{"id":127,"date":"2026-06-08T06:49:58","date_gmt":"2026-06-08T06:49:58","guid":{"rendered":"https:\/\/mehmeez.com\/hazecbd\/?page_id=127"},"modified":"2026-07-01T18:49:53","modified_gmt":"2026-07-01T18:49:53","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/mehmeez.com\/hazecbd\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><p>[vc_row woodmart_stretch_content=&#8221;section-stretch-content&#8221; woodmart_css_id=&#8221;6a2665f82fea3&#8243; responsive_spacing=&#8221;eyJwYXJhbV90eXBlIjoid29vZG1hcnRfcmVzcG9uc2l2ZV9zcGFjaW5nIiwic2VsZWN0b3JfaWQiOiI2YTI2NjVmODJmZWEzIiwic2hvcnRjb2RlIjoidmNfcm93IiwiZGF0YSI6eyJ0YWJsZXQiOnt9LCJtb2JpbGUiOnt9fX0=&#8221; mobile_bg_img_hidden=&#8221;no&#8221; tablet_bg_img_hidden=&#8221;no&#8221; woodmart_parallax=&#8221;0&#8243; woodmart_gradient_switch=&#8221;no&#8221; woodmart_box_shadow=&#8221;no&#8221; wd_z_index=&#8221;no&#8221; woodmart_disable_overflow=&#8221;0&#8243; row_reverse_mobile=&#8221;0&#8243; row_reverse_tablet=&#8221;0&#8243;][vc_column]\t\t<div class=\"haze-contact haze-contact-breadcrumb-wrap\">\r\n\t\t\t<div class=\"container\">\r\n\t\t\t\t<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\">\r\n\t\t\t\t\t<a href=\"\/\">Home<\/a>\r\n\t\t\t\t\t<span class=\"breadcrumb-sep\">\/<\/span>\r\n\t\t\t\t\t<span>Privacy Policy<\/span>\r\n\t\t\t\t<\/nav>\r\n\t\t\t<\/div>\r\n\t\t<\/div>\r\n\t\t[\/vc_column][\/vc_row][vc_row woodmart_stretch_content=&#8221;section-stretch-content&#8221; woodmart_css_id=&#8221;6a2665f82fea3&#8243; responsive_spacing=&#8221;eyJwYXJhbV90eXBlIjoid29vZG1hcnRfcmVzcG9uc2l2ZV9zcGFjaW5nIiwic2VsZWN0b3JfaWQiOiI2YTI2NjVmODJmZWEzIiwic2hvcnRjb2RlIjoidmNfcm93IiwiZGF0YSI6eyJ0YWJsZXQiOnt9LCJtb2JpbGUiOnt9fX0=&#8221; mobile_bg_img_hidden=&#8221;no&#8221; tablet_bg_img_hidden=&#8221;no&#8221; woodmart_parallax=&#8221;0&#8243; woodmart_gradient_switch=&#8221;no&#8221; woodmart_box_shadow=&#8221;no&#8221; wd_z_index=&#8221;no&#8221; woodmart_disable_overflow=&#8221;0&#8243; row_reverse_mobile=&#8221;0&#8243; row_reverse_tablet=&#8221;0&#8243;][vc_column]<div class=\"haze-policy-page\"><div class=\"policy-container\"><header class=\"page-header\"><span class=\"page-eyebrow\"><svg width=\"22\" height=\"22\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><path d=\"M12 2 4 5v6c0 5.5 3.8 10.7 8 12 4.2-1.3 8-6.5 8-12V5z\"\/><\/svg>Legal \u00b7 Privacy<\/span><h1>Privacy policy<\/h1><p class=\"page-lead\">How we collect, use, and protect your personal data. Your rights under UK GDPR and how to exercise them.<\/p><div class=\"page-meta\"><span>Last updated: <strong>20 May 2026<\/strong><\/span><span>\u00b7<\/span><span>Effective from: <strong>20 May 2026<\/strong><\/span><\/div><\/header><\/div><\/div>[\/vc_column][\/vc_row][vc_row woodmart_stretch_content=&#8221;section-stretch-content&#8221; woodmart_css_id=&#8221;6a2665f82fea3&#8243; responsive_spacing=&#8221;eyJwYXJhbV90eXBlIjoid29vZG1hcnRfcmVzcG9uc2l2ZV9zcGFjaW5nIiwic2VsZWN0b3JfaWQiOiI2YTI2NjVmODJmZWEzIiwic2hvcnRjb2RlIjoidmNfcm93IiwiZGF0YSI6eyJ0YWJsZXQiOnt9LCJtb2JpbGUiOnt9fX0=&#8221; mobile_bg_img_hidden=&#8221;no&#8221; tablet_bg_img_hidden=&#8221;no&#8221; woodmart_parallax=&#8221;0&#8243; woodmart_gradient_switch=&#8221;no&#8221; woodmart_box_shadow=&#8221;no&#8221; wd_z_index=&#8221;no&#8221; woodmart_disable_overflow=&#8221;0&#8243; row_reverse_mobile=&#8221;0&#8243; row_reverse_tablet=&#8221;0&#8243;][vc_column]<section