When Austrian herbalists
met Luxembourg-based Artisans,
a new era in organic CBD was born

1. An overview of data protection

General information The following information will provide you with an easy to navigate overview of what will happen with your personal data when you visit www.lumecan.com. The term “personal data” comprises all data that can be used to personally identify you. For detailed information about the subject matter of data protection, please consult our Data Protection Declaration, which is included below. Data recording on our website Who is the responsible party for the recording of data on this website (i.e. the “controller”) The data on this website is processed by the operator of the website: Lumecan S.à.r.l.,  which is responsible of the recording data on the website as being the controller of the processed personal data. Its details are available under section 3 “Data Protection Declaration”. How do we (i.e Lumecan S.à.r.l.) record your data? We record your data:

• As a result of your sharing of your data with us. This may, for instance be information you enter into our contact form.
• Our systems automatically record other data when you visit our website. This data comprises primarily technical information (e.g. web browser, operating system or time the site was accessed). This information is recorded automatically when you access this website.

What are the purposes we use your data for? Your data may be used for the following purposes:

• To guarantee the error free provision of the website;
• For general business administration reasons;
• To analyze your user patterns;
• We may require you to provide us with certain personal data (e.g. age verification) to comply with regulatory and legal requirements.

What rights do you have as far as your information is concerned? Under the European legislation about personal data: the General Data Protection Regulation[1] (“GDPR”), each data subject is entitled to:

• The right to be informed (Art. 12, 13, 14 GDPR);
• The right of access (Art. 15 GDPR);
• The right to rectification (Art. 16 GDPR);
• The right to erasure, also known as “right to be forgotten” (Art. 17 GDPR);
• The right to restriction of processing (Art. 18 GDPR);
• The right to data portability (Art. 20 GDPR);
• The right to object (Art. 21 GDPR);
• Rights related to automated decision-making and profiling (Art. 22 GDPR);
• The right to lodge a complaint/claim with the authority for regulation and control, the Luxembourg National Data Protection Commission (C.N.P.D).

Under section 3 “Data Protection Declaration” of the present document, you will find more information about your user’s rights as data subject. If you want to exercise any of your rights or are dissatisfied with the way we have used your information, please contact us at personaldata@lag.lu or via letter at the following address: To the attention of the Personal Data Board Lumecan S.à.r.l 31, rue de Hollerich L-1741 Luxembourg Grand Duchy of Luxembourg Analysis tools and tools provided by third parties There is a possibility that your browsing patterns will be statistically analyzed when you visit this website. Such analyses are performed primarily with cookies and with what we refer to as analysis programs. As a rule, the analyses of your browsing patterns are conducted anonymously; i.e. the browsing patterns cannot be traced back to you. You have the option to object to such analyses or you can prevent their performance by not using certain tools. For detailed information about the tools and about your options to object, please consult our Data Protection Declaration below.  

2. Hosting

External Hosting This website is hosted by an external service provider (the “host”). Personal data collected on this website are stored on the servers of the host. These may include, but are not limited to, IP addresses, contact requests, metadata and communications, contract information, contact information, names, web page access, and other data generated through a web site. The host is used for the purpose of fulfilling the contract with our potential and existing customers and in the interest of secure, fast and efficient provision of our online services. The host will only process your data to the extent necessary to fulfil its performance obligations and following our instructions with respect to such data. Execution of a data processing agreement In order to guarantee processing data in compliance with the GDPR, we have concluded a Data Processing Agreement with the host, to secure the use of your personal data, as provided by Art. 28 of the GDPR.  

