Privacy and Cookie Policy

In short

• Request forms: we keep what you type so we can answer you, and delete it 24 months after our last contact if no cooperation follows.
• Necessary cookies remember your age confirmation, language and cookie choice. They are always on.
• Google Analytics and the Meta Pixel work only if you allow them. Your name, contacts and form text are not sent to them.
• If you allow advertising, Meta may show you ads on Instagram and Facebook based on your visits here, including ads of other projects (businesses) of the same owner, for up to 180 days after your last visit.
• You can change your cookie choice at any time: “Cookie settings” at the bottom of every page.
• To see, correct or delete your data, write to privacy@canna-nirvana.com.

1. Who we are

This site (canna-nirvana.com) is run under the Canna Nirvana brand, Thailand (“we”). We decide how the personal data described here is used: we are the data controller under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

Contact for anything about your data: privacy@canna-nirvana.com.

The site is informational: it presents the farm, its strains and how we grow them. Through the site a business can send a request to get in touch or to cooperate. The site sells nothing: there are no prices, orders or payments on it. It is for business visitors aged 21 and over.

2. What we collect

Request forms (the page for businesses in Thailand and the Export page). We collect only what you enter:

• your name;
• one to three ways to contact you: a messenger nickname or number (LINE, WhatsApp, Telegram, WeChat, Viber, Signal, Messenger, Instagram, KakaoTalk, Zalo or another one you name), an email address, or a phone number with country code;
• depending on the form: shop or brand, cities, the items you are interested in (what, quantity, date, how often), strains shown on the site that interest you, with quantities in grams, country of import, licence type and a free-text message.

With the request we also store the page language, the type of form and the date and time it was sent. A hidden field catches automated spam; people never fill it in.

Your name and at least one contact are required: without them we cannot answer you. Everything else is optional. A request is a request to get in touch or to cooperate; it is not an order and does not create a contract.

Visiting the site. Like any website, our hosting provider and our website protection and delivery service receive your IP address and standard browser data (browser, device, language, the page requested and the page you came from) to deliver the page and protect the site. We hold the IP address in server memory to limit repeated attempts — 10 requests per 10 minutes, 5 partner-code attempts per 15 minutes — and do not save it with your request. These services and our server may also keep technical logs of such requests only for as long as they are needed for security and troubleshooting; after that the logs are deleted or overwritten.

Partner code. If a manager gave your company a partner code and you enter it, the partner_ok cookie links your browser to that code for 30 days. Our record of the code shows whom it was issued to.

Cookies, analytics and advertising: see sections 4 and 5.

We do not ask for sensitive data — racial or ethnic origin, political opinions, religious beliefs, criminal records, biometric data and the other categories in section 26 of the PDPA. Please do not write it in the message field.

3. Why we use your data and on what legal basis

• Answer your request and keep the correspondence about it · Form data · Steps you asked for before entering into a contract — s. 24(3)
• Notify our team of a new request by email · Form data · Steps you asked for before entering into a contract — s. 24(3); our legitimate interest in answering quickly — s. 24(5)
• Keep the site secure: limit repeated attempts, filter spam, check the age confirmation and partner code · IP address, necessary cookies · Legitimate interest — s. 24(5)
• Remember your age confirmation, language and cookie choice · Necessary cookies · Legitimate interest in providing the site you asked for — s. 24(5)
• Site statistics (Google Analytics) · Analytics cookies and events · Your consent — s. 19
• Measure visits and requests from Meta ads (Meta Pixel) · Advertising cookies and events · Your consent — s. 19
• Show you ads on Instagram and Facebook — for this site and for other projects (businesses) of the same owner — to audiences built from visits to this site (Meta Pixel) · Advertising cookies and events · Your consent — s. 19; for other projects, also consent to their use of the audience — s. 27
• Comply with the law and defend legal claims · Data needed for that · Legal obligation — s. 24(6); legitimate interest — s. 24(5)

Where we rely on legitimate interest, you may object (section 9). Where we rely on consent, you may withdraw it at any time; this does not affect what was done before you withdrew.