class=\"haze-policy-doc\"><aside class=\"doc-toc\"><div class=\"doc-toc-title\">On this page<\/div><a href=\"#controls\">Data controller<\/a><a href=\"#collect\">What we collect<\/a><a href=\"#personal\">How we use it<\/a><a href=\"#processing\">Lawful basis<\/a><a href=\"#share\">Who we share with<\/a><a href=\"#keep\">How long we keep it<\/a><a href=\"#rights\">Your rights<\/a><a href=\"#cookies\">Cookies<\/a><a href=\"#international\">International transfers<\/a><a href=\"#protect\">Security<\/a><a href=\"#childrens\">Children<\/a><a href=\"#changes\">Policy changes<\/a><a href=\"#complaints\">Contact &amp; complaints<\/a><\/aside><article class=\"doc-body\"><div class=\"callout callout-legal\"><div class=\"callout-title\">\u2696\ufe0f Legal review required<\/div><p>We collect the personal data you give us when you shop, sign up, or contact us. We use it to fulfil your orders, provide customer support, and send marketing you&#8217;ve opted into. We don&#8217;t sell your data. You have full rights under UK GDPR to access, correct, or delete your data \u2014 contact us at privacy@hazecbd.co.uk.<\/p>\n<\/div><div class=\"doc-summary\"><div class=\"doc-summary-title\">In short<\/div><p>We collect the personal data you give us when you shop, sign up, or contact us. We use it to fulfil your orders, provide customer support, and send marketing you&#8217;ve opted into. We don&#8217;t sell your data. You have full rights under UK GDPR to access, correct, or delete your data \u2014 contact us at privacy@hazecbd.co.uk.<\/p>\n<\/div><h2 id=\"controls\">Who controls your data<\/h2><p>For the purposes of UK GDPR and the Data Protection Act 2018, the data controller is:<\/p>\n<ul>\n<li><strong>Haze CBD<\/strong>\u00a0<span class=\"tag tag-review\">REVIEW: confirm legal entity name<\/span><\/li>\n<li><strong>Registered office:<\/strong>\u00a015 Whetley Lane, Bradford BD8 9EH<\/li>\n<li><strong>Companies House No:<\/strong>\u00a0<span class=\"placeholder\">[Companies House number]<\/span>\u00a0<span class=\"tag tag-review\">REVIEW<\/span><\/li>\n<li><strong>Phone:<\/strong>\u00a00333 2422 723<\/li>\n<li><strong>Email:<\/strong>\u00a0<a href=\"mailto:privacy@hazecbd.co.uk\">privacy@hazecbd.co.uk<\/a><\/li>\n<\/ul>\n<p>We are registered with the Info<\/p>\n<h2 id=\"collect\">What personal data we collect<\/h2><p>We collect different categories of personal data depending on how you interact with us.<\/p>\n<h3>When you place an order<\/h3>\n<ul>\n<li>Name and contact details (email, phone)<\/li>\n<li>Delivery and billing address<\/li>\n<li>Payment information (processed by Stripe \/ PayPal \u2014 we don&#8217;t store full card details)<\/li>\n<li>Order history and product preferences<\/li>\n<li>IP address and device information for fraud prevention<\/li>\n<\/ul>\n<h3>When you create an account<\/h3>\n<ul>\n<li>Email address and password (passwords stored as hashed values, never plain text)<\/li>\n<li>Saved addresses and payment methods (tokenised, not full card details)<\/li>\n<li>Marketing