This Privacy Policy describes how your personal information is collected, used, and shared when you visit or make a purchase from https://www.col-care.com, https://www.gocannabist.com or other websites owned and operated by Columbia Care (the “Sites”).
Certain uses or disclosure of personal information may be governed by state law and other privacy notices. Please see the information below regarding California and Illinois.
PERSONAL INFORMATION WE COLLECT
For purpose of this Privacy Policy “personal information” means information that may identify you as an individual. This includes Device Information and Order Information.
When you visit the Sites, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Sites, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Sites, and information about how you interact with the Sites. We refer to this automatically-collected information as “Device Information.”
We collect Device Information using the following technologies:
“Cookies” are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit https://www.allaboutcookies.org.
“Log files” track actions occurring on the Sites, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
Additionally, when you make a purchase, attempt to make a purchase or request information from us through the Sites, we collect certain information from you, including your name, billing address, shipping address, payment information (including credit card numbers and/or bank account information, email address, and phone number. We refer to this information as “Order Information.”
HOW DO WE USE YOUR PERSONAL INFORMATION?
We use the Order Information that we collect generally to fulfill any orders placed through the Sites (including processing your payment information, arranging for shipping, and providing you with invoices and/or order confirmations). Additionally, we use this Order Information to:
Communicate with you;
Screen our orders for potential risk or fraud; and
When in line with the preferences you have shared with us, provide you with information or advertising relating to our products or services.
We use the Device Information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our Sites (for example, by generating analytics about how our customers browse and interact with the Sites, and to assess the success of our marketing and advertising campaigns).
SHARING YOUR PERSONAL INFORMATION
We share your personal information with third parties to help us use your personal information, as described above. For example, we use BigCommerce to power our online store–you can read more about how BigCommerce uses your personal information here: https://www.bigcommerce.com/privacy/.
We use Jane Technologies, Inc. to power our website reservation system. You can read more about how Jane Technologies uses your personal information here: https://www.iheartjane.com/privacy-policy. We also use Google Analytics to help us understand how our customers use the Sites–you can read more about how Google uses your Personal Information here: https://www.google.com/intl/en/policies/privacy/. You can also opt-out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.
We also use Content Square, a solution which aggregates usage and frequency data to improve user experience. Statistics created are anonymous.
Finally, we may also share your personal information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.
BEHAVIORAL ADVERTISING
As described above, we use your personal information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at https://www.networkadvertising.org/understanding-online-advertising/how-does-it-work
COMMON LINKS INCLUDE:
FACEBOOK – https://www.facebook.com/settings/?tab=ads
GOOGLE – https://www.google.com/settings/ads/anonymous
BING – https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads
MINORS
The Sites are not intended for individuals under the age of 21
DO NOT TRACK
Please note that we do not alter our Sites’ data collection and use practices when we see a Do Not Track signal from your browser.
YOUR RIGHTS
You may always direct us not to share your personal information with third parties, not to use your personal information to provide you with information or offers, or not to send you communications by contacting us by: (i) email at privacy@col-care.com or (ii) following the removal instructions in the communication that you receive. Your opt-out request will be processed within 30 days of the date on which we receive it.
If you wish to verify, correct, or update any of your Personal Information collected through the Sites, you may contact us by mail at the address below or e-mail at privacy@col-care.com. In accordance with our routine record keeping, we may delete certain records that contain Personal Information you have submitted through the Sites. We are under no obligation to store such Personal Information indefinitely and disclaim any liability arising out of, or related to, the destruction of such Personal Information. In addition, you should be aware that it is not always possible to completely remove or delete all your information from our databases without some residual data because of backups and other reasons.
If you are a European resident, you have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. If you would like to exercise this right, please contact us through the contact information below.
Additionally, if you are a European resident, we note that we are processing your information in order to fulfill contracts we might have with you (for example if you make an order through the Sites), or otherwise to pursue our legitimate business interests listed above. Additionally, please note that your information will be transferred outside of Europe, including to Canada and the United States.
DATA RETENTION
When you place an order through the Sites, we will maintain your Order Information for our records unless and until you ask us to delete this information.