3. Data Protection Declaration

Data Protection Lumecan S.à.r.l. is committed to protecting the privacy and security of the personal data of visitors to our website www.lumecan.com (the “website”). Lumecan S.à.r.l. takes the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the GDPR and this Privacy Notice. Whenever you use this website, a variety of personal information will be collected. Personal data comprises data that can be used to personally identify you. This Privacy Notice explains which data we collect as well as the purposes we use this data for. It also explains how, and for which purpose the information is collected. We herewith advise you that the transmission of data via the Internet (i.e. through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third party access. Information about the responsible party of the personal data (referred to as the “controller” in the GDPR) The data processing controller on this website is: Lumecan S.à.r.l., 31, rue de Hollerich, L-1741 Luxembourg, Grand Duchy of Luxembourg. The controller is the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.). Designation of a Data Protection Officer as mandated by law (Art. 37 GDPR) We have appointed a Personal Data Board for our company (i.e. Lumecan S.à.r.l). If you want to exercise any of the rights described above, to have more information about a particular item or to withdraw your consent to the processing of your data, please contact us at personaldata@lag.lu or via letter at the following address: To the attention of the Personal Data Board Lumecan S.à.r.l. 31, rue de Hollerich L-1741 Luxembourg Grand Duchy of Luxembourg We will seek to deal with your request without undue delay and in any event in accordance with the requirements of the GDPR. Please note that we may keep a record of your communications to help us resolving any issue you raise.   Withdrawal of your consent to the processing of data (Art.7 GDPR) A wide range of data processing transactions are possible only subject to your express consent. You can also withdraw at any time any consent you have already given to us. To do so, you just have to notify us by e-mail or letter. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your withdrawal; it means that data processed before you withdraw your consent will be considered as lawfully collected. Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR) In the event that your data are processed on the basis of Art. 6 para. 1 lett. e) (i.e. processing of the data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) or lett. f) (i.e. processing of the data is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data, including profiling based on those provisions. To determine the legal basis on which any processing of data is based, please consult this Data Protection Declaration. If you lodge such an objection, we will then no longer process your affected personal data, unless we are in a position to demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR) If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you have your habitual residence, place of work or at the place where the alleged infringement occurred. Your right to lodge a complaint is without prejudice to any other administrative or judicial remedy which remains at your disposal. Right to data portability (Art. 20 GDPR) You have the right to demand that we transmit to you or a third party any data we automatically process on the basis of your consent or in order to fulfil a contract, in a structured, commonly used and machine-readable format. The direct transmission of the data to another controller can only be done if it is technically feasible. SSL and/or TLS encryption For security reasons and to protect the transmission of confidential content, such as purchase orders or inquiries you could submit to us as the website operator, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser switches from ”http://” to ”https://” and also by the appearance of the lock icon () in the browser line. If the SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties. Right to information about, rectification and erasure of data (Art. 12, 13, 14, 16 and 17 GDPR) Within the scope of the applicable statutory provisions, you have the right at any time to request information about your stored personal data, their source and recipients as well as the purpose of the processing of your data. You may also have the right to have your data rectified or erased. If you have questions about this subject matter or any other questions about personal data, please do not hesitate to contact us at any time at the address provided in this section under “Designation of a Data Protection Officer as mandated by law”. Right to demand processing restrictions (Art. 18 GDPR) You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time at the address provided in this section under “Designation of a Data Protection Officer as mandated by law”. The right to demand restriction of processing applies in the following cases:

• In the event that you should dispute the correctness of your data stored by us, we will usually need some time to verify this claim. During the time that this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data; or
• If the processing of your personal data was/is conducted in an unlawful manner, you have the option to demand the restriction of the processing of your data instead of demanding the erasure of this data; or
• If we no longer need your personal data and you need it to establish, exercise or defend legal claims, you have the right to demand the restriction of the processing of your personal data instead of its erasure; or
• If you have raised an objection pursuant to Art. 21, para. 1 GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data – with the exception of their storage – may be processed only with your consent, or to establish, exercise or defend legal claims, or to protect the rights of other natural or legal persons, or for reasons of important public interest of the European Union or of a Member State of the European Union.  

