The data controller is:

If we appoint a Data Protection Officer or an EU privacy representative, their contact details will be published here.

This policy applies to personal data processed through genelnova.com, our online store, customer account, checkout, customer support, loyalty features, B2B and collaboration forms, and any related service that links to this policy.

Third-party websites and services have their own privacy notices. We are not responsible for their independent processing activities.

Depending on how you interact with us, we may collect:

01 Identity & contact

Name, billing and delivery address, email address, telephone number and, where necessary, company and tax details.

02 Account

Login credentials in protected form, account settings, order history, saved preferences and loyalty information.

03 Orders & transactions

Products ordered, order value, discounts, delivery method, transaction identifiers, payment status, refunds and chargebacks. We do not normally receive or store full card details; payment providers process them directly.

04 Delivery

Recipient details, shipping address, tracking events, proof of delivery and information required to investigate a delivery issue.

05 Support & claims

Messages, call or email records, order references, photos, video, return information and evidence supplied in connection with a complaint or claim.

06 Marketing & preferences

Newsletter or promotional preferences, consent records, campaign interactions and product interests.

07 Technical & usage

IP address, device and browser information, operating system, timestamps, pages viewed, referring page, approximate location derived from IP, security logs and cookie or similar identifiers.

08 Age assurance

Confirmation that you meet the minimum age requirement and, only where legally necessary, additional verification information.

09 B2B & collaborations

Professional contact details, company information, proposal details and correspondence.

10 What you publish

Reviews, survey responses or other content, if those features are enabled.

Please do not send health information, identity documents or other sensitive data unless we specifically request it through an authorised and secure process.

How we obtain it

Is providing data mandatory?

Fields marked as required are necessary to provide the requested service or complete an order. If you do not provide them, we may be unable to create an account, process a payment, deliver an order or respond to a request. Optional fields are identified as such.

Where processing is based on consent, you may withdraw that consent at any time without affecting processing already carried out.

Where we rely on legitimate interests, you may request information about the balancing assessment and object where the law allows.

We disclose only the data necessary for the relevant purpose to:

Our providers act under written data-processing terms where required. Some recipients, such as payment providers or public authorities, may act as independent controllers for their own legal purposes.

We do not sell personal data.

Some service providers may process personal data outside Spain or the European Economic Area. Before making a restricted transfer, we use a lawful mechanism such as:

You may request information about the relevant safeguard by writing to info@genelnova.com.

We keep personal data only for as long as necessary for the purpose for which it was collected and then, where required, restrict access while statutory limitation or retention periods remain.

DataRetention

Account data

While the account remains active, then deleted or restricted after closure unless needed for orders, legal obligations or claims.

Orders, invoices, payments & refunds

For the applicable Spanish tax, accounting, commercial and consumer-law retention periods; relevant commercial records may need to be retained for up to six years.

Support, returns & claims

Until the matter is closed, then for the period necessary to establish or defend legal claims.

Marketing data

Until consent is withdrawn or you object; a minimal suppression record may be retained to ensure we respect the request.

Cookie & analytics data

For the duration stated in the current Cookie Policy and consent tool.

Security & fraud records

For a proportionate period based on risk, incident response and applicable limitation periods.

B2B enquiries

For the duration of the relationship or negotiations, then for the applicable limitation period.

Privacy-rights requests

For the time needed to respond and demonstrate compliance.

Data may be retained longer where required by law, court order or an active dispute. When retention ends, data is deleted, anonymised or securely destroyed.

Cookies and similar technologies

We use strictly necessary technologies to operate the website and checkout. Analytics, personalisation or advertising technologies are used only as permitted by law and according to your choices.

You can accept, reject or change non-essential cookie choices through Cookie Settings. For provider names, purposes, expiry periods and cookie identifiers, see our separate Cookie Policy.

Withdrawing consent must be as easy as giving it. Rejecting non-essential cookies does not prevent access to the store’s core functions.

Marketing communications

We send electronic marketing only where we have an appropriate legal basis. Every marketing message provides an unsubscribe option. You may also withdraw consent or object at any time by writing to info@genelnova.com.

Service messages about an order, payment, delivery, security issue or policy update are not marketing and may still be sent where necessary.

We will not disclose your contact details to another company for its independent marketing without a valid legal basis and clear prior information.

We may use automated tools to identify suspicious transactions, protect accounts and prevent fraud.

[To be confirmed: whether any decision with legal or similarly significant effect is made solely by automated means.]

If we make a solely automated decision that produces legal or similarly significant effects, we will provide the information and safeguards required by Article 22 GDPR, including the right to request human intervention, express your view and contest the decision where applicable.

Subject to the conditions in data-protection law, you may:

To exercise a right, email info@genelnova.com with the subject Privacy Request and describe the request. We may ask for proportionate information to verify your identity. Do not send a copy of an identity document unless we specifically request it and provide secure instructions.

We normally respond within one month. That period may be extended by up to two further months for complex or numerous requests; if so, we will explain the extension within the first month.

Requests are normally free of charge. A reasonable fee or refusal is possible only where a request is manifestly unfounded or excessive, particularly because of repetition.

You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es. We encourage you to contact us first so we can try to resolve the issue.

Security

We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. Measures are reviewed according to risk and may include access controls, encryption in transit, supplier controls, backups, logging, staff confidentiality and incident-response procedures.

No internet service can guarantee absolute security. If a personal-data breach is likely to result in a high risk to you, we will inform you as required by law.

We will never ask you to send a password or full payment-card details by email.

Adults only

Our store and cannabinoid products are intended for adults aged 18 or over. We do not knowingly allow minors to purchase age-restricted products. If you believe a minor has provided personal data unlawfully, write to info@genelnova.com.

Third-party links & social platforms

Our website may link to external websites or social platforms. Those organisations determine their own processing activities and privacy terms. Review their privacy notices before providing personal data.

Embedded third-party content or social-media tools will be activated only in accordance with applicable consent requirements.

Changes to this policy

We may update this policy to reflect changes in law, our services or our providers. The current version and effective date will always appear on this page. If a change materially affects how we use personal data, we will provide appropriate advance notice and obtain consent where required.