preferences<\/li>\n<\/ul>\n<h3>When you contact us<\/h3>\n<ul>\n<li>Contents of your message and any attachments<\/li>\n<li>Contact details you provide for our response<\/li>\n<\/ul>\n<h3>When you visit our website<\/h3>\n<ul>\n<li>IP address, browser type, device type, operating system<\/li>\n<li>Pages visited and time spent<\/li>\n<li>Referring website<\/li>\n<li>Cookie data (see our\u00a0<a href=\"\/cookies\/\">cookies policy<\/a>)<\/li>\n<\/ul>\n<h3>What we do NOT collect<\/h3>\n<ul>\n<li>Health or medical information about you (this is irrelevant to a food supplement business)<\/li>\n<li>Special category data (race, religion, sexual orientation, etc.)<\/li>\n<li>Full payment card numbers (handled by our payment processors)<\/li>\n<\/ul>\n<h2 id=\"personal\">How we use your personal data<\/h2><p>We use your personal data for the following purposes:<\/p><div class=\"doc-table-wrap\"><table class=\"doc-table doc-table-cols-2\"><thead><tr><th>Purpose<\/th><th>Data used<\/th><\/tr><\/thead><tbody><tr><td class=\"label\">Process and fulfil your orders<\/td><td>Name, address, payment info, order details<\/td><\/tr><tr><td class=\"label\">Send order confirmations and dispatch updates<\/td><td>Email, order details<\/td><\/tr><tr><td class=\"label\">Provide customer support<\/td><td>Contact details, message history<\/td><\/tr><tr><td class=\"label\">Send marketing (only if you've opted in)<\/td><td>Email, marketing preferences, purchase history<\/td><\/tr><tr><td class=\"label\">Improve our website and products<\/td><td>Aggregated browsing data, purchase patterns<\/td><\/tr><tr><td class=\"label\">Prevent fraud and abuse<\/td><td>IP address, device info, transaction patterns<\/td><\/tr><tr><td class=\"label\">Comply with legal obligations (tax, accounting)<\/td><td>Transaction records<\/td><\/tr><tr><td class=\"label\">Verify age (CBD products require 18+)<\/td><td>Date of birth declaration \/ age verification check<\/td><\/tr><\/tbody><\/table><\/div><h2 id=\"processing\">Our lawful basis for processing<\/h2><p>Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on:<\/p>\n<ul>\n<li><strong>Contract performance (Article 6(1)(b))<\/strong>\u00a0\u2014 to fulfil orders you&#8217;ve placed<\/li>\n<li><strong>Legitimate interests (Article 6(1)(f))<\/strong>\u00a0\u2014 to operate and improve our business, prevent fraud, and provide customer support<\/li>\n<li><strong>Consent (Article 6(1)(a))<\/strong>\u00a0\u2014 for marketing emails and non-essential cookies<\/li>\n<li><strong>Legal obligation (Article 6(1)(c))<\/strong>\u00a0\u2014 for tax, accounting, and regulatory records<\/li>\n<\/ul>\n<p>You can withdraw consent at any time by clicking unsubscribe in any marketing email, updating preferences in your account, or contacting us at\u00a0<a href=\"mailto:privacy@hazecbd.co.uk\">privacy@hazecbd.co.uk<\/a>.<\/p>\n<h2 id=\"share\">Who we share your data with<\/h2><p>We share your data only with the parties needed to provide our services. We do\u00a0<strong>not sell your data<\/strong>\u00a0to anyone.