These entities ensure an adequate level of protection of data the process, confirmed in relevant decisions of the European Commission or – if there is no such decision – by implementing appropriate security mechanisms, including the use of the so – called standard contractual clauses.
Your personal data will not be transferred to any international organization.
What rights do you have in relation to our process of your personal data?
In relation to our process of your personal data, you have following rights:
- the right to access to your data, rectify to supplement it,
- the right to request the erasure of your data, unless the data is still necessary in relation to the purposes for which they were collected or otherwise processed,
- the right to request the restriction of further processing of your data – in situation described in GDPR,
- the right to withdraw your consent at any time – when the data was collected based on your consent and with the reservation that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal,
- the right to object further processing of your personal data,
- the right to lodge a complaint to the President of the Personal Data Protection Office if you believe that we are processing your data unlawfully.
When requesting access to your personal data, we may ask you to provide specific data or parts of it to confirm your identity as well as to find and provide you with the requested data. If we are unable to fulfil your request, we will immediately inform you of the reasons for refusing to fulfil your request.
How are your personal data protected?
We implemented appropriate organizational and technical measures to protect your personal data. These safeguards are designed to protect your personal data from loss, destruction, alteration or unauthorised disclosure of or access to your data by a third party.
How can you contact us in regard to our processing of your personal data?
We have appointed a data protection officer for our company. If you have any questions about our processing of your personal data you can contact:
- our data protection officer under email@example.com or
- our data privacy department for any requests under firstname.lastname@example.org
Who is the controller of your personal data?
The controllers of your personal data are:
1. Canopy Growth Polska Sp. z o.o. with its registered seat in Toruń (87-100) at Grudziądzka 1-3, entered into the register of entrepreneurs of the National Court Register by the District Court in Toruń VII Commercial Division of the National Court Register under the number 0000470617, having the tax identification number (NIP) 9512445224 and REGON number 146784244,
2. Canopy Growth Corporation with its registered seat in Smiths Falls, 1 Hershey Drive, K7A 0A8 Ontario, Canada, business number 853179869RC0001 – as to the personal data collected through the use of Our website.
We do not make any decisions based solely upon automated processing of personal data, including profiling.
Our website is not intended for, nor directed to, young and underage persons. The persons may only visit our website with the consent of their parents or legal guardians.