Privacy Policy

This policy explains what personal information The CBD Shop collects when you use thecbdshop.co.uk, buy from us or contact us, why we collect it, who we share it with, how long we keep it and your rights.

Who We Are

THECBDSHOP.CO.UK (The CBD Shop) is responsible for your personal information. You can contact us about anything in this policy at help@thecbdshop.co.uk, or by post at THECBDSHOP.CO.UK, 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom.

The Short Version

• We use your details to take and deliver your orders, run your account and subscriptions, and answer your questions.
• We only email you offers and news if you've agreed to them, or if you're a customer and haven't said no. Every one of those emails has a one-click unsubscribe.
• We never see or store your full card details: you pay on Viva's secure page.
• Google Analytics only runs if you accept analytics cookies. We don't use advertising or marketing cookies.
• We don't sell your information.

What We Collect and Why

When you order. Your name, email address, delivery address and, if you give one, your phone number; what you ordered and what you paid; and a reference to your payment from Viva (never your card number). We use these to take payment, send your order, keep you updated, and handle returns, refunds and questions. Lawful basis: our contract with you. We keep order records to meet our tax and accounting duties. Lawful basis: legal obligation.

Your account. Your name, email address, sign-in details and saved addresses, so you can sign in, see your orders, manage subscriptions and start returns. Lawful basis: our contract with you.

Subscribe and save. If you subscribe, we keep your plan (how often, and at what discount), the products and quantities on it, your next delivery date, the payment reference Viva gives us so we can charge each delivery, and a record of each change (created, skipped, changed, paused, cancelled, charged or failed). We use them to send each delivery, to email you before every delivery with its date and amount, and to let you manage your subscription. Lawful basis: our contract with you.

Orders from our old shop. Before this website, our shop ran on Shopify. We've brought our customer records and order history across from it, so you can see your earlier orders when you sign in with the same email address. These hold your name, email address, phone number and default address; your past paid orders (order number, date, products and amounts); and the email and text marketing choices you made there. If you unsubscribed on the old shop, you stay unsubscribed. We also use your order history to know whether you've ordered before: our welcome offer, for example, is for first orders only. Lawful basis: our legitimate interest in continuing to serve our customers, and legal obligation for the order records.

When you type your email at checkout. Once you've typed your email address at checkout and moved on, we save it with your bag, as the notice beside the email field explains. If you leave without paying, we may email you up to two reminders about your bag, about an hour and about a day later. We only send them if you've agreed to hear from us, or if you're an existing customer and you didn't tick "Don't send me reminders about my bag", and never after you've unsubscribed. Every reminder has a one-click unsubscribe. Lawful basis: your consent, or, for existing customers, our legitimate interest in reminding you (the "soft opt-in" the Privacy and Electronic Communications Regulations allow).

Offers and news by email. You can sign up through the welcome offer that may appear when you're about to leave our site, our newsletter sign-up, the box at checkout, your account or our chat. When you sign up through the welcome offer, the newsletter or the chat, we email you a link to confirm it's your address, and nothing is sent until you click it; the welcome code comes after you confirm. We keep a record of what you agreed to, when and where. Lawful basis: your consent, which you can withdraw at any time.

Our chat assistant. Our chat is an automated assistant, not a person. When you use it, we keep the conversation, the page you were on, any name, email address or phone number you give it, and any order you ask it to look up. To look up an order it needs both the order number and the email address on the order, and it shows only the order's status, dates, items and tracking, never the address or payment details. It removes anything that looks like a card number before your message is stored or sent anywhere. We use the chat to answer your question and to pass anything it can't answer to our team by email. Lawful basis: our legitimate interest in answering you, or our contract with you if it's about an order. If you say yes to offers by email in the chat, that's consent, as above.

To understand your message, the assistant sends it, with a short summary of the conversation so far, to an AI service (OpenRouter, below). It doesn't use AI to write its replies: they come from our own wording. We may keep copies of conversations with names, email addresses, phone numbers and card-like numbers removed, to improve our own assistant. We never give conversations to anyone to train their AI models.

When you email us. Your message, your email address and anything you include, so we can reply. Lawful basis: our legitimate interest in answering you, or our contract with you.

Reviews. After your order is delivered, our delivery email invites you to review it on our site. We invite every customer whose order is delivered, and we never offer anything for a review. If you write one, we keep your review, star rating and the name you choose to show, and we publish it once we've checked it: see How We Show Reviews. We may also ask Trustpilot to invite you to review us there; if we do, we send Trustpilot your name, email address and order number, and Trustpilot is responsible for reviews on its own site under its own privacy policy. Lawful basis: our legitimate interest in collecting genuine reviews.

Cookies and analytics. Essential cookies keep our site working: your bag, signing in, your currency and your cookie choice. Analytics cookies, from Google Analytics, are set only if you accept them in the cookie banner, and you can change your choice at any time with Cookie Settings at the foot of every page. We don't use Google's advertising features, and we don't use advertising or marketing cookies. Lawful basis for analytics: your consent. We also count visits ourselves, without your name or email address: a random visit code, an encrypted (hashed) form of your IP address, your country, the page you arrived on, the website that sent you (its name only) and any campaign tags in the link, so we know which searches and links lead to visits and orders. Lawful basis: our legitimate interest in understanding and improving our shop. Our Cookie Policy explains each cookie.