<\/p>\n<h3>Service providers (data processors)<\/h3>\n<ul>\n<li><strong>Payment processors<\/strong>: Stripe, PayPal \u2014 for processing transactions<\/li>\n<li><strong>Couriers<\/strong>: Royal Mail, DPD \u2014 for delivering your orders<\/li>\n<li><strong>Email service provider<\/strong>: Klaviyo \u2014 for transactional and marketing emails<\/li>\n<li><strong>Reviews platform<\/strong>: Trustpilot \u2014 to invite reviews after delivery<\/li>\n<li><strong>Hosting provider<\/strong>:\u00a0<span class=\"placeholder\">[hosting provider]<\/span>\u00a0<span class=\"tag tag-review\">REVIEW: confirm at build<\/span><\/li>\n<li><strong>Analytics<\/strong>: Google Analytics 4 (anonymised IP)<\/li>\n<\/ul>\n<p>All service providers are bound by data processing agreements requiring them to handle your data securely and only as instructed by us.<\/p>\n<h3>Legal obligations<\/h3>\n<p>We may disclose data if required by law, regulation, or legal process (e.g. court order, tax investigation, fraud prevention).<\/p>\n<h3>Business transfers<\/h3>\n<p>If our business is sold or merged, your data may be transferred to the new owner as part of the transaction. We will notify you before any such transfer.<\/p>\n<h2 id=\"keep\">How long we keep your data<\/h2><p>We keep personal data only as long as needed for the purposes we collected it. REVIEW: confirm retention periods with legal\/finance<\/p><div class=\"doc-table-wrap\"><table class=\"doc-table doc-table-cols-2\"><thead><tr><th>Data type<\/th><th>Retention period<\/th><\/tr><\/thead><tbody><tr><td class=\"label\">Order &amp; transaction records<\/td><td>7 years (for UK tax\/HMRC compliance)<\/td><\/tr><tr><td class=\"label\">Account data<\/td><td>Until account closure + 30 days<\/td><\/tr><tr><td class=\"label\">Marketing preferences<\/td><td>Until you unsubscribe + 90 days for suppression list<\/td><\/tr><tr><td class=\"label\">Customer support emails<\/td><td>2 years from last interaction<\/td><\/tr><tr><td class=\"label\">Website analytics<\/td><td>14 months (GA4 default)<\/td><\/tr><tr><td class=\"label\">Fraud prevention logs<\/td><td>5 years<\/td><\/tr><\/tbody><\/table><\/div><h2 id=\"rights\">Your rights under UK GDPR<\/h2><p>You have the following rights regarding your personal data:<\/p>\n<ul>\n<li><strong>Right of access<\/strong>\u00a0\u2014 request a copy of what we hold about you<\/li>\n<li><strong>Right to rectification<\/strong>\u00a0\u2014 correct any inaccurate data<\/li>\n<li><strong>Right to erasure (&#8220;right to be forgotten&#8221;)<\/strong>\u00a0\u2014 request deletion of your data, subject to legal retention obligations<\/li>\n<li><strong>Right to restrict processing<\/strong>\u00a0\u2014 pause our use of your data<\/li>\n<li><strong>Right to data portability<\/strong>\u00a0\u2014 receive your data in a structured, machine-readable format<\/li>\n<li><strong>Right to object<\/strong>\u00a0\u2014 object to processing based on legitimate interests, including direct marketing<\/li>\n<li><strong>Right to withdraw consent<\/strong>\u00a0\u2014 for processing based on consent (e.g. marketing)<\/li>\n<li><strong>Right not to be subject to automated decision-making<\/strong>\u00a0\u2014 we don&#8217;t currently use automated decision-making<\/li>\n<\/ul>\n<p>To exercise any of these rights, contact us at\u00a0<a href=\"mailto:privacy@hazecbd.co.uk\">privacy@hazecbd.co.uk<\/a>. We&#8217;ll respond within\u00a0<strong>one month<\/strong>\u00a0of receiving your request.