This Privacy Policy describes how your personal information is collected, used, and shared when you visit or make a purchase from https://cannabistcompany.com, https://www.gocannabist.com, https://www.cannabistmerch.com or other websites and mobile applications owned or operated by The Cannabist Company Holdings Inc. ("The Cannabist Company") or its U.S. subsidiaries (collectively the “Sites”). This Privacy Policy and the Sites are intended for a U.S. audience.
Certain uses or disclosure of personal information may be governed by state law and other privacy notices. Please see the information below regarding California, Illinois, and Florida.
For purpose of this Privacy Policy “personal information” means information that may identify you as an individual. This includes Device Information and Order Information.
When you visit the Sites, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Sites, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Sites, and information about how you interact with the Sites. We refer to this automatically-collected information as “Device Information.”
We collect Device Information using the following technologies:
“Cookies” are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.
“Log files” track actions occurring on the Sites, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
Additionally, when you make a purchase, attempt to make a purchase or request information from us through the Sites, we collect certain information from you, including your name, billing address, shipping address, payment information (including credit card numbers and/or bank account information, email address, and phone number. We refer to this information as “Order Information.”
We use the Order Information that we collect generally to fulfill any orders placed through the Sites (including processing your payment information, arranging for shipping, and providing you with invoices and/or order confirmations). Additionally, we use this Order Information to:
Communicate with you;
Screen our orders for potential risk or fraud; and
When in line with your specific opt-in, provide you with information or advertising relating to our products or services.
We use the Device Information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our Sites (for example, by generating analytics about how our customers browse and interact with the Sites, and to assess the success of our marketing and advertising campaigns).
We share your personal information with third parties to help us use your personal information, as described above. For example, we use Jane Technologies, Inc. to power our website reservation system. You can read more about how Jane Technologies uses your personal information here: https://www.iheartjane.com/privacy-policy.
We use Alpine IQ to manage our loyalty and rewards programs. You can read more about how Alpine IQ uses your personal information here: https://alpineiq.com/privacy.html.
We also use Google Analytics to help us understand how our customers use the Sites. You can read more about how Google uses your personal information here: https://www.google.com/intl/en/policies/privacy/.
You can also opt-out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.
We also use Posthog, a solution that aggregates usage and frequency data to improve user experience. Statistics created are anonymous.
We use Sweed Inc. to power the point of sale, website reservation system, and loyalty rewards programs at some of our locations. You can read more about how Sweed Inc. uses your personal information here: https://sweedpos.com/privacy-policy
Finally, we may also share your personal information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.
We do not use your personal information to provide you with targeted advertisements or marketing communications unless you have specifically opted in to receive them. We do not process your personal information for profiling purposes.
We do not sell your personal information.
The Sites are not intended for individuals under the age of 21.
Please note that we do not alter our Sites‘ data collection and use practices when we see a Do Not Track signal from your browser.
You may always direct us not to share your personal information with third parties, not to use your personal information to provide you with information or offers, or not to send you communications by contacting us by: (i) email at privacy@cannabistcompany.com or (ii) following the removal instructions in the communication that you receive. Your opt-out request will be processed within 30 days of the date on which we receive it.
If you wish to verify, correct, update, access, or delete any of your personal information collected through the Sites, you may contact us by mail at the address below or e-mail at privacy@cannabistcompany.com. In accordance with our routine record keeping, we may delete certain records that contain personal information you have submitted through the Sites. We are under no obligation to store such personal information indefinitely and disclaim any liability arising out of, or related to, the destruction of such personal information. In addition, you should be aware that it is not always possible to completely remove or delete all your information from our databases without some residual data because of backups and other reasons.
When you place an order through the Sites, we will maintain your Order Information for our records unless and until you ask us to delete this information.
We use certain reasonable security measures to help protect your personal information or other information which we may obtain from your use of the Sites. However, no electronic data transmission or storage of information can be guaranteed to be 100% secure. Please note that we cannot ensure or warrant the security of any information you transmit to us or other information which we may obtain from your use of the Sites, and you use the Sites and provide us with your information at your own risk.
The Sites may contain links to other sites that we do not own or operate. This includes links from service providers, advertisers, sponsors and partners that may use our logo(s) as part of a co-branding agreement. We do not control, recommend or endorse, and are not responsible for these sites or their content, products, services or privacy policies or practices. These other websites may send their own cookies to your Device, they may independently collect data or solicit personal information and may or may not have their own published privacy policies. You should also independently assess the authenticity of any site which appears or claims that it is one of our sites (including those linked to through an email or social networking page).
California residents have certain rights regarding our collection and use of Personal Information under the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (CPRA), and other California privacy laws. For purposes of this “California Residents” Section (this “Section”) the terms “Personal Information” and “Sensitive Personal Information” have the same meanings as defined under Cal. Civ. Code 1798.140(v) and (ae). To the extent that any other provision of this Privacy Policy conflicts with a provision of this Section, the provision in this Section controls as to California residents.
Collection and Purposes for Use of Personal Information
This section describes, for the past twelve months preceding the date this Privacy Policy was updated, (i) the categories of Personal Information collected and (ii) the business or commercial purpose(s) for which the Personal Information will be used. This section also serves as our Notice at Collection of Personal Information.
