Register Description in accordance with Section 10 of the Personal Data Act (523/99) 

Registrar CBD Wholesale - Online Shop 

Name of the register E-commerce customer register 

Purpose of the processing of personal data The register is used only to maintain the customer relationship between CBD Wholesale and the customer. Placing an order does not require registration in the customer register. 

Information content of the register Basic customer information: customer number, last name, first name, postal address, postal code, post office, telephone number, mobile phone number, e-mail address, order history and delivery tracking information. The customer's permission to send marketing communications is stored in the register.

Regular sources of information Contact information is saved when the customer registers. Other information is stored when the customer makes a purchase in the online store. 

Regular data transfers and data transfers outside the EU or the European Economic Area 

The registry administrator shall not disclose the information to third parties. 

Registry security principles The registrar's information system and files are protected by the technical protection methods normally used. Access to the register requires a personal username and password, which are issued only to the staff of the controller whose status and duties are associated with that access.

Privacy Policy

Valid from 01.04.2020.
In order for us to serve you to the best of our ability, we require that we collect and process some information about you.

We value your privacy and are committed to protecting it in accordance with this Privacy Statement, applicable law, and general good business practice.

In accordance with the requirements of the EU Data Protection Regulation, this Privacy Statement contains information about what personal information we collect, how we process it and what rights and opportunities you have over your information.

1 Common

Black Gold Factory Ou - 14821095 processes personal information about you in accordance with this Privacy Statement and applicable law, so please read this Privacy Statement carefully.
By using our services or websites, or by contacting us, you agree that we will process personal information about you in accordance with this Privacy Statement. If you do not agree to these terms, we are unlikely to be able to serve you in the best possible way.

2. For what purpose is my personal data collected and processed?

We only collect, store and process personal information about you for pre-defined purposes

  • customer relationship management and customer communication
  • customer service and responding to contact requests
  • implementation and development of our services
  • monitoring and analyzing the use of our services and products
  • customer segmentation to provide personalized content in products and services
  • ensuring the safety of our services and products and investigating abuses
  • customer, opinion and market research
  • developing our business
  • marketing and advertising targeting
  • direct marketing

We do not perform profiling based on the personal characteristics of data subjects or the related processing of data leading to automatic decision-making.

3. What personal information about me is collected and from what sources?

We collect personal information about you primarily from you in connection with your use of and access to our websites and services. We also collect information manually, for example by telephone in connection with customer service or sales. In addition to the information you provide yourself, we also collect information on our websites and services using cookies to analyze and develop the use of our websites and services, and to target marketing and advertising. In addition, we collect information from public sources, such as the trade and business register and other parties that provide information on business decision-makers. The information we collect from these sources includes business information as well as contact information for business decision makers, such as name, email address, and phone number.

4. On what grounds is personal data processed?

We process personal information on a number of grounds required by law. The legal basis for the proceedings depends on our relationship with you. The table below shows the legal bases for the processing of our personal data and examples of processing operations.

Contractual relationship or pre - contractual measures

We process our customers' data for all uses mentioned in Section 2 on a contractual basis.

Statutory obligation

We store and process customer data, for example
for our accounting in accordance with the Accounting Act.

Registrar or third party
legitimate interests

If we do not have a contractual relationship with you, we will process your information on the basis of a legitimate interest. Such processing activities include, for example, customer service and responding to contact requests, tracking and developing visitors to our websites, and ensuring the security of our services and investigating potential misuse. The processing of personal data of company representatives for marketing purposes is based on
also a legitimate interest.


When you subscribe to a guide or newsletter from our website as an individual, we process your information based on your consent. We ask for your consent to direct marketing
in connection with the collection of data.

5. Who processes my data and is it passed on to third parties?

Your information is processed by persons belonging to our company's personnel in the performance of their duties. However, we use third party information systems in our operations to store and process information. In this case, we ensure, among other things, through agreements that your information is treated confidentially and lawfully.
We provide information to enable our partners in the information technology, payment intermediation, transportation and accounting sectors to provide the service. Such situations include, for example, when ordering payment or logistics services from your online store or other services provided by third parties that are ordered through our website or service. Any such communication to third parties related to the provision of the service shall be mentioned separately in connection with the ordering of the service. We may also disclose the information otherwise required to fulfill our contractual obligations or as required by law or a competent authority. We may also disclose your information if we are involved in a business or business transaction.

6. Will my data be disclosed outside the EU?

We prefer service providers whose servers are located in the EU. However, we also use reputable and reliable third-party service providers whose servers are located outside the EU, which means that data is also transferred outside the EU / EEA on a limited basis. For transfers outside the EU / EEA, the transfer will take place through the EU-US Privacy Shield, using EU Commission model contract clauses or any other transfer mechanism permitted by law. In this case, we take care, among other things, of the agreements that your information
confidentiality is maintained and that the data is otherwise processed lawfully.

