Privacy Policy

Version: 1.3 — Last updated: 03/06/2026

1. Data Controller and DPO

The data controller is Weedo Lifestyle & Media GmbH, Machtlfinger Str. 21, 81379 Munich.
For any questions regarding your personal data, contact our Data Protection Officer (DPO) at: info@house-of-seeds.de or by mail at Machtlfinger Str. 21, 81379 Munich.

2. Legal Bases and Purposes (Art. 6 GDPR)

Purpose	Legal Basis	Retention Period
Order and delivery management	Contract performance (Art. 6.1.b)	Duration of the relationship + 3 years
Invoicing and accounting	Legal obligation (Art. 6.1.c)	10 years
Age verification	Legal obligation (Art. 6.1.c)	Deletion after verification
Newsletter marketing	Consent (Art. 6.1.a)	Until consent is withdrawn
Fraud prevention	Legitimate interest (Art. 6.1.f)	13 months
Website improvement (analytics)	Consent (Art. 6.1.a)	13 months

3. Subcontractors and Recipients

Your data is shared only for service execution:

• Hosting: Shopify Inc. (Canada/USA) — Standard Contractual Clauses (SCC) approved by the European Commission
• Payment: Prepayment, Credit card
• Logistics: DHL
• Analytics: Google Analytics (if consented via Cookies)

4. International Transfers

Shopify may transfer your data to Canada and the United States. These transfers are governed by Standard Contractual Clauses validated by the European Commission, ensuring an adequate level of protection.

5. Your Rights (Art. 15 to 22 GDPR)

You have the following rights:

• Right of access (Art. 15)
• Right of rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to set post-mortem directives (French law)

To exercise these rights, send a written request to info@house-of-seeds.de. We respond within a maximum of 30 days.

6. Profiling and Automated Decision-Making

We do not use fully automated decision-making producing legal effects. Profiling is limited to marketing personalization if you have accepted the marketing cookies.

7. Complaint to the CNIL

If you believe that the processing of your data violates the GDPR, you can file a complaint with the National Commission on Informatics and Liberty (CNIL):
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
www.cnil.fr