PRIVACY POLICY AND DATA PROTECTION NOTICE
Last Updated: February 06, 2025
- Introduction and Overview
1.1 Policy Scope This Privacy Policy and Data Protection Notice (“Policy”) is issued by and applies to The London Dispensary, Company Number 13734124, registered in England and Wales (“Company,” “we,” “our,” or “us”). This Policy governs the collection, processing, storage, use, and disclosure of personal information through our website www.thelondondispensary.com (“Website”), associated services, and business operations.
1.2 Policy Updates This version supersedes and replaces all previous versions. The Company reserves the right to amend this Policy at any time to reflect changes in applicable law, our practices, or the features of our services. Material changes will be communicated through appropriate channels, and continued use of our services following such changes constitutes acceptance of the updated Policy.
- Definitions and Interpretations
2.1 Statutory Definitions For the purposes of this Policy, the following terms shall have the meanings assigned to them under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018:
2.1.1 “Personal Data”: Any information relating to an identified or identifiable natural person (‘Data Subject’).
2.1.2 “Processing”: Any operation performed on Personal Data, whether automated or not.
2.1.3 “Controller”: The natural or legal person determining the purposes and means of Processing.
2.1.4 “Processor”: A natural or legal person who Processes Personal Data on behalf of the Controller.
2.1.5 “Special Category Data”: Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a natural person’s sex life or sexual orientation.
2.2 Additional Definitions The following additional definitions apply throughout this Policy:
2.2.1 “Service”: The website, applications, communications, and related services provided by the Company.
2.2.2 “User”: Any individual accessing or using the Service.
2.2.3 “Device”: Any internet-connected device used to access the Service.
2.2.4 “Cookie”: A small text file stored on a User’s Device.
- Information Collection and Processing
3.1 Categories of Personal Data The Company collects and processes the following categories of Personal Data:
3.1.1 Identity and Contact Information a) Full name b) Postal address c) Email address d) Telephone number e) Username and password f) Communication preferences
3.1.2 Technical and Usage Data a) Internet Protocol (IP) address b) Device identifiers c) Browser type and version d) Operating system and platform e) Time zone setting and location f) Browser plug-in types and versions g) Access times and dates h) Page views and browsing patterns i) Referral source and exit pages
3.1.3 Transaction and Financial Data a) Purchase history b) Order details c) Transaction identifiers d) Shipping information e) Transaction confirmation records Note: Payment card details are not stored by the Company but are processed directly by authorized payment processors.
3.2 Legal Bases for Processing
3.2.1 Contractual Necessity Processing necessary for the performance of a contract to which the Data Subject is party, including: a) Processing orders b) Managing accounts c) Providing customer service d) Fulfilling legal obligations related to purchases
3.2.2 Legal Obligation Processing necessary for compliance with legal obligations, including: a) Financial record keeping b) Tax compliance c) Anti-money laundering regulations d) Consumer protection requirements
3.2.3 Legitimate Interests Processing necessary for the legitimate interests pursued by the Company or third parties, including: a) Fraud prevention and detection b) Network and information security c) Business development and improvement d) Marketing analysis and optimization
3.2.4 Consent Processing based on specific, informed, and unambiguous consent, including: a) Marketing communications b) Cookie usage (where not strictly necessary) c) Location data processing d) Personalization preferences
- Technical and Organizational Security Measures
4.1 Infrastructure Security
4.1.1 Server Infrastructure a) Dedicated Amazon Web Services (AWS) infrastructure b) Geographic data residency within the EU/UK c) Regular security patching and updates d) Access control and authentication protocols e) Intrusion detection and prevention systems
4.1.2 Network Security a) Cloudflare enterprise-grade protection b) DDoS mitigation c) Web application firewall d) SSL/TLS encryption for all data in transit e) Regular security audits and penetration testing
4.1.3 Application Security a) Wordfence security monitoring b) Real-time threat detection and blocking c) Automated security updates d) Regular vulnerability assessments e) Security incident response procedures
4.2 Data Security
4.2.1 Encryption Standards a) SHA-256 encryption for stored data b) AES-256 encryption for sensitive data at rest c) TLS 1.3 for data in transit d) Secure key management procedures
4.2.2 Access Controls a) Role-based access control b) Multi-factor authentication c) Regular access review and audit d) Principle of least privilege enforcement
- Data Retention and Deletion
5.1 Retention Periods
5.1.1 Statutory Retention a) Financial records: 7 years from transaction date b) Tax records: 7 years from end of tax year c) Anti-money laundering records: 5 years from transaction date d) Consumer contract information: 7 years from contract end
5.1.2 Operational Retention a) Active user accounts: Until deletion request or account closure b) Marketing data: Until consent withdrawal c) Security logs: 5 years for fraud prevention d) Analytics data: 26 months in anonymized form
