Last updated: 8 October 2026
Your privacy matters to us. This policy explains what personal data we collect when you visit cannaraycbd.com, shop with us or hear from us, why we use it, who we share it with and the choices you have. It applies to customers and visitors in the UK and the European Union.
Privacy at a glance
- We never sell your personal data.
- We only send you marketing emails or texts if you’ve opted in, and you can unsubscribe at any time.
- We don’t build health profiles about you. If you choose to tell us about a health condition, we only use it to help with your enquiry.
- Our products are for adults only, and we don’t knowingly collect data from anyone under 18.
- You can ask to see, correct or delete your data at any time by emailing hello@cannaray.co.uk.
1. Who we are
Cannaray Brands Limited (“Cannaray”, “we”, “us”, “our”) is the data controller responsible for your personal data. We are registered in England and Wales under company number 11926997, and our registered office is at 1 Bow Churchyard, London, EC4M 9DQ, United Kingdom.
If you have any questions about this policy or how we use your data, contact us at hello@cannaray.co.uk.
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and, where we offer our products to people in the EU, the EU General Data Protection Regulation (EU GDPR) and ePrivacy rules.
2. The personal data we collect
Information you give us
- Contact and identity details – your name, email address, phone number, billing and delivery addresses.
- Order details – the products you buy, order history, returns and refunds.
- Payment details – card payments are processed securely by our payment providers. We never see or store your full card number.
- Account details – your login details, preferences, subscriptions and loyalty points if you create an account or join the Cannaray Club.
- Age confirmation – your confirmation that you’re 18 or over, and your date of birth if you share it with us (for example, for birthday rewards).
- Communications – messages you send our customer care team, reviews, survey responses and competition or giveaway entries.
- Marketing preferences – whether you’ve opted in to emails or texts, and when.
Information we collect automatically
- Device and usage data – your IP address, browser and device type, approximate location, the pages you visit, products you view and how you arrived on our site. We collect this using cookies and similar technologies (see section 11).
- Email and SMS engagement – whether you open our emails or click links in them, so we can improve what we send.
Information from third parties
- Payment and fraud-prevention providers, including Klarna if you choose to pay with Klarna.
- Delivery partners, such as Royal Mail, with updates about your parcel.
- Advertising, social media and affiliate partners, such as Meta, Google and Rakuten Advertising, for example when you click one of our ads or arrive from a partner website.
- Review platforms, if you leave a review of our products.
3. CBD, wellness products and your health information
Because we sell CBD and wellness supplements, we take extra care with information that could relate to your health.
- Purchases: The products you buy are not, on their own, information about your health. We don’t use your order history to work out or record health conditions, and we don’t sell or share your order history with advertisers to target you based on health.
- Health information you choose to share: If you tell us about a health condition, medication, pregnancy or a reaction to a product (for example, in an email, review or survey), this is “special category” data. We only use it to respond to you, handle your query or complaint, and meet our legal obligations, and we limit who can see it. Where required, we’ll ask for your explicit consent. Please only share health details if you’re comfortable doing so.
- Product safety and regulatory requirements: Our CBD food supplements are subject to UK food law, including the Food Standards Agency (FSA) Novel Foods regime. If you report a suspected adverse reaction or product safety issue, we may need to record it and share relevant details with the FSA, local authorities or other regulators, as required by law.
- Age restrictions: Our products are only for adults aged 18 and over. We ask you to confirm your age when you order, and we may ask for proof of age where needed.
- Medical advice: We’re not able to give medical advice. If you have a health condition, are pregnant or breastfeeding, or take medication, please speak to your doctor before using our products.
4. How we use your data and our lawful bases
Data protection law requires us to have a lawful basis for each way we use your personal data.
- To process and deliver your orders, handle returns and refunds, and provide customer care – performance of our contract with you.
- To manage your account, subscriptions and Cannaray Club rewards – performance of our contract with you.
- To send you marketing emails and texts – your consent. You can withdraw it at any time.
