Privacy notice

1. Who is responsible for your data?

The controller is the legal entity operating Cannatural.eu. It determines the purposes and means of the processing described here.

Full legal name

Cannatural Korlátolt Felelősségű Társaság

Registered address

2483 Gárdony, Ady Endre utca 11., Hungary

Company registration number

07-09-037981

Hungarian tax number

25713455-2-07

Privacy contact

info@cannatural.eu

Website

cannatural.eu

2. What information do we process?

Contact enquiries: your name, email address, company name if provided, selected enquiry topic, message and subsequent correspondence. The form also sends a request identifier to help distinguish submissions and prevent duplicate processing. Delivery information and an enquiry reference can be associated with the request.

Website operation: our hosting and server providers process technical request information, such as IP addresses, request times, requested pages and browser information, to deliver the website, handle form requests, diagnose faults and prevent abuse. The form includes an anti-spam field.

Optional analytics: if you agree, Google Analytics processes online identifiers and information about pages visited, device/browser use, approximate location and interaction events. Our integration measures successful enquiries, email-link clicks and laboratory-document clicks. It does not send form names, email addresses, company names or message contents as analytics event data, and removes query parameters from the page URLs it sends.

Please do not include health information, identity documents, payment-card details or other sensitive personal data in your enquiry.

3. Why we use your data and our legal bases

• General and business enquiries: to answer questions, communicate with a company representative, provide product information and discuss distribution, resale or white label cooperation. The basis is our legitimate interest in handling correspondence and developing the business relationship you initiated (GDPR Article 6(1)(f)).
• Steps towards a contract with you as an individual: where necessary to provide a quotation or take other steps you requested before entering into a contract with you, the basis is GDPR Article 6(1)(b). This basis does not automatically apply when you represent a separate company.
• Website delivery, security and preventing duplicate or abusive submissions: our legitimate interest in operating a reliable website and protecting communications (GDPR Article 6(1)(f)).
• Optional Google Analytics: your consent (GDPR Article 6(1)(a)). The Google tag is loaded only after acceptance. Advertising features are disabled in this integration.
• Where a specific legal obligation requires us to keep information, the basis is GDPR Article 6(1)(c). Any records needed to establish, exercise or defend legal claims are limited to what is necessary for that purpose, based on GDPR Article 6(1)(f).

Submitting an enquiry may generate an acknowledgement email and an internal notification so that the team can respond. Those are service communications about your request. This form is not a newsletter subscription.

4. Do you have to provide your data?

Contacting us is voluntary. To use the online form, you need to enter your name, a valid email address and a message; an enquiry topic is selected in the form. Company name is optional. Without the required information, we cannot receive and answer your enquiry through the form. You may also contact us directly by email.

You can browse the website and send an enquiry without accepting analytics. Reading this notice is not treated as consent to analytics or marketing.

5. Who receives your information?

Enquiries are made available to the people authorised to handle your request for Cannatural.eu. Technical providers process the information needed to deliver their services. Relevant categories are hosting and server providers, email delivery and mailbox providers, and Google Analytics when you have opted in.

Google Firebase and Google Cloud provide website hosting and server infrastructure for the contact endpoint. Google Analytics is supplied separately by Google. The Google entity providing each service, its subprocessors and processing terms are described in the applicable service agreement.

Email delivery and mailbox provider: DEVBOX Kft. (RapidWP) · 7054 Tengelic, Rákóczi Ferenc u. 9., Hungary · devbox.hu

Information may also be disclosed to professional advisers or competent authorities where required by law or necessary to establish, exercise or defend legal claims. Access must be limited to the information needed for the relevant task.

6. International processing

Google operates global infrastructure. Some processing, support access and onward transfers can take place outside the European Economic Area, including in the United States. Choosing a European server region does not mean that all related processing remains in that region.

The safeguard for each transfer must match the provider, destination and service agreement. Google describes mechanisms including the European Commission’s standard contractual clauses and, for eligible certified recipients and covered transfers, the EU–US Data Privacy Framework. The arrangements applicable to this website are set out below. You can contact us for information about the safeguards and how to obtain a copy.

To be completed before publication

7. How long do we keep your data?

Enquiry information is needed while we handle your request and any agreed follow-up. Continued storage must be justified by the ongoing relationship, an identified legal obligation or a specific need connected with legal claims. Information that is no longer necessary must be deleted or anonymised. Deletion also needs to cover copies in mailboxes and any server-side records, with backups removed in their normal deletion cycle.

The following details must reflect the actual mailbox, backend, log and Google Analytics settings. A browser-cookie expiry is different from retention of data already received by a server.

Enquiries and correspondence

To be completed before publication

Technical records, delivery records and backups

To be completed before publication

Google Analytics user and event data

To be completed before publication

Browser choices and analytics cookies

Your analytics choice is stored in this browser for 180 days. This integration configures Google Analytics cookies (_ga and _ga_*) to expire after 180 days without extending that period on each visit. Clearing browser storage removes your saved choice.

8. Cookies and withdrawing analytics consent

Use Cookie settings in the footer to allow or reject analytics at any time. Rejection does not affect the contact form. Withdrawal stops future measurement in this browser and removes this website’s Google Analytics cookies; it does not itself delete information already received by Google. Withdrawal does not affect the lawfulness of earlier processing based on consent.

Your choice applies to the browser and website address you are using. You can also manage cookies in your browser. Further information is available on our cookie information page.

9. Your data protection rights

Depending on the applicable legal conditions, you may request access to your personal data, correction of inaccurate data, erasure or restriction of processing. You may object to processing based on legitimate interests. Where processing is automated and based on consent or a contract, you may also have the right to receive the personal data you provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.

You can withdraw consent for processing based on consent at any time. To exercise your rights or ask a privacy question, email the privacy contact above. Please identify the enquiry or browser information relevant to your request. We may request only the additional information necessary to verify your identity if there are reasonable doubts.

We normally respond without undue delay and within one month. If a request is complex or we receive several requests, the period may be extended by up to two further months; we will explain the extension within the first month. Requests are normally free of charge, subject to the exceptions in the GDPR.

The website integration does not use enquiry data for automated decisions producing legal or similarly significant effects, or for advertising profiling.

10. Complaints and changes to this notice

You have the right to complain to a supervisory authority, in particular in the EEA country where you habitually live, work or where you believe an infringement occurred. You do not need to contact us first. In Hungary, the authority is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH). You may also seek a judicial remedy.

We will update this notice if the website’s processing changes. The date above identifies this version.

Provider information

• Firebase privacy and security
• Google Privacy Policy
• Google Cloud processing terms
• Google Analytics processing terms
• RapidWP services and provider details