5.2 Deletion Procedures
5.2.1 Automated Deletion a) Expired retention periods b) Abandoned cart data (30 days) c) Failed login attempts (7 days) d) Session data (24 hours)
5.2.2 Manual Deletion a) User request fulfillment b) Account closure c) Right to erasure requests d) Contractual termination
- Third-Party Data Processors
6.1 Authorized Processors
6.1.1 Payment Services a) Viva Wallet
- Purpose: Payment processing
- Data processed: Transaction details
- Location: EU data processing
b) Klarna
- Purpose: Payment processing and financing
- Data processed: Transaction and credit assessment data
- Location: EU data processing
6.1.2 Marketing and Analytics a) Klaviyo
- Purpose: Marketing automation
- Data processed: Contact and behavioral data
- Location: EU data processing
b) Google Analytics 4
- Purpose: Website analytics
- Data processed: Usage and performance data
- Location: EU data processing
c) Meta
- Purpose: Advertising
- Data processed: Hashed customer data
- Location: EU data processing
6.1.3 Security Services a) Cloudflare
- Purpose: Security and performance
- Data processed: Traffic and security data
- Location: Global infrastructure, EU primary
b) Wordfence
- Purpose: Security monitoring
- Data processed: Security logs
- Location: EU data processing
6.2 Processor Obligations
6.2.1 Data Processing Agreements All third-party processors are bound by: a) Written data processing agreements b) Confidentiality obligations c) Security requirements d) Sub-processor restrictions
6.2.2 Transfer Safeguards International data transfers are protected by: a) Standard contractual clauses b) Adequacy decisions c) Appropriate safeguards d) Transfer impact assessments
- User Rights and Control
7.1 Data Subject Rights
7.1.1 Access Rights a) Confirmation of processing b) Copy of personal data c) Processing information d) Supplementary information
7.1.2 Rectification Rights a) Correction of inaccurate data b) Completion of incomplete data c) Additional statements
7.1.3 Erasure Rights a) Withdrawal of consent b) Data no longer necessary c) Unlawful processing d) Legal obligation compliance
7.1.4 Restriction Rights a) Accuracy contestation b) Unlawful processing c) Legal claims d) Legitimate interests override
7.1.5 Portability Rights a) Structured format b) Machine-readable format c) Direct transmission where feasible
7.1.6 Objection Rights a) Direct marketing b) Legitimate interests c) Research purposes d) Automated decision-making
7.2 Exercise of Rights
7.2.1 Request Procedures Users may exercise their rights by: a) Email: [email protected] b) Post: 86-90 Paul Street, London, EC2A 4NE c) Online form: Available through account settings
7.2.2 Response Timelines a) Initial response: Within 72 hours b) Full response: Within one calendar month c) Extension if necessary: Up to two additional months d) Regular updates on progress
- Cookie Technology
8.1 Cookie Categories
8.1.1 Strictly Necessary Cookies a) Session management b) Security measures c) Load balancing d) User interface customization
8.1.2 Performance Cookies a) Analytics data b) Error monitoring c) Testing variations d) Performance measurement
8.1.3 Functionality Cookies a) User preferences b) Language settings c) Location customization d) Service personalization
8.1.4 Targeting Cookies a) Advertising delivery b) Marketing optimization c) Campaign measurement d) User profiling
8.2 Cookie Control
8.2.1 Consent Management a) Initial cookie notice b) Granular consent options c) Consent withdrawal d) Preference updates
8.2.2 Browser Controls Information on cookie control through browser settings
- Marketing Communications
9.1 Communication Channels
9.1.1 Email Marketing a) Promotional messages b) Newsletters c) Product updates d) Service announcements
9.1.2 WhatsApp Business Subject to separate WhatsApp Business Communication Policy
9.2 Consent Management
9.2.1 Obtaining Consent a) Express consent mechanisms b) Soft opt-in conditions c) Clear privacy notices d) Unsubscribe options
9.2.2 Withdrawal of Consent a) Unsubscribe links b) Preference centers c) Customer service channels d) Account settings
- Data Protection Officer
10.1 DPO Contact Details Data Protection Officer The London Dispensary 86-90 Paul Street London, EC2A 4NE Email: [email protected]
- Supervisory Authority
11.1 Regulatory Oversight Information Commissioner’s Office (ICO) Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Website: https://ico.org.uk Telephone: 0303 123 1113
- Governing Law and Jurisdiction
12.1 Applicable Law This Policy is governed by and construed in accordance with the laws of England and Wales.
12.2 Jurisdiction Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.
- Contact Information
13.1 Company Details The London Dispensary 86-90 Paul Street London, EC2A 4NE Email: [email protected] Company Registration Number: 13734124
This Policy was last updated on February 06, 2025, and supersedes all previous versions.
WhatsApp Messaging Terms of Service
The London Dispensary
Last updated: February 06, 2025
-
Introduction and Scope
1.1 Policy Overview This WhatsApp Business Communication Policy (“Policy”) establishes the terms, conditions, and practices governing the provision and use of WhatsApp Business messaging services (“Service”) by The London Dispensary (“Company,” “we,” “our,” or “us”), operating through the Meta WhatsApp Business Platform (“Platform”). This Policy forms a legally binding agreement between the Company and any individual engaging with our WhatsApp Business communications (“User,” “you,” or “your”).
