1. Data Controller
| Trade name | WeedsPayments |
|---|---|
| Legal name | WEEDSPAYMENTS LTD |
| Registration number (Companies House) | 17281796 |
| Legal form | Private Limited Company (Limited by Shares) |
| Jurisdiction | England and Wales (United Kingdom) |
| Registered office | London, United Kingdom |
| [email protected] | |
| Web | www.weedspayments.com |
WEEDSPAYMENTS LTD, established in the United Kingdom, provides services to clients located in the European Union. Data processing is subject to the GDPR (EU 2016/679) and the UK GDPR (Art. 3(2) GDPR).
2. Personal Data Collected
In accordance with the data minimisation principle (Art. 5 GDPR), only the data strictly necessary for the provision of the service is collected:
| Category | Data |
|---|---|
| Identification | First name, surname, identity document |
| Contact | Email, phone, postal address |
| Business | Company name, NIF/CIF/VAT, sector of activity |
| Technical | Domain, e-commerce platform, configuration |
| Financial | Bank details for settlements (where applicable) |
| Navigation | IP, browser, pages visited, duration |
| KYB Compliance | Know-Your-Business information for merchant onboarding |
NO special categories of data (Art. 9 GDPR) nor data of minors are collected.
3. Purpose of Processing and Legal Basis
| Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|
| Provision of the contracted service | Art. 6.1.b — performance of a contract | Duration of the service + 5 years |
| Invoicing and tax obligations | Art. 6.1.c — legal obligation | 5 years |
| Commercial communications | Art. 6.1.f — legitimate interest | Until withdrawal |
| KYB compliance and fraud prevention | Art. 6.1.c — legal obligation | 5 years |
| System security and access logs | Art. 6.1.f — legitimate interest | 12 months |
| Web analytics | Art. 6.1.a — consent | Maximum 13 months |
4. Recipients and Disclosure of Data
WeedsPayments does NOT sell or rent personal data. Data may only be disclosed to:
- Acquiring banks and payment processors under PSD2 licence and PCI DSS certification
- Technical infrastructure providers (hosting, email) under Data Processing Agreements (DPA, Art. 28 GDPR)
- Legal and accounting advisors subject to professional confidentiality duties
- Competent public authorities when required by law
5. International Data Transfers
Transfers of personal data between the European Union and the United Kingdom are covered by the European Commission's adequacy decision of 28 June 2021 (Decision (EU) 2021/1772), which recognises the United Kingdom as providing an adequate level of data protection. Any other international transfers are carried out under the safeguards of Art. 46 GDPR (standard contractual clauses).
6. Rights of Data Subjects
| Right | Description |
|---|---|
| Access | Know what personal data we process |
| Rectification | Correct inaccurate or incomplete data |
| Erasure | Request the deletion of the data ("right to be forgotten") |
| Restriction | Restrict processing in certain cases |
| Portability | Receive the data in a structured and portable format |
| Objection | Object to processing based on legitimate interest |
| Withdrawal | Withdraw consent at any time |
To exercise these rights, send an email to [email protected] attaching a copy of your identity document. A response will be provided within a maximum of 30 days. If you consider that your rights have not been properly attended to, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country.
7. Data Security
WeedsPayments applies the technical and organisational measures required by Art. 32 GDPR:
- Encryption of communications using TLS 1.2 or higher
- Role-based access control and principle of least privilege
- Incident management and data breach notification procedure
- Periodic reviews of the security posture
- Non-disclosure agreements (NDA) with all personnel with access to data
- PCI DSS compliance in the processing of payment data
In the event of a data breach, the competent supervisory authority shall be notified within a maximum of 72 hours (Art. 33 GDPR), and the data subjects when there is a high risk to their rights.
8. Use of Cookies
The use of cookies is governed by the site's specific Cookie Policy.
9. Minors
WeedsPayments' services are aimed exclusively at companies and professionals over 18 years of age. Personal data of minors is not collected. Should we become aware of the registration of data of a minor, we would proceed to its immediate deletion.
10. Policy Updates
Any material modification of this Privacy Policy will be notified with a minimum of 30 days in advance. The current version is always available at www.weedspayments.com/privacidad.
11. Contact and Data Protection Officer
| [email protected] | |
| Suggested subject | "Privacy Request — [your name]" |
| Response time | Maximum 30 days |
| Languages | Spanish · English · German |
| Hours | Mon–Fri · 9:00–18:00 CET |