PRIVACY POLICY

1. INTRODUCTION

Dr. Greenthumb's ("Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or visit our retail locations.

As a licensed cannabis retailer operating in California and Illinois, we are subject to state and local regulations governing the collection and handling of customer information. We comply with all applicable privacy laws, including the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

3. INFORMATION WE COLLECT

3.1 Information You Provide

• Identity Verification: Name, date of birth, government-issued ID number, and photo ID (as required by state cannabis regulations)
• Contact Information: Email address, phone number, mailing address
• Account Information: Username, password, and account preferences
• Transaction Data: Purchase history, payment information, and loyalty program activity
• Communications: Messages you send us, customer service inquiries, and survey responses

3.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, time spent on pages, links clicked, referring URLs
• Location Data: General geographic location based on IP address (we do not collect precise GPS location without consent)
• Cookies and Tracking: See Section 7 for details on our cookie practices

3.3 Information from Third Parties

• Identity verification services
• Payment processors
• Marketing partners (with your consent)
• State cannabis tracking systems (as required by law)

4. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

• Regulatory Compliance: To verify your age and identity as required by state cannabis laws, and to report required information to state tracking systems
• Order Processing: To process transactions, fulfill orders, and manage your account
• Customer Service: To respond to your inquiries and provide support
• Personalization: To customize your experience and provide product recommendations
• Marketing: To send promotional communications (with your consent)
• Analytics: To analyze usage patterns and improve our services
• Security: To detect and prevent fraud, unauthorized access, and other illegal activities
• Legal Obligations: To comply with applicable laws and regulations

5. INFORMATION SHARING AND DISCLOSURE

We may share your information in the following circumstances:

• Regulatory Authorities: We are required by law to report certain transaction data to state cannabis regulatory agencies and tracking systems (such as METRC in California)
• Service Providers: Third parties who perform services on our behalf (payment processing, email delivery, analytics)
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you have given us permission to share your information

We do not sell your personal information to third parties for their marketing purposes.

6. DATA RETENTION

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

Regulatory Requirements: California cannabis regulations require us to retain certain transaction records for a minimum of seven (7) years. Illinois regulations have similar requirements. We will retain this information as required by applicable law.

7. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to:

• Remember your preferences and settings
• Authenticate your identity and maintain your session
• Analyze website traffic and usage patterns
• Deliver targeted advertising (with your consent)

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our website, including age verification features.

8. YOUR PRIVACY RIGHTS

8.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and share
• Request deletion of your personal information (subject to legal exceptions)
• Opt-out of the sale or sharing of your personal information
• Correct inaccurate personal information
• Limit the use of sensitive personal information
• Not be discriminated against for exercising your privacy rights

8.2 European Union Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Right of Access: You can request a copy of the personal data we hold about you
• Right to Rectification: You can request that we correct any inaccurate or incomplete personal data
• Right to Erasure: You can request that we delete your personal data ("right to be forgotten"), subject to legal retention requirements
• Right to Restrict Processing: You can request that we limit how we use your personal data
• Right to Data Portability: You can request a copy of your data in a structured, machine-readable format
• Right to Object: You can object to our processing of your personal data for direct marketing or based on legitimate interests
• Right to Withdraw Consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority

Legal Basis for Processing: We process your personal data based on: (a) your consent, (b) performance of a contract, (c) compliance with legal obligations, or (d) our legitimate interests (such as fraud prevention and website security).

International Data Transfers: Your data may be transferred to and processed in the United States. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

8.3 Illinois Residents

Illinois residents may have additional rights under state law. Please contact us to learn more about your rights.

8.4 Exercising Your Rights

To exercise any of these rights, please contact us using the information in Section 11. We will verify your identity before processing your request. For GDPR requests, we will respond within one month. For CCPA requests, we will respond within 45 days.

9. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and audits
• Employee training on data protection

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

10. THIRD-PARTY LINKS

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

11. CONTACT US

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on our website and updating the "Last Updated" date. Your continued use of our services after any changes indicates your acceptance of the updated Privacy Policy.