Privacy Policy

 

Welcome to cbdlogistics.eu. CBD Logistics is committed to protecting your privacy and ensuring the security and confidentiality of your personal and commercial data. This Privacy Policy describes how we collect, use, and protect your data when you interact with our website www.cbdlogistics.eu, including our forms, our newsletter and our AI assistant (AI Mode). This policy complies with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Swiss Federal Act on Data Protection (nFADP / nLPD, SR 235.1), to the extent applicable.

1. Identity of the Company

CBD Logistics is a registered commercial brand of Orgena SA, a company registered in the Canton of Grisons, based in Stradón 116, CH-6557 Cama, Switzerland (Commercial Register UID: CHE-190.569.496 MWST / TVA). Orgena SA is the controller of the personal data processed through this website. For general and privacy-related inquiries, you can reach our team at info@cbdlogistics.eu (Attn: Data Protection) or by phone at +41 91 830 11 14. For further corporate details, please visit our Impressum section.

2. Collection of Personal and Commercial Data

When you use our website, register for a wholesale B2B account, contact us, subscribe to the newsletter, use the AI assistant or place an order, we collect the information necessary to deliver our services, process transactions, and ensure statutory compliance. The data we collect includes:

Personal identification: First and last name, email address, phone number.
Delivery and billing details: Shipping address, billing address, order records, customer account data, and your confirmation of being at least 18 years old. Where required by the carrier or by customs, we also process the information needed for customs clearance of your shipment.
B2B wholesale details: Legal company name, registered corporate seat, operating address, Commercial Register UID / VAT number, business representative contact details.
Contact and support data: The content of messages sent through our forms, by email, by phone or, if you choose to use it, through WhatsApp.
Newsletter data: Email address, language and proof of your consent.
AI assistant data: Messages you type into the AI assistant, as described in Section 4.
Technical browsing data: IP address, timestamp of access, browser type, operating system, and pages visited (server logs). Statistical analysis of browsing behavior takes place only with your consent (see Section 8).
Payment logs: Selected payment method and transaction status. Private cryptocurrency keys are never stored on our servers.

3. Use of Data and Legal Bases

The personal and business data collected is processed on the following legal bases of Art. 6 GDPR and, where applicable, in accordance with the principles of the Swiss nFADP, for the following purposes:

Processing and managing wholesale B2B and retail orders, including payment, delivery, customs clearance, invoicing, withdrawals and customer support (performance of a contract, Art. 6(1)(b) GDPR).
Complying with Swiss fiscal, tax, and commercial accounting obligations, including agricultural traceability and anti-fraud checks (compliance with legal obligations, Art. 6(1)(c) GDPR).
Ensuring the technical stability, operational security, and cybersecurity defense of our website, preventing abuse and operating and improving the AI assistant (legitimate interests, Art. 6(1)(f) GDPR).
Sending professional communications, industry regulatory updates, newsletters, and promotional offers, and measuring website traffic with analytics cookies, where consent has been granted (consent, Art. 6(1)(a) GDPR).

4. AI Assistant (AI Mode)

Our website offers an AI assistant, available through the button at the bottom right of the pages and on the AI Mode page. It answers questions about our products, shipping, payments and wholesale conditions and helps you choose products. Please read the following information before using it.