1.2 Legal Framework This Policy operates in compliance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), Meta’s WhatsApp Business Terms of Service, and all applicable electronic communication regulations.
1.3 Policy Integration This Policy should be read in conjunction with our Privacy Policy, Website Terms of Use, General Terms and Conditions, and Cookie Policy. In the event of any conflict between this Policy and the aforementioned documents, the provisions of this Policy shall prevail in respect of WhatsApp Business communications.
-
Service Description and Implementation
2.1 Communication Categories The Company utilizes the Service for the following categories of communications:
2.1.1 Transactional Communications a) Order confirmations and updates b) Shipping and delivery notifications c) Payment confirmations and receipts d) Account security alerts e) Service-related updates f) Appointment confirmations and reminders
2.1.2 Customer Service Communications a) Support inquiry responses b) Technical assistance c) Product information d) Return and refund processing e) Account-related support
2.1.3 Marketing Communications a) Promotional offers and discounts b) Product launches and updates c) Event invitations and notifications d) Loyalty program communications e) Personalized recommendations
2.2 Communication Frequency and Timing The Company implements the following communication protocols:
2.2.1 Transactional Messages Sent immediately upon triggering events within standard business hours (9:00 AM – 10:00 PM GMT)
2.2.2 Customer Service Messages Delivered during active support sessions or within 24 hours of inquiry receipt
2.2.3 Marketing Messages Limited to a maximum of four (4) messages per calendar week, subject to user preferences
-
Consent Management and User Control
3.1 Consent Requirements The Company obtains and maintains consent through the following mechanisms:
3.1.1 Express Consent Users must provide explicit, informed consent through one of the following methods: a) Website opt-in verification b) Direct WhatsApp account confirmation c) Written consent documentation d) Electronic consent validation
3.1.2 Consent Records The Company maintains comprehensive records of: a) Consent timestamp and method b) Scope and duration of consent c) Associated preferences and limitations d) Consent withdrawal history
3.2 Opt-Out Procedures Users may withdraw consent through multiple channels:
3.2.1 Direct Methods a) Sending “STOP” to our WhatsApp Business account b) Using WhatsApp’s blocking features c) Updating communication preferences in user account settings
3.2.2 Alternative Methods a) Emailing [email protected] b) Submitting a request through our website c) Contacting customer service
- Data Processing and Protection
4.1 Data Collection and Usage The Company processes the following data categories:
4.1.1 User Data a) WhatsApp telephone numbers b) Profile information c) Communication history d) Preference settings e) Engagement metrics
4.1.2 Technical Data a) Device information b) Message delivery status c) Usage patterns d) Platform metrics
4.2 Data Protection Measures The Company implements comprehensive security measures:
4.2.1 Technical Security a) End-to-end encryption b) Secure data storage c) Access control protocols d) Regular security audits
4.2.2 Organizational Security a) Staff training and awareness b) Access restriction protocols c) Data handling procedures d) Incident response plans
- Service Limitations and Liability
5.1 Service Availability The Company does not guarantee uninterrupted Service availability. Temporary service interruptions may occur due to: a) Platform maintenance b) Technical issues c) Network problems d) Regulatory requirements,
5.2 Limitation of Liability To the extent permitted by law, the Company shall not be liable for: a) Message delivery failures b) Communication delays c) Platform functionality issues d) Third-party service interruptions e) Consequential losses or damages
- Compliance and Monitoring
6.1 Regulatory Compliance The Company maintains compliance with: a) Data protection regulations b) Electronic communication laws c) Consumer protection requirements d) Platform policies and guidelines
6.2 Quality Assurance Regular monitoring and assessment of: a) Communication effectiveness b) User engagement metrics c) Compliance standards d) Service performance
- Dispute Resolution
7.1 Complaint Procedures Users may submit complaints through: a) Email: [email protected] b) Website contact form c) Customer service channels
7.2 Resolution Timeline The Company aims to resolve complaints within: a) Initial response: 24 hours b) Resolution: 5 business days c) Complex issues: 14 business days
- Modifications and Updates
8.1 Policy Changes The Company reserves the right to modify this Policy at any time. Changes will be communicated through: a) WhatsApp notification b) Email notification c) Website announcement d) In-app notification
8.2 Change Implementation Material changes will be implemented with: a) Advance notice where practical b) Clear communication of changes c) Updated consent requirements if necessary d) Transition period where appropriate
- Governing Law and Jurisdiction
9.1 Applicable Law This Policy is governed by and construed in accordance with the laws of England and Wales.
9.2 Jurisdiction Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.
- Contact Information
10.1 Company Details The London Dispensary 86-90 Paul Street London, EC2A 4NE Email: [email protected] Company Registration Number: 13734124
10.2 Data Protection Officer Email: [email protected]
This Policy was last updated on February 06, 2025, and supersedes all previous versions.
