Effective Date: October 12, 2026
Last Updated: October 12, 2026
At Verdara Hemp UK ("we," "our," or "us"), we are committed to respecting your privacy and protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and safeguard your personal information when you visit our website, purchase our products, or interact with our services.
This document complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Notice: Please review this policy carefully. By using our website or purchasing our products, you acknowledge the terms outlined in this document.
1. Who We Are (Data Controller)
Verdara Hemp UK operates as the Data Controller responsible for your personal data.
Company Name: Verdara Hemp UK Ltd
Company Registration Number: [Insert UK Companies House Number]
Registered Address: [Insert Street Address, City, Postcode, United Kingdom]
Data Protection Officer / Contact Email: [privacy@verdarahemp.co.uk]
Telephone Number: [Insert Phone Number]
2. Information We Collect
We collect personal data only where necessary to deliver our services, process orders, maintain site security, and provide relevant communications.
A. Data You Provide directly
Identity Data: Full name, age/date of birth (to verify legal age compliance for CBD/hemp products).
Contact Data: Billing address, delivery address, email address, and phone number.
Transaction Data: Details of orders, payments, subscriptions, and purchase history.
Account Data: Username, password, order history, and account settings (if an account is created).
Communication Data: Inquiries, feedback, product reviews, or customer service communications sent to us.
B. Data Collected Automatically
Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting, browser plug-in types, operating system, and platform.
Usage Data: Pages viewed, time spent on pages, search queries, referral URLs, and interactions with website features.
Cookie & Tracking Data: Information gathered through cookies and web beacons (see Section 8).
C. Sensitive Payment Data
We do not collect or store full payment card details on our servers. Payment card transactions are processed through tokenised encryption by our PCI-DSS compliant third-party payment gateways (e.g., Stripe, Viva Wallet, Klarna).
3. Lawful Basis for Processing Data
Under the UK GDPR, we process your personal data based on the following legal grounds:
| Purpose of Processing | Data Types | Lawful Basis (UK GDPR) |
| Fulfilling Orders & Delivery | Identity, Contact, Transaction | Performance of a Contract: Required to deliver your order and process payments. |
| Account Management | Identity, Account, Contact | Performance of a Contract: Necessary to provide user portal services. |
| Age Verification | Identity | Legal Obligation: Compliance with age restrictions for hemp/CBD sales. |
| Customer Support | Contact, Communication | Legitimate Interests: Responding to inquiries and improving service. |
| Direct Email Marketing | Identity, Contact | Consent: You have opted in to receive marketing communications. |
| Site Analytics & Optimization | Technical, Usage | Consent / Legitimate Interests: Analyzing usage to improve website features. |
| Accounting & Tax Reporting | Identity, Transaction | Legal Obligation: Meeting UK statutory tax and financial keeping duties. |
| Fraud Prevention & Security | Technical, Transaction | Legitimate Interests / Legal Obligation: Preventing fraud and securing systems. |
4. Third-Party Data Processors
We share personal data with trusted third-party service providers who assist in operating our business. All processors are contractually required to handle data strictly in accordance with UK GDPR.
E-Commerce & Hosting: [Shopify / WooCommerce / Magento] (Website infrastructure and hosting).
Payment Services: [Stripe / PayPal / Viva Wallet] (Secure payment processing).
Courier & Logistics: [Royal Mail / DPD / DHL] (Shipping and order tracking).
Marketing & Email: [Klaviyo / Mailchimp] (Newsletter and transactional automated emails).
Analytics & Performance: [Google Analytics / Hotjar] (Performance monitoring and audience insights).
Age Verification: [AgeChecked / VerifyMyAge] (Verifying legal age requirements).
5. International Data Transfers
Some of our third-party service providers are located outside the United Kingdom. Whenever we transfer your data internationally, we ensure a similar degree of protection is afforded by ensuring at least one of the following safeguards is implemented:
Adequacy Regulations: The target country is approved by the UK Government as providing an adequate level of data protection.
Standard Contractual Clauses (SCCs): We use approved International Data Transfer Agreements (IDTAs) or UK Addendums to Standard Contractual Clauses with non-UK service providers.
6. Retention of Data
We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.
Order & Financial Records: Retained for 6 years following the tax year end to comply with UK HM Revenue & Customs (HMRC) legal requirements.
Marketing Preferences: Retained until you opt out or withdraw consent.
Customer Support Enquiries: Retained for 2 years following resolution.
Inactive User Accounts: Accounts dormant for 3 consecutive years are deleted or anonymised.
7. Data Security Measures
We have implemented technical and organizational security measures to prevent your personal data from being accidentally lost, altered, accessed, or disclosed without authorization:
Encryption: Standard 256-bit Secure Socket Layer (SSL / TLS) encryption across all site pages.
Access Control: Restricted access to personal data to staff and contractors on a strict need-to-know basis.
System Monitoring: Regular vulnerability scans, secure servers, and firewall configurations.
8. Cookies and Tracking Technologies
Our website uses cookies to distinguish you from other users, optimize browsing performance, and analyze site traffic.
Categories of Cookies We Use
Strictly Necessary Cookies: Essential for the website to function (e.g., managing your shopping basket and account authentication).
Performance & Analytics Cookies: Help us understand how visitors interact with the website (e.g., Google Analytics).
Functional Cookies: Remember choices you make (e.g., language or region settings).
Targeting / Advertising Cookies: Used to deliver relevant advertisements and track campaign efficiency.
Managing Cookie Preferences
When you first visit our site, you can manage your preferences via our Cookie Consent Banner. You can change your preferences or disable cookies through your web browser settings at any time. Note that disabling essential cookies may affect website functionality.
9. Your Rights Under UK Data Protection Law
Under the UK GDPR, you hold specific rights regarding your personal data:
Right of Access: Request a copy of the personal data we hold about you (Subject Access Request).
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your data where no overriding legal basis requires processing.
Right to Restrict Processing: Request suspension of processing under specific circumstances.
Right to Data Portability: Receive your data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent: Withdraw marketing consent at any time without affecting prior processing legality.
To exercise any of these rights, contact us at [privacy@verdarahemp.co.uk]. We aim to respond to all legitimate requests within one calendar month.
10. Children's Privacy
Our website and CBD/hemp products are strictly intended for individuals aged 18 and older. We do not knowingly collect or solicit personal data from children. If we discover that a child under 18 has provided personal information, we will delete it immediately.
11. How to Contact Us or Lodge a Complaint
If you have questions about this policy or wish to exercise your rights, please reach out to us:
Email: privacy@verdarahemp.co.uk
Postal Address: Verdara Hemp UK Ltd, United Kingdom
You also have the right to lodge a complaint with the UK supervisory authority for data protection:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk
12. Changes to This Privacy Policy
We may update this policy periodically to reflect changes in our business practices or regulatory legal obligations. Any updates will be published on this page with an updated "Last Updated" date.