18+ only.
How we collect, use and protect your personal data. Last updated: January 2025.
YCBD Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO), Registration No. [XXXXXXXX].
Contact: privacy@ycbd.uk · YCBD Ltd, [Address], England, United Kingdom
Information you provide: Name, email address, delivery address, phone number, date of birth (for age verification), account password (hashed), and order history. Payment card details are processed by our PCI-DSS Level 1 compliant payment processor (Stripe); we never see or store your full card number.
Automatically collected data: IP address, browser type and version, pages visited, time spent, referring URLs, and device information — collected via cookies and server logs.
Communications: Content of emails, chat messages, or correspondence you send us.
We share your data only with trusted third parties necessary to operate our business:
All third-party processors are bound by GDPR-compliant data processing agreements. We never sell, rent, or trade your personal data to third parties for their own marketing purposes.
Some third-party providers (e.g., Google, Stripe) may transfer data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs).
You have the following rights, which you can exercise by contacting privacy@ycbd.uk:
We will respond to data rights requests within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk / 0303 123 1113.
We implement appropriate technical and organisational security measures to protect your data including: SSL/TLS encryption, PCI-DSS compliant payment processing, access controls, and regular security reviews. In the event of a data breach, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR.
Our website and products are not directed at persons under 18. We do not knowingly collect personal data from minors. If we discover we have inadvertently collected data from a person under 18, it will be promptly deleted.
We may update this Privacy Policy from time to time. Significant changes will be communicated via email or a prominent notice on our website. The date of the last update is shown above.
Data protection enquiries: privacy@ycbd.uk · YCBD Ltd, [Address], England, UK