Cannevo
    § Legal · Privacy

    Privacy Policy.

    Last updated: 1 January 2026 · Version 2.0

    1. Data Controller

    The data controller responsible for processing your personal data is:

    Cannevo Technologies GmbH
    Linienstr. 12, 10115 Berlin, Germany
    HRB 123456 B · Amtsgericht Berlin-Charlottenburg
    Email: [email protected]

    2. Data We Collect

    When you use Cannevo services we may process the following categories of personal data:

    • Identity data: full name, date of birth, government ID document (via IDnow verification partner).
    • Contact data: email address, city of residence.
    • Usage data: dispensing events, cultivation records, audit log entries — all required for KCanG §26 compliance.
    • Technical data: IP addresses, browser type, device identifiers, session tokens (session cookies only).

    3. Purposes and Legal Basis (Art. 6 GDPR)

    Art. 6(1)(b) — Contract

    Processing member applications, maintaining your membership record, processing dispensing events.

    Art. 6(1)(c) — Legal obligation

    KCanG §16, §26, and §31 compliance records; BtMG-related audit obligations; financial records under HGB.

    Art. 6(1)(a) — Consent

    Optional analytics cookies (you may withdraw consent at any time via the cookie banner).

    Art. 6(1)(f) — Legitimate interests

    Platform security, fraud prevention, incident response, and service improvement.

    4. Data Processing Agreements (DPA Art. 28)

    When we act as a data processor on behalf of club operators (Verantwortliche), we enter into a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. This agreement governs the scope, duration, nature, and purpose of processing, the type of personal data processed, and the obligations and rights of the controller.

    Club operators may request a copy of our standard DPA by emailing [email protected].

    5. Cookies

    We use only necessary cookies by default (session management, CSRF protection). Analytics cookies are only set with your explicit consent via the cookie banner shown on your first visit.

    You can withdraw analytics consent at any time by clearingcannevo-cookie-consent from your browser's local storage.

    6. Your Rights

    Under the GDPR you have the following rights regarding your personal data:

    • Access (Art. 15): Request a copy of all data we hold about you.
    • Erasure (Art. 17): Request deletion of your data, subject to our legal retention obligations under KCanG and HGB.
    • Portability (Art. 20): Receive your data in a structured, machine-readable format.
    • Objection (Art. 21): Object to processing based on legitimate interests.
    • Rectification (Art. 16): Correct inaccurate data.

    To exercise any right, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

    7. Data Protection Contact

    For all data-protection inquiries: [email protected]