- To show you relevant ads on other websites and social media, and use non-essential cookies – your consent, given through our cookie banner.
- To send review requests and service messages about your order – our legitimate interests in delivering a good service and gathering genuine feedback.
- To understand how our website is used, fix problems and improve our products and services – our legitimate interests, and your consent where required for cookies.
- To prevent fraud and keep our website secure – our legitimate interests and legal obligations.
- To keep tax and accounting records, confirm customers are 18 or over, meet food safety and regulatory requirements, and respond to lawful requests – legal obligations.
- To handle health information you choose to share – your explicit consent, or where necessary to establish, exercise or defend legal claims or meet our legal obligations.
- To run competitions, giveaways and promotions – performance of our contract with you (the promotion’s terms).
Where we rely on legitimate interests, we balance our interests against your rights and freedoms, and you can object at any time (see section 9).
We don’t make decisions about you based solely on automated processing that have a legal or similarly significant effect on you. Our payment and fraud-prevention providers may use automated checks to approve or decline a payment. If that happens, you can contact us to ask for a person to review the decision.
5. Marketing
We’ll only send you marketing emails or texts if you’ve opted in, for example by ticking a box at checkout or signing up on our website. You can change your mind at any time by:
- clicking “unsubscribe” in any of our emails;
- replying STOP to any of our texts; or
- emailing hello@cannaray.co.uk.
It may take up to 2 working days for the change to take effect. You’ll still receive service messages about your orders. Standard message and data rates may apply to texts.
6. Who we share your data with
We only share your personal data where we need to, and we require our service providers to keep it secure and only use it on our instructions. We share data with:
- Shopify – our e-commerce platform, which hosts our website and processes orders and payments. Shopify Privacy Policy
- Payment providers, including Klarna if you choose to pay with Klarna. Klarna may use your details to assess your eligibility for its payment methods and acts as an independent controller. Klarna Privacy Notice
- Delivery and fulfilment partners, including our warehouse and Royal Mail, to pack and deliver your order.
- Klaviyo – to send our emails and texts and manage your marketing preferences. Klaviyo Privacy Policy
- Yotpo – to collect and display product reviews and run our loyalty and SMS programmes. Yotpo Privacy Policy
- Analytics and advertising partners, including Google, Meta (Facebook and Instagram) and Criteo, only where you’ve agreed to marketing cookies. These partners may act as independent controllers. See section 11.
- Rakuten Advertising – to track and reward sales from our affiliate partners. Rakuten Advertising Privacy Policy
- IT, customer service and professional advisers, such as our lawyers, accountants and insurers, where needed.
- Regulators, law enforcement and public authorities, such as the Food Standards Agency, HMRC, the police or the courts, where the law requires it or to protect our rights, customers or others.
- A buyer or investor, if we sell, merge or restructure all or part of our business. Your data would remain protected under this policy.
We never sell your personal data.
7. International transfers
Some of our service providers, including Shopify, Klaviyo and Google, store or access data outside the UK and EU, for example in Canada and the United States. When this happens, we make sure your data is protected by:
- sending it to countries the UK or EU has confirmed provide adequate protection (such as Canada, and US companies certified under the UK Extension to the EU-US Data Privacy Framework); or
- using approved contracts, such as the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.
Contact us if you’d like more information about these safeguards.
8. How long we keep your data
We only keep your personal data for as long as we need it:
- Order and payment records – 6 years after the end of the financial year of your purchase, to meet tax and accounting rules.
- Your account – until you close it, or after a long period of inactivity.
- Marketing preferences – until you unsubscribe. After that, we keep a minimal record so we don’t contact you again.
- Customer care messages – as long as needed to resolve your enquiry and deal with any follow-up.
- Product safety and adverse reaction reports – as long as required by food safety law and regulators.
- Cookies – for the periods set by each cookie (see section 11).
When we no longer need your data, we delete or anonymise it securely.
