Only the German version is legally binding.
Privacy policy
cannabis-transparent.de
1. Controller
The controller responsible for data processing on this platform within the meaning of the GDPR is: Cannabis-Transparent UG (haftungsbeschränkt) Holzmarktstraße 66, 10179 Berlin, Germany Represented by the managing director Leonard Metsch E-mail: kontakt@cannabis-transparent.de Commercial register: Amtsgericht Charlottenburg, HRB 288999 B
2. Data protection officer
Davor Vukelic E-mail: datenschutz@cannabis-transparent.de
3. Principle of data minimisation
The platform is designed for data economy. Reviews can be submitted without registration. Only structured quality and sensory information is published — never a link to your identity. Free-text feedback is not published.
4. Hosting and technical infrastructure
We use the following service providers as processors (Art. 28 GDPR): • Vercel Inc. (provision of the web application) — data may be transferred to the USA in this context; the transfer takes place on the basis of the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. • Supabase (database, authentication, file storage) — storage within the EU. The agreements required under data protection law are in place with all processors used. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation).
5. Server log data
When the platform is accessed, technically necessary access data is processed (IP address, time, page accessed, user agent). This data serves operational security and error analysis and is deleted or anonymised after 14 days at the latest. Legal basis: Art. 6(1)(f) GDPR.
6. Cookie-free audience measurement
We use our own cookie-free audience measurement: page views and events are counted without cookies, without storing IP addresses and without creating user profiles. Do Not Track signals are respected. Since neither end devices are accessed nor personal identifiers stored, no consent is required for this (§ 25 TDDDG); the legal basis for the statistical analysis is Art. 6(1)(f) GDPR.
7. Registration and user account
a) Testers without an account: no registration is required. Reviews are stored without a user account and are merely linked to a random, non-traceable identifier. No contact details are collected. b) Registered and verified testers: upon registration we process your username, e-mail address, password (encrypted), year of birth and gender — for verified testers, additionally your real name, solely for verification purposes. Your real name is stored only in the authentication metadata and is never linked to published reviews or to data shared within the research cooperation. Year of birth and gender serve scientific analysis in aggregated, pseudonymised form. Legal basis: Art. 6(1)(b) GDPR. c) Professional accounts (doctors, pharmacies): healthcare-professional status is verified via the DocCheck service (DocCheck Community GmbH); in this process we receive confirmation of healthcare-professional status. Legal basis: Art. 6(1)(b) GDPR. d) Recovery code: when the account is created, a one-time recovery code is generated that enables password recovery without storing additional contact details.
8. Review data
The structured quality, sensory and product information recorded in the review sections is stored and published in pseudonymised form. Private free-text feedback is not published and is not shared within the research cooperation. Legal basis: Art. 6(1)(a) and (b) GDPR.
9. Health-related information (Art. 9 GDPR)
We process health-related information (e.g. effect, side effects, indication, effect on symptoms, medical history of verified testers) exclusively on the basis of your express, separate consent (Art. 9(2)(a) GDPR). Consent is obtained granularly for each purpose — separately for pseudonymous publication and for sharing with healthcare professionals and the research cooperation — is voluntary and can be withdrawn at any time with effect for the future. Without consent, the respective information is not stored.
10. Photo and video uploads; text recognition (OCR)
For a review, you can optionally upload product photos and a short video. Publication takes place only with separate consent. Before publication, all metadata (including location data) is removed; for videos, the audio track is also removed and recognisable faces are blurred. All media are editorially reviewed before publication. Media are stored in storage located within the EU. For the automatic recognition of product and label information, you can upload a photo of the package. The package photo is transmitted to Mistral AI SAS (EU) solely for automatic text recognition and is not stored by us; processing by Mistral AI (Mistral AI SAS, France) takes place within the EU (optical character recognition). Product, manufacturer and batch information is extracted in this process; personal data on the label is not transferred into the product data.
11. Complaints and product warning reports (ChargenAlarm)
Reports of product defects are initially pseudonymised; the description of the defect, batch information and the uploaded photos (label, packaging, product) are processed for internal review (triage). If the suspicion is confirmed and you expressly consent, your contact details are passed on to the manufacturer and/or pharmacy in a second step for handling; you will be informed of this in advance. Without this separate consent, the report remains pseudonymised. Legal bases: Art. 6(1)(a), (b) and (f) GDPR.
12. Newsletter
When you subscribe to the newsletter (product warnings & recalls, platform updates), we process your e-mail address via the mailing service provider Brevo (Sendinblue GmbH, Germany). Mailings are only sent after confirmation via the double opt-in procedure. You can cancel your subscription at any time via the unsubscribe link. Legal basis: Art. 6(1)(a) GDPR.
13. Sharing within the research cooperation (HU Berlin)
It is planned to share selected review data within our research cooperation with Humboldt-Universität zu Berlin. Data is shared exclusively in pseudonymised and coarsened form for a restricted research view; real names, e-mail addresses, user identifiers or free texts are not transmitted. HU Berlin cannot trace the data back to individual persons. Data will only be shared once an agreement on joint controllership (Art. 26 GDPR) has been concluded; its essential content will be made available on request. Legal bases: Art. 6(1)(a), Art. 9(2)(a) GDPR.
14. Storage period
We store account data for the duration of registration. Server logs: see section 5. Unconfirmed newsletter subscriptions are deleted after 72 hours. Photos from complaint reports in which the suspicion is not confirmed are deleted after 90 days. Otherwise, we delete personal data as soon as the respective purpose of processing no longer applies and no statutory retention obligations preclude deletion.
15. Account deletion
When you delete your account, your personal data (e-mail, name, demographics, uploaded photos) is permanently deleted. Reviews already submitted are retained in anonymised form: the link to your person is irrevocably removed so that re-identification is no longer possible (research data without personal reference).
16. Your rights
You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future. Please send requests to kontakt@cannabis-transparent.de or to the data protection officer (section 2). You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin.
17. Changes to this privacy policy
We will adapt this privacy policy if the data processing or the legal situation changes. The version currently published on the platform applies.
Last updated: July 2026 · Cannabis-Transparent UG (haftungsbeschränkt)