Nature of the service: Answers are generated automatically by artificial intelligence and may contain errors or be incomplete. Please verify important information (prices, availability, legal requirements in your country) at checkout or by contacting us. The assistant does not provide medical, legal or tax advice, does not confirm that a product is legal in a specific country, and our products are not medicinal products.
What not to enter: The assistant does not ask for your email address, order number or other identification data. Please do not enter personal data, health data or other sensitive information in the chat. If you do, it will be processed as described in this section. For questions about a specific order, please contact us by email or phone.
Processing by AI providers: To generate an answer, your message, the most recent messages of the same conversation, the selected language and relevant extracts of our product catalog and knowledge base are sent from our server to an AI service provider. Our primary provider is Google (Gemini API); if the primary service is unavailable or at capacity, Mistral AI or Groq are used as fallback providers. Requests are sent by our server, so your IP address and device details are not transmitted to these providers by us. The providers process the content under their own terms and data-processing conditions; transfers outside the EU/EEA and Switzerland are described in Section 9.
Conversation storage: We do not keep an archive of conversations linked to you on our servers. The conversation history is held by the AI Mode page in your browser and sent back with each message so that the assistant can follow the discussion.
Anonymous usage statistics: To improve the assistant and our knowledge base, we record counters (number of conversations and messages, products suggested, clicks on product and cart buttons, orders attributed to the assistant) and the text of the questions asked, shortened to a maximum of 180 characters, without IP address or other identifiers. Daily records are aggregated and then deleted; aggregated summaries are kept for up to 21 days in an internal dashboard, and a periodic report is sent by email to our internal team. To prepare the report, the shortened questions may be translated by the AI providers mentioned above.
Abuse protection: To prevent abuse, the number of messages per visitor is limited. For this purpose, a technical identifier derived from your IP address (hash) is stored for 10 minutes.
Link between assistant and orders: If you reach our shop through the assistant, a technical marker is stored in your shop session and on the resulting order, only to measure how many orders originate from the assistant. No chat content is linked to your order.
Legal basis: Taking steps at your request before a contract (Art. 6(1)(b) GDPR) and our legitimate interest in operating, securing and improving the assistant and measuring its effectiveness (Art. 6(1)(f) GDPR). The assistant does not take decisions with legal effects for you. If you subscribe to the newsletter through the assistant, Section 5 applies.

5. Newsletter and Welcome Offer

By subscribing to our newsletter, through our website forms or through the AI assistant, you consent to receive commercial communications and industry market reports via email. We utilize Moosend (Sitecore) to manage our email campaigns, with data hosted on compliant European servers. Moosend tracking is activated only if you have given your consent through the cookie banner.

If a welcome discount is offered, the discount code is sent to you by email after you submit your email address. If the code has not been used about three days later, we may send you one reminder email; for this purpose we check whether the code has been used in an order placed with that email address. A record linked to a pseudonymised identifier (hash) of your email address is kept for the duration of this welcome campaign to avoid duplicate emails and to compile statistics. The welcome and reminder emails are sent from our website mail system; newsletter campaigns are sent through Moosend.

You can withdraw your consent and unsubscribe at any time using the direct link provided in each email. Unsubscribing will not affect administrative notifications regarding active or past orders.

6. Data Retention

We retain your personal data strictly for as long as necessary to fulfill the purposes for which it was gathered, in alignment with the retention periods applicable to us under Swiss law:

Invoices, commercial contracts, and transaction records are retained for ten (10) years following the close of the financial year, pursuant to the mandatory corporate record-keeping provisions of Article 958f of the Swiss Code of Obligations (CO).
Customer account and wholesale registration data are retained while the account is active and until you request deletion, subject to statutory retention duties.
Customer inquiries submitted via forms or email are retained for up to twelve (12) months after resolution, unless leading to an ongoing commercial contract.
Newsletter registration data is retained until you unsubscribe.
Bank details provided for refunds (for example for payments made in cryptocurrency) are used only to process the refund and kept only as long as needed or required by law.
AI assistant statistics are retained as described in Section 4.
Technical server log files are automatically purged within thirty (30) days.

7. Data Security

CBD Logistics implements technical and organizational security measures to protect your data against unauthorized access, loss, alteration, or disclosure. All data transmissions on our website, including shopping cart operations and B2B registrations, are protected using modern TLS (Transport Layer Security) encryption. Our IT systems, databases, and website are securely hosted on enterprise servers provided by Infomaniak Network SA (Geneva, Switzerland), with physical data centers located within Swiss territory.

8. Cookies and Tracking Technologies

Our site uses cookies and similar technologies to ensure security, improve navigation, and evaluate technical performance. We manage cookie consent through an automated consent banner that prevents non-essential cookies from firing without prior consent. Your consent choice is stored for up to 365 days:

Strictly Necessary Cookies: Essential for shopping cart functionality, user sessions, B2B account login, currency selection, system security and storing your consent choice.
Functional / Preference Cookies: Store interface settings, such as language or display preferences.
Statistical / Analytical Cookies (GA4): Deployed via Google Tag Manager (container GTM-MCT5FKTV) to collect anonymized website traffic statistics without tracking individuals across external platforms. They are activated only with your consent. We do not deploy Meta Pixel or third-party behavioral advertising remarketing trackers.
Newsletter tracking (Moosend): Activated only with your consent, as described in Section 5.

