Effective date: [●] BlackberryTreeCann GmbH takes the protection of personal data seriously. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website, contact us, request professional access, use our professional portal, or otherwise communicate with us.This Privacy Policy applies to the website: www.btcann.de
1. Controller
The controller responsible for data processing on this website is:
BlackberryTreeCann GmbH
Kurfürstendamm 11
10719 Berlin
Germany
Email: info@btcann.de
Telephone: [+49 ●]
Represented by: Alexandre Lourenco
2. Data Protection Officer
We have not appointed a Data Protection Officer because we are not legally required to do so. For privacy-related questions, please contact us at: info@btcann.de
3. General Information on Data Processing
We process personal data only where permitted under applicable data protection law, including the General Data Protection Regulation, the German Federal Data Protection Act, and other applicable privacy laws.
Depending on the processing activity, the legal basis may include:
- Article 6(1)(a) GDPR – consent
- Article 6(1)(b) GDPR – performance of a contract or pre-contractual measures
- Article 6(1)(c) GDPR – compliance with a legal obligation
- Article 6(1)(f) GDPR – legitimate interests
Where we process special categories of personal data, if applicable, we do so only where a specific legal basis under Article 9 GDPR applies.
4. Website Access Data / Server Log Files
When you visit our website, our hosting provider automatically collects and stores certain technical data in server log files. This may include:
- IP address
- Date and time of access
- Requested page or file
- Referrer URL
- Browser type and version
- Operating system
- Device information
- Amount of data transferred
- Access status / HTTP status code
We process this data to ensure the security, stability, and proper functioning of the website, to detect technical errors, and to prevent misuse.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.
Server log files are generally deleted after [● days / weeks], unless longer storage is required for security purposes or to investigate misuse.
5. Contact by Email, Telephone, or Contact Form
If you contact us by email, telephone, or through a contact form, we process the personal data you provide, such as:
- Name
- Company
- Role / professional status
- Email address
- Telephone number
- Country
- Message content
- Any documents or information submitted by you
We process this data to respond to your inquiry, manage business communication, evaluate professional access requests, and, where applicable, take pre-contractual or contractual steps.
Legal basis: Article 6(1)(b) GDPR where the communication relates to a contract or pre-contractual inquiry; otherwise Article 6(1)(f) GDPR based on our legitimate interest in responding to business inquiries. If we are legally required to retain certain communications, the legal basis is Article 6(1)(c) GDPR.
6. Supplier Inquiries and Supplier Onboarding
If you contact us as a potential supplier or business partner, we may process:
- Name and contact details
- Company details
- Role / job title
- Licenses and authorizations
- Quality documentation
- Product specifications
- Regulatory documentation
- Commercial information
- Communication history
We process this data to evaluate potential cooperation, conduct supplier qualification, assess product and documentation suitability, and manage business relationships.
Legal basis: Article 6(1)(b) GDPR for pre-contractual or contractual measures; Article 6(1)(f) GDPR based on our legitimate interest in supplier evaluation and business development; and Article 6(1)(c) GDPR where processing is necessary to comply with legal or regulatory requirements.
7. Cookies and Similar Technologies
Our website may use cookies or similar technologies. Cookies are small text files stored on your device. Some cookies are technically necessary for the operation of the website. Others may be used only with your consent, for example for analytics, embedded media, or marketing-related features.
Strictly necessary cookies may be required for security functions, session management, professional login, cookie consent settings, and form functionality. Legal basis: Article 6(1)(f) GDPR and, where applicable, § 25 TDDDG.
Optional cookies, such as analytics or marketing cookies, are used only with your consent. Legal basis: Article 6(1)(a) GDPR and, where applicable, § 25 TDDDG. You can withdraw or change your consent at any time through the cookie settings on our website.
8. Cookie Consent Tool
We may use a cookie consent management tool to obtain and document user consent for optional cookies and similar technologies. The tool may process IP address or shortened IP address, consent status, date and time of consent, browser and device information, and selected cookie preferences.
Legal basis: Article 6(1)(c) GDPR, where consent documentation is legally required, and Article 6(1)(f) GDPR based on our legitimate interest in managing legally compliant consent records.
Provider: [Cookie tool provider name]. Data processing location: [EU / EEA / other].
9. Analytics Tools
Option A – if no analytics are used: We do not currently use analytics tools that track visitors across our website.
Option B – if privacy-friendly analytics are used: We use [Matomo / Plausible / other provider] to understand how visitors use our website and to improve our content and user experience. Depending on the configuration, the following data may be processed: pages visited, time of visit, referrer, device and browser information, approximate location, and shortened IP address.
Legal basis: Article 6(1)(a) GDPR if analytics are based on consent. If analytics are configured without cookies and with anonymized data, legal basis may be Article 6(1)(f) GDPR. Provider: [●]. Further information: [●].