7. How long will my personal information be kept?

We will only retain your personal information for as long as is necessary for its purpose or as required by contract or law. We strive to update information as well as delete unnecessary information on a regular basis. We will, in principle, delete data that has not been used for more than two years, provided that there is no other reason to retain the data, for example to ensure the security of our services, or a legal basis. Please note that, for example, the Accounting Act requires you to keep accounting material for at least six (6) years during the financial year. 
from the end of the year.

8. How is my information stored and protected?

Your information will be stored on the servers of our service providers, which are protected in accordance with general industry practices. We ensure that the processing complies with the requirements of applicable law and with safeguards designed to prevent the accidental or unlawful destruction, destruction, alteration, unauthorized disclosure or unauthorized access to personal data. The personal information we collect and process is kept confidential and access to it is restricted to those who need the information in the course of their work. We also undertake not to disclose or disclose personal information to non-employees or other persons (including any subcontractors) who need to know such information for the agreed purpose and who are required by law or other agreements or are legally required to keep the information confidential. Access to your personal information is protected by user-specific IDs, passwords and access rights.

9. Mandatory disclosure and consequences of non-disclosure?

If you do not provide or allow the processing of personal information in accordance with the principles set out in this Privacy Statement, we are unlikely to be able to serve you and fulfill the purpose of our activities. If you do not want us to process your information in accordance with this privacy statement, we ask that you do not provide us with any information.

10. Are cookies used on the website and what are they?

We use cookies on our websites to provide the best possible user experience for the users of our websites and services. Cookies are short text files that a web server stores on a user's terminal. Cookies allow us to obtain information about how we use our websites and services. We use the information to develop our services and websites, analyze usage, and target and optimize marketing and advertising. You can allow or deny the use of cookies in the settings of the browser you are using. Most browsers allow cookies automatically. Please note that blocking cookies may limit the functionality of our website and service.

Information on the use of cookies

Updated 4/1/2020
Our websites and online services use cookies. A cookie is a small text file that is stored on a user's terminal and stored there. Cookies do not harm users' computers or files. Purpose of cookies The purpose of cookies is to identify the user so that we can facilitate the use of the website, provide personalized content and targeted advertising, and monitor and analyze the use of our services.

We use both session cookies and the cookies set by web analytics within the meaning of the third party. Session-specific cookies remain in memory while the browser is open, but are destroyed when the browser is closed. Only tracking cookies used to identify new visitors and returners will be retained.

Withdrawal of consent

If we process your information on the basis of your consent, you can withdraw your consent at any time by notifying us. You may also opt out of the use of your information for direct marketing purposes at any time by clicking on the “Unsubscribe” link in each email we send you for marketing purposes.

Access to information

You have the right to receive confirmation from us whether we process personal data about you and to know what personal data we process about you. In addition, you have the right to receive additional information about the grounds for the processing of your personal data.

Right to have errors corrected

You have the right to request the correction of incorrect or outdated or otherwise incomplete information about you.

Right to delete data

You have the right to request the deletion of information about you
for example, if the information is no longer needed for the purpose
to which they have been collected or if you withdraw your consent by
we have processed your information.

The right to prohibit direct marketing

You can refuse to process your personal information
for direct marketing purposes at any time by clicking on “Exit at the end of our emails
mailing list "link. or by notifying our customer service. If you, as our customer, deny your information
use for direct marketing, we will only send you customer relationship management 
necessary messages.

Right to object to processing

If we process your personal information in the public interest or
on the basis of our legitimate interests, you have the right to object
the processing of personal data concerning you in so far as
there is no compelling reason to consider that
would override your rights or processing is not necessary
to deal with a legal claim. Please note that here
in this situation we will probably no longer be able to serve

Right to limit processing

You have the right in certain situations to demand that we restrict 
processing of your personal data. For example, if the data is
do you think 
wrong, allowing us to restrict the processing of data 
during the validity check or if the processing
you believe is illegal and you do not want your information deleted.

The right to have the data transferred


If we have processed your information with your consent
on the basis of or to perform the contract, you are entitled
receive the information you provide us electronically by machine
in a readable, commonly used format to make the information
could be transferred to another service provider, if any
technically possible.

The right to oppose automatic processing and profiling

We do not carry registered personal
feature-based profiling or automated data processing.

How can I exercise my rights?

You can exercise your rights described above by contacting us, for example, by sending an email to More detailed contact information can be found at the end of this document. Please be prepared to prove your identity if your contact concerns the processing of your own personal data. If you consider that the processing of your personal data is not lawful, you can also lodge a complaint with the competent supervisory authority. You can find the contact details of the Data Protection Officer on the Data Protection Officer's website.

Can this privacy statement be updated?

We will update the content of this privacy statement as our operations develop and / or 
as legislation changes, so we ask you to visit this page 
from time to time. You will find the latest update date in the privacy statement 
from the beginning of this document. Significant changes to the privacy statement are sought
inform data subjects when updating the conditions.

How can I contact us about privacy?

The easiest way to contact us is to send an email to Messages sent to this email address 
will be treated confidentially by our privacy team.

Black Gold Factory OU
Tallinn, Estonia