Jonny Seeds’, operated by C.C.C. AgriSol vGmbH
Last updated: 25.11.2025

1. General Information

This Privacy & Cookie Policy explains how Jonny Seeds’, operated by C.C.C. AgriSol vGmbH, (“we”, “us”, “our”), processes personal data when you:

• visit our website www.jonny-seeds.com (the “Website”),
• create an account or place an order,
• subscribe to our newsletter, or
• otherwise interact with us (e.g. by email or social media).

It also explains:

• what personal data we collect,
• for which purposes and on what legal bases,
• how long we keep it,
• with whom we share it,
• how we use cookies and similar technologies, and
• what your rights are under the General Data Protection Regulation (GDPR) and applicable Luxembourg law.

2. Data Controller

• Company: C.C.C. AgriSol vGmbH, trading as “ Jonny Seeds’ ”
• Registered Office:
  3, Kabesbierg
  L-5741 Filsdorf
  Luxembourg
• RCS Number: B274943
• VAT ID: LU34726778
• Contact: js@jonny-seeds.com

We currently do not have a designated Data Protection Officer. For all privacy-related questions and requests, please use the contact details above. The competent data protection authority in Luxembourg is:

• Commission nationale pour la protection des données (CNPD)
  Website: www.cnpd.lu

You can lodge a complaint with the CNPD or with your local supervisory authority in the EU.

3. Categories of Data We Collect

We only collect personal data that is necessary for the purposes described in this Policy.

3.1 Account & Order Data
When you place an order or create a customer account, we process:

• first and last name,
• billing address and delivery address,
• email address,
• phone number (optional, e.g. for delivery updates),
• date of birth (for age verification where required for cannabis-related products),
• order details (products, quantities, prices, order date),
• delivery method,
• chosen payment method,
• technical identifiers related to the order (order number, invoice number),
• IP address and basic device data at the time of order (for security and fraud prevention).

We do not store full payment card numbers; these are handled by our payment service providers (see section 6).

3.2 Newsletter Subscription Data
If you subscribe to our newsletter, we process:

• email address,
• name or optional nickname
• country (e.g. for regional updates).

3.3 Customer Service & Communication Data
When you contact us (e.g. by email, contact form, social media), we process:

• your name and contact details,
• the content of your messages and any attachments,
• related order details (if your request concerns an order).

3.4 Website Usage, Cookies & Analytics Data

When you use our Website, we collect certain usage data, mainly via cookies and similar technologies (see section 7):

• IP address,
• device and browser type,
• operating system and basic device settings (e.g. language),
• pages viewed, time spent, clicks, and navigation paths,
• referrer (e.g. search engine, social media, external link),
• consent preferences (which cookies you accepted or rejected).

Depending on your cookie choices, some of this data is collected only with your conse

4. Purposes & Legal Basis for Processing

We process your data for the following purposes and on the following legal bases (Art. 6 GDPR):

If we later use your data for a purpose incompatible with the original one, we will inform you separately where required by law.

5. Data Retention

We keep your data only as long as necessary for the purposes listed above and to comply with legal obligations.

• Customer account data: as long as the account is active. If you request deletion, we will deactivate or delete the account, keeping only the data that we must retain by law (e.g. invoices) or for legitimate interests (e.g. ongoing claims).
• Order and invoice data: generally 10 years to comply with Luxembourg legal and tax record-keeping obligations.
• Newsletter data: until you unsubscribe or withdraw consent. We may keep minimal information (email + opt-out flag) to ensure we do not contact you again.
• Customer service data: generally up to 3 years after your last interaction, unless a longer period is needed for legal reasons (e.g. ongoing dispute).
• Website logs and security data: typically up to 12 months for security and fraud prevention, unless an incident requires longer retention.
• Cookie and analytics data: in accordance with the cookie’s lifespan (see section 7 and your browser settings).

6. Data Sharing & Third Parties

We do not sell your personal data. We only share it with:

6.1 Payment Service Providers
For processing payments, your data is shared with the payment provider you select at checkout, for example:

• [Name of card payment provider, e.g. Stripe] + Address + Link
• [Name of online payment service, e.g. PayPal] + Address + Link
• [Name of crypto payment processor, if used] + Address + Link

These providers process payment data as independent controllers or processors, according to their own terms and privacy policies. We do not store your full card numbers.

6.2 Fulfillment & Shipping Partners
To deliver your orders, we share your name, delivery address and, where required, your email address and/or phone number with:

• POST Luxembourg and other national postal operators;
• parcel and courier services (e.g. DHL, DPD, GLS or similar providers, depending on the destination country);
• third-party fulfilment partners who store, pack and ship merchandise or grow equipment on our behalf.

These partners use the data solely to provide logistics services (e.g. transport, tracking, returns handling).

6.3 Newsletter and Marketing Services
To send newsletters and other email communications, we use an external service provider:

• [MailerLite UAB] / [Mailchimp / Intuit Inc.] – [short description]. Privacy policy: [link].

This provider processes your email address (and optional data such as your name and country) to manage subscriptions, send emails and measure delivery/interaction (e.g. open and click rates). You can unsubscribe at any time via the link in each email.