<\/p>\n<p>We may need to verify your identity before responding to protect your data from unauthorised access.<\/p>\n<h2 id=\"cookies\">Cookies &amp; tracking<\/h2><p>We use cookies and similar technologies to operate our website, analyse usage, and (with your consent) deliver marketing. Full details are in our separate\u00a0<a href=\"\/cookies\/\">Cookies Policy<\/a>.<\/p>\n<p>You can manage your cookie preferences at any time via the cookie banner or in your browser settings.<\/p>\n<h2 id=\"international\">International data transfers<\/h2><p>Some of our service providers (e.g. Google Analytics, Klaviyo) may process data outside the UK. When this happens, we ensure appropriate safeguards are in place under UK GDPR:<\/p>\n<ul>\n<li>Transfers to countries with UK adequacy decisions (e.g. EEA countries)<\/li>\n<li>Standard Contractual Clauses (SCCs) for transfers to other countries<\/li>\n<li>Compliance with the UK International Data Transfer Agreement (IDTA) where applicable<\/li>\n<\/ul>\n<p><span class=\"tag tag-review\">REVIEW: confirm all third-party processors meet UK adequacy\/SCC requirements<\/span><\/p>\n<h2 id=\"protect\">How we protect your data<\/h2><p>We use industry-standard security measures to protect your personal data:<\/p>\n<ul>\n<li>HTTPS encryption across our entire site<\/li>\n<li>Encrypted database storage of sensitive data<\/li>\n<li>Hashed passwords (never stored in plain text)<\/li>\n<li>PCI-DSS compliant payment processing via Stripe \/ PayPal<\/li>\n<li>Access controls limiting who in our team can view personal data<\/li>\n<li>Regular security audits and software updates<\/li>\n<\/ul>\n<p>However, no method of transmission over the internet is 100% secure. If we become aware of a personal data breach affecting your data, we&#8217;ll notify you and the ICO within 72 hours where required by law<\/p>\n<h2 id=\"childrens\">Children&#039;s data<\/h2><p>Our products are\u00a0<strong>not intended for anyone under 18<\/strong>. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at\u00a0<a href=\"mailto:privacy@hazecbd.co.uk\">privacy@hazecbd.co.uk<\/a>\u00a0and we will delete it.<\/p>\n<p>All purchases on our site require age verification confirming the buyer is 18 or over.<\/p>\n<h2 id=\"changes\">Changes to this policy<\/h2><p>We may update this privacy policy from time to time. The &#8220;last updated&#8221; date at the top of this page tells you when. Material changes will be communicated to you by email (if you have an account) or via a prominent notice on our website.<\/p>\n<p>Continued use of our website after changes constitutes acceptance of the updated policy.