4. Cookies and similar storage

A cookie is a small file a site stores in your browser. We use two groups.

Necessary — always on; the site cannot work as intended without them:

• age_ok · Remembers that you confirmed you are 21 or older · 1 year · Not needed — always on
• cn_consent · Stores your cookie choice (analytics and advertising: yes or no) and when you made it · 180 days, then we ask again · Not needed — always on
• NEXT_LOCALE · Remembers your language; set automatically on your first visit · 1 year · Not needed — always on
• partner_ok · Signed marker that a partner code was entered; opens the partner section · 30 days · Not needed — set only after you enter a code
• preview_ok · Lets our team preview the site before launch · 30 days · Not given to visitors

The site also keeps two short notes in your browser tab (session storage): one remembers whether you opened the list of past strains and where you were on the page; the other, used only if you allowed analytics or advertising, stops one request from being counted twice. Both disappear when you close the tab.

Analytics and advertising — only if you allow them in the 21+ window or in the cookie bar:

• _ga, _ga_<ID> (Google Analytics) · Tells visits from the same browser apart for statistics · 2 years · Only with your consent
• _fbp, _fbc (Meta Pixel) · Identify your browser and the ad click for Meta · Up to 90 days · Only with your consent

The advertising and analytics companies may also read cookies on their own domains (third-party cookies) under their own policies.

Changing your choice. “Cookie settings” at the bottom of every page shows the choice again. If you switch to “Necessary only”, we delete the platforms’ cookies stored under our domain and reload the page without their scripts. Cookies on the platforms’ own domains can be removed only in your browser or in your accounts with them. You can also block or delete cookies in your browser settings; the necessary ones will be set again on your next visit.

What withdrawal changes: from that moment our site sends nothing more to the platforms. Advertising audiences already built from your earlier visits stay in Meta until they expire — up to 180 days after your last visit; we cannot remove one person from them. To stop such ads sooner, use the ad settings in your Meta account.

5. Analytics and advertising tools

Google Analytics and the Meta Pixel load only after you allow them. Until then your browser sends them nothing; we check this with automated tests.

What they receive once you allow them:

• the pages you open, with the full web address, and the page you came from;
• your IP address and browser data (browser, device, language, screen); the platforms use the IP address to estimate your country and city;
• their cookie identifiers;
• these events from our site: page view, strain page view, opening the catalogue, selecting a strain in a form, starting a form (Google only) and sending a request — for a request, only the type of form;
• Google Analytics also records scrolling, clicks on links to other sites and file downloads;

What they do not receive from us: your name, your contacts and the text you type in forms. Meta’s automatic events and automatic advanced matching are switched off.

Google Analytics gives us visit statistics. We keep its event-level data for 14 months and have Google Signals switched off.

Meta advertising. The Meta Pixel counts visits and requests that come from Meta ads, and adds visitors to audiences in Meta’s advertising tools: all visitors, visitors who viewed strains, visitors who sent a request. A person stays in such an audience for up to 180 days after the last visit. These audiences are used to show ads on Instagram and Facebook:

• ads of Canna Nirvana that comply with Meta’s advertising rules;
• ads of other projects (businesses) of the same owner. These ads are not about this site or its subject.

Other projects of the same owner use these audiences only inside Meta’s advertising tools, to show you their ads on Instagram and Facebook. They get no list of visitors, no names and no contacts; Meta shows the ads. They may use the audiences only for that purpose. Only the business accounts of the owner’s other projects get access to these audiences; agencies and contractors do not.

The platforms also use this data for their own purposes under their own privacy policies and process it outside Thailand, including in the United States:

• Google: policies.google.com/privacy; how Google uses data from sites that use its services: policies.google.com/technologies/partner-sites
• Meta: facebook.com/privacy/policy

Other ways to opt out: the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout) and Google Ad Settings (adssettings.google.com); the ad settings in your Meta account.