You can manage, configure, or revoke your cookie choices at any time via the on-site consent banner or through your browser settings.

In addition, to display and operate the website we use the following technical services, which may receive your IP address and device data when pages are loaded:

GTranslate: Automatic translation of the website into English, German, French and Italian. When you select a language, the page content is processed by the translation service and a language preference is stored. The brand and product names are excluded from translation.
Google Fonts: Web fonts loaded from Google servers.
Font Awesome: Icons loaded from the Font Awesome content delivery network.
Google reCAPTCHA: Protects our forms against spam and abuse. reCAPTCHA analyzes technical data such as IP address, browser data and interaction behavior. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

9. Data Transfers

Our company is based in Switzerland, which the European Commission recognizes as providing an adequate level of data protection. Your data is therefore hosted and processed primarily in Switzerland and may be transmitted to your country of destination for delivery and customs purposes. Where service providers process data in third countries (such as Google analytics, Google services and the AI provider Groq in the United States), transfers are secured through recognized Standard Contractual Clauses (SCCs), adequacy frameworks where available, and robust technical safeguards. Mistral AI processes data in the European Union.

10. Third-Party Data Processing and External Service Providers

We utilize trusted external service providers bound by contractual confidentiality and data processing agreements, strictly to the extent required to execute their functions:

Payment: NOWPayments (cryptocurrency settlement). For bank transfers, payments are received on our PostFinance corporate account.
Logistics and Freight Couriers: Swiss Post, DHL and UPS, depending on the destination and the service selected. Carriers receive your delivery details and, where required, the information needed for customs clearance, and may share it with the customs authorities of the destination country.
AI Assistant: Google (Gemini API), Mistral AI and Groq, as described in Section 4.
Newsletter: Moosend (Sitecore), as described in Section 5.
Analytics: Google Analytics 4 and Google Tag Manager, only with consent.
Website tools: GTranslate, Google Fonts, Font Awesome, Google reCAPTCHA and Google Maps (interactive location display on the Contacts page).
Customer communication: Email, telephone and, if you choose to contact us through the link on our website, WhatsApp (Meta Platforms Ireland Ltd.).
Hosting: Infomaniak Network SA (Geneva, Switzerland).

11. Your Rights

Under the GDPR and, where applicable, the Swiss nFADP, you have the right to:

Request access and obtain confirmation and a copy of your personal data processed by us.
Request the correction of inaccurate or outdated data.
Request the deletion of your personal data, provided statutory retention duties (e.g., 10-year accounting rules under Swiss CO) do not apply.
Object to or restrict the processing of your data for direct marketing or legitimate business interests.
Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Request data portability to receive your personal data in a structured, commonly used format.
Lodge a complaint with a supervisory authority: you may contact the data protection authority of your country of residence, your place of work or the place of the alleged infringement, or the competent Swiss authority, the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, CH-3003 Bern, Switzerland (www.edoeb.admin.ch).

To exercise any of these rights, please contact our team at info@cbdlogistics.eu specifying “Attn: Data Protection” in the subject line.

12. Links to External Sites

Our site may contain links to external third-party websites, social media profiles (Instagram, YouTube), WhatsApp or official Swiss and European authorities. We assume no responsibility for the content, privacy practices, or policies of third-party platforms and encourage you to review their respective privacy statements.

13. Changes to the Privacy Policy

CBD Logistics reserves the right to amend or update this Privacy Policy at any time to reflect legal, regulatory, or technical developments. Amendments become effective upon publication on this page. Significant revisions will be notified via our website or directly to registered B2B account holders.

14. Applicable Law and Jurisdiction

This Privacy Policy and all related matters shall be governed by Swiss law, excluding conflict-of-law principles. For business-to-business relationships, the exclusive place of jurisdiction is the Regionalgericht Moesa (Canton of Grisons), Switzerland, subject to any mandatory legal provisions. For consumers, nothing in this Privacy Policy excludes or restricts any mandatory data protection rights, applicable law or jurisdiction protections that cannot lawfully be excluded, including the right to bring proceedings before the courts of the place of domicile where mandatory law so provides.

For further information or questions regarding this Privacy Policy, please contact our team at info@cbdlogistics.eu (Attn: Data Protection) or by phone at +41 91 830 11 14 (Monday to Friday, 8:30–12:30 and 13:30–18:30).

Last updated: October 27, 2026