<\/p>\n<h2 id=\"complaints\">Contact us &amp; complaints<\/h2><p>For any questions about this policy or to exercise your rights:<\/p>\n<ul>\n<li><strong>Email:<\/strong>\u00a0<a href=\"mailto:privacy@hazecbd.co.uk\">privacy@hazecbd.co.uk<\/a><\/li>\n<li><strong>Post:<\/strong>\u00a0Data Protection, Haze CBD, 15 Whetley Lane, Bradford BD8 9EH<\/li>\n<li><strong>Phone:<\/strong>\u00a00333 2422 723 (Mon\u2013Fri 9am\u20135pm GMT)<\/li>\n<\/ul>\n<h3>Complaints to the ICO<\/h3>\n<p>If you&#8217;re unhappy with how we&#8217;ve handled your personal data, you have the right to complain to the Information Commissioner&#8217;s Office (ICO):<\/p>\n<ul>\n<li><strong>Website:<\/strong>\u00a0<a href=\"https:\/\/ico.org.uk\" target=\"_blank\" rel=\"noopener\">ico.org.uk<\/a><\/li>\n<li><strong>Helpline:<\/strong>\u00a00303 123 1113<\/li>\n<li><strong>Post:<\/strong>\u00a0Information Commissioner&#8217;s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF<\/li>\n<\/ul>\n<p>We&#8217;d appreciate the chance to address your concerns first, so please contact us before going to the ICO.<\/p>\n<div class=\"contact-cta\"><div class=\"contact-cta-icon\"><svg width=\"22\" height=\"22\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><path d=\"M12 2 4 5v6c0 5.5 3.8 10.7 8 12 4.2-1.3 8-6.5 8-12V5z\"\/><\/svg><\/div><div class=\"contact-cta-content\"><h3>Privacy questions or data requests?<\/h3><p>Contact our data protection team directly.<\/p><\/div><a href=\"mailto:privacy@hazecbd.co.uk\" class=\"contact-cta-btn\">Email privacy team<\/a><\/div><\/article><\/section>[\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>[vc_row woodmart_stretch_content=&#8221;section-stretch-content&#8221; woodmart_css_id=&#8221;6a2665f82fea3&#8243; responsive_spacing=&#8221;eyJwYXJhbV90eXBlIjoid29vZG1hcnRfcmVzcG9uc2l2ZV9zcGFjaW5nIiwic2VsZWN0b3JfaWQiOiI2YTI2NjVmODJmZWEzIiwic2hvcnRjb2RlIjoidmNfcm93IiwiZGF0YSI6eyJ0YWJsZXQiOnt9LCJtb2JpbGUiOnt9fX0=&#8221; mobile_bg_img_hidden=&#8221;no&#8221; tablet_bg_img_hidden=&#8221;no&#8221; woodmart_parallax=&#8221;0&#8243; woodmart_gradient_switch=&#8221;no&#8221; woodmart_box_shadow=&#8221;no&#8221; wd_z_index=&#8221;no&#8221; woodmart_disable_overflow=&#8221;0&#8243; row_reverse_mobile=&#8221;0&#8243; row_reverse_tablet=&#8221;0&#8243;][vc_column][\/vc_column][\/vc_row][vc_row woodmart_stretch_content=&#8221;section-stretch-content&#8221; woodmart_css_id=&#8221;6a2665f82fea3&#8243; responsive_spacing=&#8221;eyJwYXJhbV90eXBlIjoid29vZG1hcnRfcmVzcG9uc2l2ZV9zcGFjaW5nIiwic2VsZWN0b3JfaWQiOiI2YTI2NjVmODJmZWEzIiwic2hvcnRjb2RlIjoidmNfcm93IiwiZGF0YSI6eyJ0YWJsZXQiOnt9LCJtb2JpbGUiOnt9fX0=&#8221; mobile_bg_img_hidden=&#8221;no&#8221; tablet_bg_img_hidden=&#8221;no&#8221; woodmart_parallax=&#8221;0&#8243; woodmart_gradient_switch=&#8221;no&#8221;<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-127","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/mehmeez.com\/hazecbd\/wp-json\/wp\/v2\/pages\/127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mehmeez.com\/hazecbd\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/mehmeez.com\/hazecbd\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/mehmeez.com\/hazecbd\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/mehmeez.com\/hazecbd\/wp-json\/wp\/v2\/comments?post=127"}],"version-history":[{"count":6,"href":"https:\/\/mehmeez.com\/hazecbd\/wp-json\/wp\/v2\/pages\/127\/revisions"}],"predecessor-version":[{"id":297,"href":"https:\/\/mehmeez.com\/hazecbd\/wp-json\/wp\/v2\/pages\/127\/revisions\/297"}],"wp:attachment":[{"href":"https:\/\/mehmeez.com\/hazecbd\/wp-json\/wp\/v2\/media?parent=127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}