6. Who receives your data

We do not sell your data. Inside our company only the people who answer requests and run the site can see it. Your data may be received by:

• Our hosting provider · Runs the site and stores its database on servers in Asia, outside Thailand
• Our website protection and delivery service · Delivers the pages and protects the site from attacks; handles every request, including your IP address
• Our email sending service · Sends our team an email with the contents of your request
• Our email provider · Holds the mailbox where request emails arrive
• Google · Analytics — only with your consent (section 5)
• Meta · Measurement and advertising audiences — only with your consent (section 5)
• Other projects (businesses) of the same owner · Use audiences inside Meta to show you their ads — only with your consent; no names, contacts or visitor lists

We may also disclose data when the law requires it, for example to a court or an authority with legal power to request it. Requests are not transferred automatically to any other system. If our staff copy a request into our internal customer records, it is used for the same purpose and kept for the same periods.

7. Transfers outside Thailand

The site and its database are hosted on servers in Asia, outside Thailand. Our other service providers and the platforms may also process data outside Thailand; Google and Meta do so in the United States as well. Data protection law in those countries may not offer the same protection as the PDPA.

• Our service providers process your request and deliver the site because this is necessary to answer the request you sent (PDPA s. 28(3)).
• Analytics and advertising data go to Google and Meta on the basis of your consent, which you give after being told that the destination countries may not have adequate protection (s. 28(2)).

8. How long we keep it

• Requests that do not lead to cooperation · 24 months after our last contact with you, then deleted
• Requests that lead to cooperation · While we cooperate, then as long as the law requires (accounting and tax records)
• Request emails in our mailbox · The same periods
• Database backups · Deleted data remains in daily backups for up to 7 days
• Email copies at our email sending service · 30 days
• IP address in server memory for limiting attempts · Up to 15 minutes; cleared when the server restarts
• Cookies · As listed in section 4
• Google Analytics · 14 months
• Meta advertising audiences · Up to 180 days after your last visit; other Meta data — under Meta’s policy

9. Your rights

Under the PDPA you can:

• withdraw your consent at any time (s. 19) — for cookies, use “Cookie settings”;
• get access to and a copy of your data, and ask how we obtained data you did not consent to (s. 30);
• receive your data in a common machine-readable format or have it sent to another controller, where technically possible (s. 31);
• object to processing based on our legitimate interest, and to direct marketing at any time (s. 32);
• ask us to delete or anonymise your data (s. 33);
• ask us to restrict the use of your data (s. 34);
• ask us to correct inaccurate or incomplete data (s. 35, 36);
• complain to the Office of the Personal Data Protection Committee (PDPC), www.pdpc.or.th (s. 73).

Write to privacy@canna-nirvana.com from the contact you gave in your request, or name that contact, so we can find your data and confirm it is yours. We answer within 30 days. We refuse only where the law allows, and then we explain why.

10. Security

What we do:

• the site works only over HTTPS; our cookies travel only over secure connections, and page scripts cannot read the age, partner and preview cookies;
• requests are stored in a database closed to the public: only our team’s accounts can read them, after logging in to the admin panel;
• repeated submissions are limited and spam is filtered;
• the database is backed up daily, and backups are kept for 7 days.

No system is perfectly secure. If a breach may put your rights at risk, we report it to the PDPC without delay and, where feasible, within 72 hours; if the risk is high, we also tell you without delay (s. 37(4)).

11. Age 21+

The site is only for people aged 21 and over; the 21+ window asks every new visitor to confirm. We do not knowingly collect data from anyone younger. If we learn that we have, we delete it. Tell us if you think this has happened.

12. Changes to this policy

We update this policy when the site changes; the date at the top shows the current version. If we change what the analytics or advertising tools do, or who may use the audiences, we ask for your cookie choice again.

This policy is published in English and Thai. If the two texts differ, the English text prevails.

13. Contact

Canna Nirvana, Thailand. Email: privacy@canna-nirvana.com.