Categories of Personal Information
(i.) Identifiers, also referred to as “Order Information” above, including name, billing address, shipping address, payment information, email address, telephone number, IP address and professional or employment-related information.
(ii.) Device information including information about your web browser, IP address, time zone, cookies installed on your device, web pages and products viewed, websites or search terms that referred you to the Sites, and information about how you interact with the Sites.
(iii.) Sensory Data such as audio and voicemail messages.
(iv.) Driver’s license or other state identification card.
Business or Commercial Purposes for Use of Personal Information
(i.) Communicate with customers and others.
(ii.) Screen orders for potential risk or fraud.
(iii.) Provide information relating to our products or services.
(iv.) Employment-related.
(v.) Improve and optimize our Sites.
(vi.) Generate analytics about how customers browse and interact with our Sites.
(vii.) Detecting security incidents and protecting against malicious, fraudulent, or illegal activity.
(viii.) Verify consumers’ identity and/or age.
No Sale of Personal Information
We do not sell Personal Information of California residents.
No Sharing of Personal Information for Cross-Context Behavioral Advertising
We do not share Personal Information of California residents with third parties for purposes of cross-context behavioral advertising.
No Use or Disclosure of Sensitive Personal Information Other Than for Authorized Business Purposes
We do not use or share Sensitive Personal Information of California residents other than to verify their identity and age, which is an authorized business purpose under Section 1798.140(e).
Assistance for the Disabled
Alternative formats of this Privacy Policy and Notice of Collection of Personal Information are available to individuals with a disability through use of the Accessibility Adjustments icon available on the Sites.
Retention
We will retain each category of Personal Information described above for so long as necessary to accomplish the Business or Commercial Purpose for which it was collected, as described above. We may retain such Personal Information longer where so required by any applicable law.
Rights:
California residents may:
Request information about:
(i) the categories and specific pieces of Personal Information we have collected about them;
(ii) the categories of sources from which we have collected their Personal Information;
(iii) the business or commercial purpose for collecting or selling their Personal Information;
(iv) the categories of Personal Information we have sold about them; and
(v) the categories of third parties with whom we have shared, disclosed for a business purpose, or sold their Personal Information, and which categories of Personal Information we have sold to which categories of third parties.
We will not discriminate against California residents for exercising their rights under the CCPA or CPRA. Consistent with Section 1798.125 of the CCPA, we may charge California Residents different prices, or provide different levels or quality of goods or services, if the difference is reasonably related to the value of your data. We may also offer financial incentives for the collection, sale, or deletion of your Personal Information.
Requests for Information
California residents may request that we provide certain information about our use of their Personal Information, as specified above. Upon receiving a request from a California resident, we will take reasonable steps to verify the person‘s identity. We will respond to a verified person's request by: (a) providing the requested information, or (b) explaining to the requestor why the CCPA or CPRA does not require us to provide the requested information.
We will respond to requests for information within 45 days. If a response requires additional time, we will notify the requestor of the basis for the delay and may extend our response period up to an additional 90 days. If the CCPA or CPRA requires us to provide the information requested to the person, we will provide the information covering the 12 months preceding the request, free of charge, and in a readily useable portable format. We have no obligation to provide Personal Information to a California resident more than twice in a 12-month period. If a request or series of requests are manifestly unfounded or excessive, we may charge a reasonable fee for processing the request(s) or may refuse to process the request(s).
Requests to Opt Out
California users may opt out of the sale of their Personal Information and the sharing of their Personal Information for cross-context behavioral advertising. However, as mentioned above, we do not sell Personal Information of California residents or share Personal Information of California residents for cross-context behavioral advertising.
Requests to Delete
California residents may request that we delete their Personal Information. Upon receiving a request from a California resident, we will take reasonable steps to verify the person’s identity. We will respond to a verified person’s request by: (a) deleting their Personal Information and, if applicable, directing our service providers to delete their Personal Information; or (ii) explaining to the requestor why the CCPA or CPRA does not require us to delete their Personal Information.
If a request or series of requests are manifestly unfounded or excessive, we may charge a reasonable fee for processing the request(s) or may refuse to process the request(s).
Submitting a Request or Inquiry
California residents or their authorized agents can submit a request or inquiry by contacting our Privacy Officer via email at privacy@cannabistcompany.com, by toll-free telephone at (888) 880-3001, or via U.S. mail at the mailing address below.
If you are a medical cannabis patient in Illinois, personal information about you that constitutes Protected Health Information (PHI) pursuant to the Health Insurance Portability and Accountability Act (HIPAA) is governed by our Notice of Privacy Practices for Illinois Medical Cannabis. You can access this Notice at https://cannabistcompany.com/notice-of-privacy-practices/
If you are a medical cannabis patient or caregiver in Florida, your personal identifying information will remain confidential in compliance with Florida Statutes and applicable Florida Department of Health regulations. Personal identifying information collected during the website purchasing process will be utilized only for purposes of website purchasing, and not for any other purposes. Personal identifying information means data which includes, but is not limited to, the patient’s or caregiver’s name, social security number, email address, address, date of birth, photograph, and telephone number.
We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons.
This policy was last updated on February 23, 2024.
For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at privacy@cannabistcompany.com or by mail at:
The Cannabist Company Holdings Inc.
Attn: Privacy Officer/Legal
321 Billerica Road, Suite 204
Chelmsford, MA 01824