SECURITY OF YOUR INFORMATION
We use certain reasonable security measures to help protect your Personal Information or other information which we may obtain from your use of the Sites. However, no electronic data transmission or storage of information can be guaranteed to be 100% secure. Please note that we cannot ensure or warrant the security of any information you transmit to us or other information which we may obtain from your use of the Sites, and you use the Sites and provide us with your information at your own risk.
OTHER SITES
The Sites may contain links to other sites that we do not own or operate. This includes links from service providers, advertisers, sponsors and partners that may use our logo(s) as part of a co-branding agreement. We do not control, recommend or endorse, and are not responsible for these sites or their content, products, services or privacy policies or practices. These other websites may send their own cookies to your Device, they may independently collect data or solicit Personal Information and may or may not have their own published privacy policies. You should also independently assess the authenticity of any site which appears or claims that it is one of our sites (including those linked to through an email or social networking page).
CALIFORNIA RESIDENTS
California residents have certain rights regarding our collection and use of personal information under the California Consumer Privacy Act (“CCPA” or the “Act”). For purposes of this “CCPA Section,” the term “personal information” means personal information under Cal. Civ. Code 1798.140(o). To the extent that any other provision of this Privacy Policy conflicts a provision of this CCPA Section, the provision in this section controls as to California residents.
Rights:
California residents may:
Request that we delete their personal information.
Opt-out of the sale of their personal information.
Request information about:
(i) the categories and specific pieces of personal information we have collected about them;
(ii) the categories of sources from which we have collected their personal information;
(iii) the business or commercial purpose for collecting or selling their personal information;
(iv) the categories of personal information we have sold about them; and
(v) the categories of third parties with whom we have shared, disclosed for a business purpose, or sold their personal information, and which categories of personal information we have sold to which categories of third parties.
We will not discriminate against California residents for exercising their rights under the CCPA. Consistent with Section 1798.125 of the Act, we may charge California Residents different prices, or provide different levels or quality of goods or services, if the difference is reasonably related to the value of your data. We may also offer financial incentives for the collection, sale, or deletion of your personal information.
Requests for Information
California residents may request that we provide certain information about our use of their personal information, as specified above. Upon receiving a request from a California resident, we will take reasonable steps to verify the person’s identity. We will respond to a verified person’s request by: (a) providing the requested information; or (b) explaining to the requestor why the Act does not require us to provide the requested information.
We will respond to requests for information within 45 days. If a response requires additional time, we will notify the requestor of the basis for the delay and may extend our response period up to an additional 90 days. If the Act requires us to provide the information requested to the person, we will provide the information covering the 12 months preceding the request, free of charge, and in a readily useable portable format. We have no obligation to provide personal information to a California resident more than twice in a 12-month period. If a request or series of requests are manifestly unfounded or excessive, we may charge a reasonable fee for processing the request(s) or may refuse to process the request(s).
Requests to Opt Out
California users may opt out of the sale of their personal information by contacting us at privacy@col-care.com.
Once we have received a directive from a California resident to not sell their personal information, we will not sell their personal information unless and until the person subsequently provides express authorization for the sale of their personal information. We will not ask for their for permission to sell their personal information for 12 months after receiving a request to opt out. We will only use information that they provided in submitting a request to opt out for purposes of processing the opt-out request.
Requests to Delete
California residents may request that we delete their personal information. Upon receiving a request from a California resident, we will take reasonable steps to verify the person’s identity. We will respond to a verified person’s request by: (a) deleting their personal information and, if applicable, directing our service providers to delete their personal information; or (ii) explaining to the requestor why the Act does not require us to delete their personal information.
If a request or series of requests are manifestly unfounded or excessive, we may charge a reasonable fee for processing the request(s), or may refuse to process the request(s).
ILLINOIS RESIDENTS
If you are a medical cannabis patient in Illinois, personal information about you that constitutes Protected Health Information (PHI) pursuant to the Health Insurance Portability and Accountability Act (HIPAA) is governed by our Notice of Privacy Practices for Illinois Medical Cannabis. You can access this Notice at https://col-care.com/notice-of-privacy-practices/
CHANGES
We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons.
This policy was last updated on January 11, 2022
CONTACT US
For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at privacy@col-care.com or by mail at:
Attn: Privacy/Legal
321 Billerica Road, Suite 204
Chelmsford, MA 01824