9. Your rights
Under UK and EU data protection law, you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that’s inaccurate or incomplete;
- delete your data in certain circumstances;
- restrict how we use your data in certain circumstances;
- object to us using your data based on legitimate interests, and to direct marketing at any time;
- data portability – receive the data you gave us in a commonly used format, or ask us to send it to someone else;
- withdraw your consent at any time, where we rely on consent. This won’t affect anything we did before you withdrew it; and
- not be subject to decisions based solely on automated processing that significantly affect you.
To use any of these rights, email hello@cannaray.co.uk. We may need to confirm your identity before we respond. We’ll reply within one month, or tell you if we need longer (up to two further months for complex requests). There’s usually no charge.
10. Complaints
If you’re unhappy with how we’ve handled your personal data, please contact us first at hello@cannaray.co.uk with the subject line “Data protection complaint”. We’ll acknowledge your complaint within 30 days, look into it without undue delay and let you know the outcome.
You also have the right to complain to a data protection regulator:
- UK: the Information Commissioner’s Office (ICO), ico.org.uk/make-a-complaint or 0303 123 1113.
- EU: the data protection authority in the country where you live or work, or where you think the issue happened. You can find yours on the European Data Protection Board website.
11. Cookies and similar technologies
Cookies are small text files stored on your device when you visit a website. We and our partners also use similar technologies, such as pixels and local storage. Together, we call these “cookies”.
Your choices
When you first visit our website, our cookie banner lets you accept or reject non-essential cookies. We only set analytics, personalisation and marketing cookies if you agree, or where UK law allows certain low-risk analytics cookies without consent, in which case you can still opt out. You can change your choices at any time using the cookie preferences link in our website footer, or by clearing cookies in your browser settings. Blocking strictly necessary cookies may stop parts of our website, like your basket and checkout, from working.
The cookies we use
- Strictly necessary – essential for the website to work, such as keeping items in your basket, checkout, logging in and remembering your cookie choices. Set by Shopify (for example _secure_session_id, cart, cart_sig, cart_ts, checkout_token, secure_customer_sig, _cmp_a). These don’t need your consent.
- Analytics – help us understand how visitors use our website so we can improve it. Set by Shopify (for example _shopify_y, _shopify_s, _orig_referrer, _landing_page) and Google Analytics (_ga, _ga_*).
- Personalisation – remember your preferences and show you relevant content and offers on our website, including review and loyalty features from Yotpo, and on-site sign-up forms from Klaviyo (__kla_id).
- Marketing and advertising – used by our advertising partners to show you relevant ads on other websites and social media, and to measure how well our ads work. Set by Meta (_fbp), Google Ads (_gcl_au, IDE), Criteo and Rakuten Advertising (rmuid, which helps us reward affiliate partners and lasts up to 365 days).
Cookies last for different lengths of time, from the end of your browsing session up to around two years. Third-party cookies are controlled by the providers listed above. You can find out more in their privacy policies: Google, Meta, Criteo and Rakuten Advertising.
To learn how to manage cookies in your browser, visit the ICO’s guide to cookies. You can also opt out of Google Analytics with the Google Analytics opt-out browser add-on.
12. Children
Our website and products are for adults aged 18 and over. We don’t knowingly collect personal data from anyone under 18. If you think we’ve collected data from a child, please contact us at hello@cannaray.co.uk and we’ll delete it.
13. Keeping your data secure
We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, secure payment processing that meets PCI-DSS standards, and limiting access to people who need it. No method of sending data over the internet is completely secure, but we work hard to protect your information. If a data breach is likely to put your rights at high risk, we’ll tell you and the relevant regulator as required by law.
14. Links to other websites
Our website may link to other websites, such as social media platforms and partner sites. We’re not responsible for how they handle your data, so please read their privacy policies.
15. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top. If we make significant changes, we’ll let you know, for example by email or a notice on our website.
16. Contact us
Questions about this policy or your personal data? Email hello@cannaray.co.uk or write to us at Cannaray Brands Limited, 1 Bow Churchyard, London, EC4M 9DQ, United Kingdom.
