Privacy Policy

We, clavacres GmbH, Burgstrasse 21, 5634 Merenschwand, Switzerland (hereinafter "clavacres"), hereby inform you about the processing of personal data in the context of the "edelcrowd" app, for which we are responsible within the meaning of the EU General Data Protection Regulation (GDPR). In addition to the option of contacting us by post, you can also contact us at any time via info@edelcrowd.com.

Below we have compiled the most important information for you on the data processing we carry out, broken down by app function. Where the term "data" is used in the text, this refers solely to personal data within the meaning of the GDPR.

When using the app (technical usage data)

When using the app, certain information is sent to the server of our website on the end device for technical reasons. This data is stored and processed on our server.

We process the following data for the purpose of providing the app content accessed, ensuring the security of the IT infrastructure used, troubleshooting and managing cookies
The processed data is HTTP data: HTTP data is protocol data that is generated for technical reasons when the app is used via the Hypertext Transfer Protocol (Secure) (HTTP(S)): This includes IP address, device identifier, operating system used, the language set, date and time of the call. HTTP(S) data is also collected on the servers of our service providers (e.g. when accessing third-party content).
The legal basis for the processing is our legitimate interest in the operation of the app (Art. 6 para. 1 lit. f) GDPR and § 25 para. 2 no. 2 TDDDG)
The data is provided automatically by the app.
We use service providers within the scope of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems. This may result in data being transferred to Switzerland. Switzerland is a so-called third country for which, however, an adequacy decision has been issued by the EU Commission (Art. 45 GDPR). For the cloud functions, we use in particular the Firebase service of the service provider Google Ireland Limited Gordon House, Barrow Street Dublin 4, Ireland by way of order processing. To protect your data, we have concluded the EU standard contractual clauses (2021/914; Module 2) with Google and agreed additional security precautions. You can request a copy of the key contractual content of the standard contractual clauses at any time. In addition, the Google companies (including Google LLC) are certified in accordance with the EU-US Data Privacy Framework (Art. 45 GDPR).
IP addresses are anonymized after 24 hours at the latest. Pseudonymous usage data is deleted after a period of six months.
It is not technically possible to use the app without disclosing personal data.

When creating and using an account

To join a growers' association or found a growers' association, users must first create an account. The membership fees for your growers' association can also be paid via the account.

We process your data for the purpose of creating and using a user account, which you can then use to interact in the app. The data from an ID document is only processed for the purposes of proof of age when an account is created. No copy of the ID document is stored.
The processed data are:

Name
Username
Profile picture
Contact details (address optional, e-mail address, telephone number)
Date of birth
Zip code
Order history
Communication with the growers' association
Data from ID document (e.g. biometric photo, ID number)
Photo or video for identification
Google ID or Apple ID when logging in via Google or Apple

The legal basis for the processing of your data is the contract for the use of the app (Art. 6 para. 1 lit. b) GDPR). The legal basis for any disclosure of data to offices and authorities is a legal obligation (Art. 6 para. 1 lit. c) GDPR, Section 26 para. 2 and 3 KCanG).
The data is actively provided by you.
We use service providers as part of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems. This may result in data being transferred to Switzerland. Switzerland is a so-called third country for which, however, an adequacy decision has been issued by the EU Commission (Art. 45 GDPR). In particular, we use the service provider Google Ireland Limited Gordon House, Barrow Street Dublin 4, Ireland for hosting by way of order processing. To protect your data, we have concluded the EU standard contractual clauses (2021/914; Module 2) with Google and agreed additional security precautions. You can request a copy of the key contractual content of the standard contractual clauses at any time. In addition, the Google companies (including Google LLC) are certified in accordance with the EU-US Data Privacy Framework (Art. 45 GDPR).

To establish your identity, we use the service provider mesoneer AG, Richtistrasse 17, 8304 Wallisellen, Switzerland by way of order processing. Switzerland is a so-called third country for which, however, an adequacy decision has been issued by the EU Commission (Art. 45 GDPR).

When you log in with your Google or Apple account, personal data is transmitted to Google Ireland Limited Gordon House, Barrow Street Dublin 4, Ireland or Apple Distribution International Ltd, Hollyhill Ln, Hollyhill Industrial Estate, Cork, T23 YK84, Ireland as the respective data controller within the meaning of data protection law. The collection and processing of this data takes place exclusively within the area of responsibility of Google and Apple. Data transfer to the USA cannot be ruled out. As independent controllers, Google and Apple are each responsible for ensuring suitable data protection guarantees for the data transfer. In addition, both companies are certified in accordance with the EU-US Data Privacy Framework (Art. 45 GDPR). Information about the processing of personal data by Google or Apple can be found in their privacy policies: https://policies.google.com/privacy?hl=de and https://www.apple.com/de/legal/privacy/data/de/sign-in-with-apple/.