6.4 Analytics & Cookie Tools
For website analytics and cookie consent, we may use:

• Google Analytics (GA4), with privacy controls such as IP anonymisation and data retention settings to support GDPR compliance. Google may process data on servers located outside the EU; we rely on appropriate safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
• CookieYes as our consent management platform (CMP) to manage cookie preferences. CookieYes Limited (UK) acts as a processor, and stores data in AWS data centres in compliance with GDPR, under a Data Processing Agreement between CookieYes (Processor) and us (Controller).

Analytics cookies and similar technologies are only used with your consent (see section 7).

6.5 Hosting & Technical Service Providers
Our Website is hosted and technically maintained by:

• [Name of hosting provider / WordPress hosting] + Address + Link
• [Any external IT / development service provider, if applicable] + Address + Link

These providers may process personal data (e.g. IP addresses in server logs) as processors according to our instructions.

6.6 Legal Obligations & Authorities
We may disclose data where required by law, court order or lawful request from a public authority, or to establish, exercise or defend legal claims.

7. Cookies & Tracking Technologies

We use cookies and similar technologies on our Website. A cookie is a small text file stored on your device when you visit a website. Cookies can be “session” cookies (deleted when you close your browser) or “persistent” cookies (stored for a defined period). We follow the CNPD’s cookie guidelines, which require: consent for non-essential cookies, clear information, and an easy way to change your settings.

7.1 Types of Cookies

Essential (necessary) cookies

• Purpose: basic site functionality (e.g. cart, login, security, language preference).
• Legal basis: our legitimate interest in providing a functional website and the service you request (Art. 6(1)(f) GDPR).
• Consent: not required, but you can block them in your browser (the site may not work properly).

Functional cookies

• Purpose: remember your preferences (e.g. saved address details, UI settings).
• Legal basis: legitimate interest or consent, depending on the cookie type.

Analytics cookies

• Purpose: understand how visitors use the site (e.g. pages visited, time on page), to improve content and usability.
• Legal basis: your consent, obtained via the cookie banner (Art. 6(1)(a) GDPR).
• If you do not consent, these cookies will not be set.

Marketing / advertising cookies

• Purpose: show relevant marketing or measure campaign performance (e.g. retargeting).
• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Currently: [state if you are using any, or write “We do not currently use marketing cookies on this Website” if true].

7.2 Cookie Banner & CookieYes
On your first visit, our cookie banner (powered by CookieYes) allows you to:

• accept all cookies,
• reject all non-essential cookies, or
• customise your choices per category.

You can change or withdraw your consent at any time by opening the Cookie Settings link (banner icon and/or at the bottom of this page) and adjusting your preferences.

7.3 Cookie Duration and List
Cookie lifetimes vary:

• session cookies: deleted when you close your browser,
• persistent cookies: stored for a defined period (e.g. 1 day, 1 month, 1 year).

A detailed list of cookies used on the Website (name, type, purpose, duration) is provided in the cookie table generated by CookieYes and accessible via the Cookie Settings link (banner icon and/or at the bottom of this page).

You can also manage cookies directly in your browser settings (delete existing cookies, block some or all cookies). Please note that blocking essential cookies may affect site functionality.

8. Your Rights Under GDPR

You have the following rights regarding your personal data, subject to the conditions and exceptions set out in GDPR:

• Right of access: obtain confirmation of whether we process your data and a copy of it.
• Right to rectification: have inaccurate or incomplete personal data corrected.
• Right to erasure (“right to be forgotten”): request deletion of your data where there is no legal ground for us to keep it.
• Right to restriction: request temporary restriction of processing in certain cases.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.
• Right to object: object to processing based on our legitimate interests, including profiling, and we will stop unless we have compelling legitimate grounds.
• Right to withdraw consent: where processing is based on your consent (e.g. newsletter, non-essential cookies), you can withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise your rights, please contact us at js@jonny-seeds.com or by mail at the address in section 2. We may ask you to prove your identity where necessary. You also have the right to lodge a complaint with the CNPD or your local supervisory authority (see section 2).

9. Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

• SSL/TLS encryption for data transmitted between your browser and our Website,
• access control and authentication for our systems,
• limiting access to personal data to staff and service providers who need it,
• secure backup and logging procedures,
• internal guidelines and awareness for handling customer data.

No system is completely secure, but we aim to keep your data as safe as reasonably possible.

10. International Transfers

Some of our service providers (e.g. Google, CookieYes, newsletter providers, or cloud hosting) may process personal data outside the European Economic Area (EEA).
In such cases, we ensure that appropriate safeguards are in place, such as:

• an adequacy decision by the European Commission (e.g. for certain countries), or
• Standard Contractual Clauses (SCCs) adopted by the Commission, possibly combined with additional technical and organisational measures.

You can contact us for more information about these safeguards.

11. Changes to this Policy

We may update this Privacy & Cookie Policy from time to time, for example to reflect changes in law, our services or processing activities.

The date of the latest version is indicated at the top (“Last updated”). Significant changes may be notified on the Website or by email where appropriate.

12. Contact & Complaints

For any questions, requests or concerns relating to this Policy or to your personal data, you can contact us at:

• Company: C.C.C. AgriSol vGmbH
  3, Kabesbierg
  L-5741 Filsdorf
  Luxembourg
• Email: js@jonny-seeds.com

You can also contact the CNPD at www.cnpd.lu.