Last updated: 26 October 2026
This policy explains what personal data is processed when you visit hemppy.com or contact us, why, and what rights you have. Hemppy is an information website about CBD oils and CBD gummies. We do not sell products, and our partner shop is not open yet.
1. Who is responsible
The controller is Astotnieks LLC, Darzauglu street 1, Riga, Latvia.
You can reach us through our contact form, or by post at the address above.
2. Visiting the website
When you open a page, your browser sends technical data to the server: your IP address, the date and time, the page requested (including any search term you typed into our search box), the referring page, and browser and device information. Our hosting provider records this in server logs.
- Purpose: delivering the website, keeping it secure and preventing abuse.
- Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, working website.
- Storage: the logs are kept by the hosting provider for a limited period under its retention settings and then deleted, unless they are needed to investigate a security incident.
The website is delivered through our hosting provider’s content delivery network. Your request can be answered by a server close to you, which may be outside the European Economic Area (see section 6).
3. Country detection
To show the right version of a page, the website may work out your country from your IP address at the moment of the request. We do not store the IP address or the country for this, and we do not set a cookie for it.
- Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is showing the correct version of a page and, when our shop opens, not promoting products in countries where that is not permitted.
4. Contacting us
If you use the contact form or email us, we process your name, email address, the subject you choose, your message and anything else you include. The contact form has a simple arithmetic spam check; it does not use any external captcha service.
- Purpose: answering you and dealing with your request.
- Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is answering enquiries. If your enquiry concerns a contract with us (for example a business partnership), also Art. 6(1)(b) GDPR.
- Where it goes: contact form messages are sent by email to our business mailbox, which is hosted by Hostinger. A copy is also kept in a restricted email log in the website’s database, which holds at most the 200 most recent emails sent by the website and can be seen only by site administrators.
- Storage: we keep messages for as long as we need them to deal with your request and any follow-up, and delete them at the latest 24 months after our last contact with you, unless we need them longer to establish, exercise or defend legal claims.
- Giving us your data is voluntary, but without an email address we cannot reply.
5. Who receives data
- Hosting, content delivery and email: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Hostinger hosts the website, its database and server logs, runs the content delivery network and hosts our email. It acts as our processor under a data processing agreement (Art. 28 GDPR).
- Authorities: only where we are legally required to disclose data.
We do not sell personal data and do not share it for advertising.
6. Transfers outside the EEA
Hostinger’s data processing agreement provides that the European Commission’s standard contractual clauses (Decision (EU) 2021/914) apply where data is transferred to a country outside the EEA without an adequacy decision. You can ask us for more information using the contact details in section 1.
7. What we do not use
- No analytics, advertising or social-media tracking tools, and no tracking pixels.
- No externally loaded fonts: our fonts are stored on our own server.
- No embedded videos, maps or social-media posts.
- No user comments and no profile pictures (Gravatar).
- No automated decision-making or profiling with legal or similarly significant effects (Art. 22 GDPR).
8. Links to other websites
Our guides link to sources such as regulators and scientific publications. When our shop opens, “Buy” links will take you to the websites of partner brands. Those websites are run by others, who process your data under their own privacy policies. Please read them when you visit. More about how shop links will work is in our Affiliate Disclosure.
9. Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format, where the legal conditions are met (Art. 20).
Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests, you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data for legal claims.
To use your rights, use our contact form or write to us at the address in section 1. We may ask you to confirm your identity first.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where an alleged infringement took place. In Latvia this is the Data State Inspectorate (Datu valsts inspekcija), www.dvi.gov.lv.
10. Security
The website is served only over an encrypted connection (HTTPS). Access to the website administration and to the email log is limited to the people who need it.
11. Changes
We will update this policy when our processing changes, for example when our shop opens or if we add a newsletter. The date at the top shows the current version.