"Recently ordered" notices. Our pages may show that a product was ordered recently, and when. These notices never include anything about the customer: no name, town, quantity or price.

Security. We record an encrypted form of IP addresses and similar technical details to prevent fraud and abuse and keep our site secure. Lawful basis: our legitimate interest in protecting our customers and our shop.

We don't make decisions about you by automated means that have legal or similarly significant effects. Viva may check payments for fraud as part of taking them.

Who We Share It With

We use these companies to run our shop. Each one only gets what it needs, and only uses it for us, except where we say it's responsible for it itself.

• Amazon Web Services, in London, UK: hosting our website, database and files, and sending our emails (Amazon SES). It holds everything our site holds.
• Viva (viva.com): taking payments, including the repeat payments for subscriptions. It gets your name, email address and the amount, and the payment details you enter on Viva's page. Viva is responsible for your payment details under its own privacy notice, which also says where it processes them.
• Royal Mail (Click & Drop), in the UK: printing labels, delivering your order and sending you tracking updates. It gets your name, delivery address, email address and, if you gave one, your phone number.
• Our email campaign system, which runs on Cloudflare's worldwide network: sending our offers and news emails, and keeping unsubscribes in step with our site. It gets the email addresses and first names of people who have agreed to marketing, the discount codes sent to them, and the orders those people have paid for (order number, total and products).
• Google Analytics, in the United States: analytics, only if you accept analytics cookies. It gets how you use our site, with a random ID, never your name or email address.
• Google Workspace, outside the UK, including the United States: our email inbox, help@thecbdshop.co.uk. It holds the emails you send us.
• OpenRouter, in the United States, and the AI model providers it uses for us, wherever they are: understanding chat messages, and choosing which of our own answers fits. They get your chat messages, with card numbers removed, and a short summary of the conversation. Our blog writer uses the same service but sends it no customer information.
• Trustpilot, in Denmark (EU): review invitations, if we use them. It gets your name, email address and order number.

We may also share information when the law requires it, or to protect our rights, our customers or others.

Sending Information Outside the UK

Some of these services (Google, OpenRouter and the AI model providers it uses, Cloudflare and Trustpilot) may process information outside the UK, including in the United States. When they do, we make sure it's protected as UK law requires: by a UK decision that the country, or the company's certification, protects it adequately (such as the UK extension to the EU–US Data Privacy Framework), or by the UK's approved contract terms.

How Long We Keep It

Information	How long
Orders, refunds and the order history from our old shop	7 years, for tax and accounting. If you delete your account, we keep them with your name, email address and address removed.
Your account and saved addresses	Until you delete your account
Sign-in sessions	Deleted 30 days after they expire. A guest who hasn't ordered and has no bag is deleted after 30 days without use.
Your email saved with a bag at checkout	Deleted 30 days after you last changed or opened the bag, or sooner if you ask us. If you ticked "Don't send me reminders about my bag", we keep only a scrambled form of the address (a hash) so we never send you one.
Chat conversations	12 months, or sooner if you ask us
Marketing contacts	Until you unsubscribe. If you never ordered and haven't agreed to marketing, 24 months.
Records of what you agreed to (consent)	At least 2 years, and for as long as you're subscribed
The list of addresses that have unsubscribed	Kept, so we never email them again by mistake
Records of the emails we've sent	12 months
A copy of your data that you download from your account	7 days
The files we brought across from our old shop	Deleted from our storage within 2 days of being imported

Your Rights

You have the right to ask for a copy of your information, to correct it, to have it deleted, to restrict or object to how we use it, to have it in a portable form, and to withdraw your consent at any time. You can object to marketing at any time, and we'll stop: use the unsubscribe link in any of our emails, or email us.

If you have an account, you can download your information or delete your account yourself, on your account's Profile page. If you delete your account, we delete your sign-in, profile and addresses, your marketing contact record and your chat conversations. We keep your orders for 7 years for tax and accounting, with your name, email address and address removed.

For anything else, email help@thecbdshop.co.uk. We'll reply within one month.

Children

Our shop is for adults. You must be 18 or over to buy from us, and we don't knowingly collect information about anyone under 18.

Keeping It Safe

Your information is encrypted when it travels to and from our site and when it's stored. Only people who need it can reach it, and every staff sign-in to our shop's administration needs a second step, a code by email. We store IP addresses in an encrypted (hashed) form. No system is perfectly secure; if we ever have a data breach that puts you at risk, we'll tell you and the ICO as the law requires.

Complaints

If you're unhappy with how we've used your information, please tell us first at help@thecbdshop.co.uk and we'll try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, or 0303 123 1113.

Changes to This Policy

If we change this policy, we'll publish the new version here, with the date it takes effect. If a change matters to you, we'll tell you by email.