For the purposes of joining a growers' association, we transmit data to the respective growers' association. This is its own controller in terms of data protection law. Information on the processing of personal data by the growers' associations can be found in their data protection provisions.

For payment processing, we transmit data to the payment service provider Stripe Payments Europe, Limited, 1 Grand Canal Street Lower Grand Canal Dock, Dublin, D02 H210, Ireland (hereinafter referred to as "Stripe") as our own controller within the meaning of data protection law. The collection and processing of this data takes place exclusively within Stripe's area of responsibility. A data transfer to the USA cannot be excluded. As an independent controller, Stripe is responsible for ensuring suitable data protection guarantees for the data transfer. In addition, Stripe is certified in accordance with the EU-US Data Privacy Framework (Art. 45 GDPR). Information on the processing of personal data by Stripe can be found in their privacy policy: Privacy Policy (stripe.com).

Data may also be transmitted to offices and authorities within the scope of their statutory duties.

You can delete your account yourself. The data stored there will also be deleted unless there is a legal obligation to retain it.
It is not possible to create an account without providing the data.

When using the platform functions

In the app, it is possible to share, like or comment on posts with other users. The username is visible to other club members. Further profile information is only shared with your consent .

We process your data for the purpose of providing a platform on which users can exchange information.
The processed data are:

Username
Profile picture
Posted content
First and last name
Contact details (address, e-mail address, telephone number)
Date of birth

The legal basis for the processing of your data is the contract for the use of the app (Art. 6 para. 1 lit. b) GDPR). The legal basis for the publication of first and last names, contact details and date of birth to other club members is your consent (Art. 6 para. 1 lit. a) GDPR). Consent is voluntary and can be withdrawn at any time with effect for the future.
The data is actively provided by you.
We use service providers within the scope of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems. This may result in data being transferred to Switzerland. Switzerland is a so-called third country for which, however, an adequacy decision has been issued by the EU Commission (Art. 45 GDPR)
You can delete your posts, comments and likes yourself.
It is not possible to use the platform functions without providing the data.

When making a reservation

You can use the app to reserve the permitted quantity of cannabis in your growers' association. You can collect it yourself.

We process your data for the purpose of carrying out and managing the reservation.
The processed data are:

Name
Username
Contact details (address optional, e-mail address, telephone number)
Date of birth
Reservation details: product, quantity, price
Membership of a growers' association

The legal basis for the processing of your data is the contract for the use of the app (Art. 6 para. 1 lit. b) GDPR). The legal basis for the storage of the data relevant for the reservation is a statutory retention obligation of the growers' associations for documentation purposes (Art. 6 para. 1 lit. c) GDPR, Section 26 para. 2 KCanG).
The data is actively provided by you.
We use service providers as part of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems. This may result in data being transferred to Switzerland. Switzerland is a so-called third country for which, however, an adequacy decision has been issued by the EU Commission (Art. 45 GDPR)

To carry out the purchase, we transmit data to the respective growers' association of which you are a member and with which your order is reserved. This is its own controller in terms of data protection law. Information on the processing of personal data by the growers' associations can be found in their data protection regulations.

You can delete your account yourself. The data stored there will also be deleted unless there is a legal obligation to retain it. Data used for documentation purposes for the growers' associations must be stored for 5 years.
It is not possible to make a reservation without providing this information.

When visiting the menu item "Information"

If you click on "Information" in the app menu, content from the infos-cannabis.de website will be loaded. This is an external information service provided by the Federal Center for Health Education (BZgA). Technically, the same happens as if you were to switch to the BZgA website via a link: the BZgA receives all the information that your device automatically transmits. This data is collected and processed exclusively within the area of responsibility of the BZgA, Maarweg 19-161, 50825 Cologne-Ehrenfeld. Information on the processing of personal data by the BZgA can be found in their data protection regulations: Infos-Cannabis.de | Privacy Policy: Infos-Cannabis.de.

Rights of data subjects and further information

We do not use any automated individual decision-making processes.
There are no plans to change the aforementioned purposes.
If your personal data is incorrect or incomplete, you have a right to rectification and completion.
You can request the deletion of your personal data at any time, unless we are legally obliged or entitled to continue processing your data.
If the legal requirements are met, you can request that the processing of your personal data be restricted.
You have the right to object to the processing insofar as the data processing is carried out for the purpose of direct advertising or profiling.
If the processing is based on a balancing of interests, you can object to the processing by stating reasons that arise from your particular situation.
If the data processing takes place on the basis of your consent or within the framework of a contract, you have the right to transfer the data you have provided, provided that this does not affect the rights and freedoms of other persons.
If we process your data on the basis of a declaration of consent, you have the right to revoke this consent at any time with effect for the future. The processing carried out before a revocation remains unaffected by the revocation.
You also have the right to lodge a complaint with a data protection supervisory authority at any time if you are of the opinion that data processing has taken place in breach of applicable law.

as of January 2025