Option C – if Google Analytics is used: We use Google Analytics only with your consent. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics may process information about your use of our website, including device information, browser information, pages visited, interactions, approximate location, and IP address. Google may also process data in the United States or other third countries. Legal basis: Article 6(1)(a) GDPR. You may withdraw your consent at any time through the cookie settings.
12. Embedded Content and Third-Party Services
Our website may include embedded content or third-party services, such as maps, videos, fonts, security tools, or external links. When you interact with such services, personal data may be transmitted to the relevant third-party provider.
Examples may include Google Maps, YouTube or Vimeo, LinkedIn, web fonts, security or spam protection tools, CRM tools, or form management tools.
We use such services only where necessary for website functionality, professional communication, or with your consent where required. Legal basis: Article 6(1)(a), Article 6(1)(b), Article 6(1)(c), or Article 6(1)(f) GDPR, depending on the service.
Specific third-party services used on this website: [Insert complete list of providers].
13. Pharmacovigilance, Product Complaints, and Quality Inquiries
If you submit a product complaint, quality inquiry, adverse event report, or pharmacovigilance-related communication, we may process the personal data required to assess, document, report, and follow up on the matter.
- Name and contact details
- Professional role
- Company / pharmacy / healthcare institution
- Product information
- Batch information
- Complaint or event description
- Relevant supporting documentation
Where health-related information is submitted, it may constitute special category data under Article 9 GDPR.
Legal basis: Article 6(1)(c) GDPR for compliance with legal obligations; Article 6(1)(f) GDPR for quality management and product safety; and, where applicable, Article 9(2)(i) GDPR for public health and medicinal product safety obligations.
Please do not submit patient-identifiable health information through general contact forms unless specifically requested through an appropriate secure channel.
14. Recipients of Personal Data
We may share personal data with the following categories of recipients where necessary:
- Hosting providers
- IT service providers
- Email and communication service providers
- CRM providers
- Cookie consent providers
- Analytics providers, where applicable
- Legal, tax, and compliance advisors
- Regulatory authorities, where legally required
- Business partners, where necessary for supplier, pharmacy, or distribution communication
- Logistics or quality service providers, where applicable
We do not sell personal data. Where we use service providers that process personal data on our behalf, we conclude appropriate data processing agreements pursuant to Article 28 GDPR.
15. International Data Transfers
Where possible, we process personal data within the European Union or European Economic Area. If personal data is transferred to a country outside the EU/EEA, we ensure that appropriate safeguards are in place, such as an adequacy decision by the European Commission, EU Standard Contractual Clauses, additional technical and organizational safeguards, or your explicit consent, where applicable.
International transfers are handled in accordance with Chapter V GDPR.
16. Data Retention
We store personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law.
- General inquiries are retained for [● months / years].
- Business communications may be retained for statutory commercial and tax retention periods.
- Professional access records are retained for as long as the account exists and for [●] thereafter.
- Regulatory, quality, and pharmacovigilance records may be retained for longer periods where legally required.
- Server logs are retained for [● days / weeks], unless longer retention is required for security reasons.
After the applicable retention period, personal data is deleted or anonymized unless further retention is legally required.
17. Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.
- Access controls
- Encrypted transmission
- Secure hosting
- User authentication
- Role-based access rights
- Logging and monitoring
- Regular review of service providers
- Internal confidentiality measures
18. Your Rights
Subject to the requirements of applicable law, you have the following rights:
- Right of access – Article 15 GDPR
- Right to rectification – Article 16 GDPR
- Right to erasure – Article 17 GDPR
- Right to restriction of processing – Article 18 GDPR
- Right to data portability – Article 20 GDPR
- Right to object – Article 21 GDPR
- Right to withdraw consent – Article 7(3) GDPR
- Right to lodge a complaint with a supervisory authority – Article 77 GDPR
To exercise your rights, please contact: [privacy@blackberrytreecann.de].
19. Right to Object
Where we process personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless processing is necessary for the establishment, exercise, or defense of legal claims.
20. Withdrawal of Consent
Where processing is based on your consent, you may withdraw your consent at any time with future effect. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
You can withdraw cookie consent through the cookie settings on our website or contact us at: [privacy@blackberrytreecann.de].
21. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.
The competent supervisory authority may depend on the federal state in which BlackberryTreeCann GmbH is established. Competent authority: [Insert competent German state data protection authority]. You may also contact the supervisory authority in your usual place of residence, place of work, or place of the alleged infringement.
22. No Automated Decision-Making
We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR. If this changes, we will update this Privacy Policy accordingly.
23. Updates to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our website, processing activities, legal requirements, or service providers. The current version is available on this website.
Last updated: [●]