4. Recording of data on this website

Cookies Cookies are small text files that can be used by websites to make a user's experience more efficient. The law states that we can store cookies on your device if they are strictly necessary for the operation of our website. For all other types of cookies, we need your permission. This website uses cookies and stores cookies on your computer. Cookies are used to collect information about how you interact with our website and allow us to remember you. We use this information in order to improve and customize your browsing experience and for analytics and metrics about our visitors both on this website and other media. We may share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our necessary cookies if you continue to use our website. As we respect your right to privacy, you can choose not to allow some types of cookies (the ones not strictly necessary for the operation of this website). However, blocking some types of cookies may negatively impact your experience on the website and limit the services we are able to provide. Your consent applies to the following domains: www.lumecan.com The processing of data collected are storage of cookies are based on art. 6, para. 1, lett. f) GDPR: we as operator have a legitimate interest in the operation of our website, but also in the analysis of the users patterns to optimize both the services offered online and the operator’s advertising activities. For cookies other than strictly necessary cookies, the processing and storage are based on art. 6, para. 1, lett. a) GDPR: your consent, which you may withdraw at any time. Your current state: user’ choice about cookies Server log files  We, as operator of this website and its pages, automatically collect and store information in so-called server log files, which your browser communicates to us automatically. The information comprises:

• The type and version of browser used
• The used operating system
• Referrer URL
• The hostname of the accessing computer
• The time of the server inquiry
• The IP address.

These data are not merged with other data sources. The processing of these data is based on Art. 6, para. 1, lett. f) GDPR:  we, as  operator of the website, have a legitimate interest in the technically error free depiction and the optimization of our website. In order to achieve this, server log files must be recorded. Contact form If you submit inquiries to us via our contact form, the information provided in the contact form as well as any contact information provided therein will be stored by us in order to handle your inquiry and in the event that we have further questions. We will not transmit this information without your consent. The processing of these data is based on Art. 6, para. 1, lett. b) GDPR: processing of your data is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract with us. In all other cases, the processing is based on Art. 6 para. 1, lett. a) GDPR: you give us your consent, and/or on Art. 6, para. 1, lett. f) GDPR: our legitimate interest in the effective processing of the requests addressed to us. The data you have entered into the contact form shall remain with us until you request us to erase the data, withdraw your consent to the storage of data or if the purpose for which the data are stored no longer exists (e.g. after completion of your request). This shall be without prejudice to any mandatory legal provisions – in particular retention periods. Request by e-mail, phone or fax If you contact us by e-mail, phone or fax, your request, including all resulting personal data (name, details) will be stored and processed by us for the purpose of processing your request. We will not transmit this information without your consent. The processing of these data is based on Art. 6,  para. 1, lett. b GDPR: processing of your data is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract with us. In all other cases, the processing is based on Art. 6 para. 1, lett. a) GDPR: you give us your consent, and/or on Art. 6, para. 1, lett. f) GDPR: our legitimate interest in the effective processing of the requests addressed to us. The data you sent to us via contact requests shall remain with us until you request us to erase the data, withdraw your consent to the storage of data or if the purpose for which the data are stored no longer exists (e.g. after completion of your request). This shall be without prejudice to any mandatory legal provisions – in particular retention periods. Registration on this website You have the option to register yourself on this website to be able to use additional website functions. We shall use the data you enter only for the purpose of using the respective offer or service you have registered for. The required information we request at the time of registration must be entered in full. Otherwise we shall reject the registration. To notify you of any important changes to the scope of our portfolio or in the event of technical modifications, we shall use the e-mail address provided during the registration process. The processing of the data entered for the registration process is based on Art. 6 para. 1, lett. a) GDPR: you give us your consent. The data recorded during the registration process shall remain with us and be stored by us as long as you are registered on this website. Subsequently, such data shall be erased. This shall be without prejudice to any mandatory legal provisions – in particular retention periods. Processing of data (customer and contract data) We may collect, process and use personal data to the extent necessary for the establishment, content organization,  change of the legal relationship or inventory of customers’ complaints (data inventory). The processing of these data is based on Art. 6, para. 1, lett. b) GDPR: processing of your data is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract with us. We may collect, process and use personal data concerning the use of this website (usage data)to the extent that this is necessary to make it possible for users to see their requests properly handled. The processing of these data is based on Art. 6, para. 1, lett. b) GDPR: processing of your data is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract with us. In all other cases, the processing is based on Art. 6 para.1, lett. a): you give us your consent, and/or on Art. 6, para. 1, lett. f) GDPR: our legitimate interest in the effective processing of the requests addressed to us. Data transmission to third parties Your personal data will be treated confidentially. We may share your personal data with:

• Legal entities within our Group;
• Third parties who provide us or you with services or products (e.g. payment services providers, delivery providers, professional advisers, external consultants);
• Other third parties, where required or permitted by the law such as: public authorities, regulatory authorities, government departments, financial organizations, law enforcement agencies for the prevention or detection of fraud, tax authorities, if we consider disclosure necessary to protect and defend the rights, property or personal safety of Lumecan S.à.r.l, its people, its brand or other visitors to our website and in the context of a restructuring process.

We may decide to sell, buy, merge or re-organize our business for strategic or financial reasons. In this process, we may share your personal data with third parties or receive it as part of the mentioned transaction. Any further transmission of data shall not occur or shall only occur if you have expressly consented to the transmission. Any sharing of your data with third parties in the absence of your express consent, for instance for advertising purposes, shall not occur. The processing of these data may be based on Art. 6, para. 1, lett. b) GDPR: processing of your data is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract with us. It may also be based on Art. 6, para. 1., lett. c), GDPR: processing of your data is necessary for compliance with a legal obligation to which we are subject. The processing may again be based on Art. 6 para.1, lett. a): you give us your consent, and/or on Art. 6, para. 1, lett. f) GDPR: our legitimate interest in the effective processing of the requests addressed to us.  

5. Plug-ins and tools

Google reCAPTCHA We use „Google reCAPTCHA“ (hereinafter referred to as „reCAPTCHA“) on this website. The provider is Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland. The purpose of reCAPTCHA is to determine whether data entered on this website (e.g. information entered into a contact form) is being provided by a human user or by an automated program. To determine this, reCAPTCHA analyses the behaviour of the website visitors based on a variety of parameters. This analysis is triggered automatically as soon as the website visitor enters the site. For this analysis, reCAPTCHA evaluates a variety of data (e.g. IP address, time the website visitor spent on the site or cursor movements initiated by the user). The data tracked during such analyses are forwarded to Google. reCAPTCHA analyses run entirely in the background. Website visitors are not alerted that an analysis is underway. The data processing is based on Art. 6, para. 1, lett. f) GDPR: we, as operator of this website, have a legitimate interest in protecting our web content against misuse by automated industrial espionage systems and against SPAM. For more information about Google reCAPTCHA please refer to the Google Data Privacy Declaration and Terms Of Use under the following links: https://policies.google.com/pr… and https://policies.google.com/te….  

6. E-Mail communication

Information provided as mandated by Article 13 GDPR If this is your first interaction with us, Art. 12 et 13 GDPR provides that we make available to you the following mandatory data protection related information: If you are contacting us via e-mail, we will process your personal data only if we have a legitimate interest in the processing of this data (Art. 6, para. 1, lett. f) GDPR), if you have consented to the processing of your data (Art. 6, para. 1, lett. a) GDPR), if the processing of the data is required for the development, establishment, content or modification of a legal relationship between you and our company (Art. 6, para. 1, lett. b) GDPR) or if any other legal provision permits the processing of this data. Your personal data will remain in our possession until you ask us to erase the data or you withdraw your consent to store the data, or if the purpose for which the data are stored no longer exists (e.g. after completion of your request) or if the established retention period is expired. This shall be without prejudice to any mandatory legal provisions – in particular tax and commercial law based retention periods. You have the right at any time to receive free information concerning the origins, recipients and purpose of your data stored by us. You also have a right to object, to request data portability and to lodge a complaint with the competent supervisory authority. Moreover, you can demand the rectification, erasure and, under certain circumstances, the restriction of the processing of your personal data. Further information is available at the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 [1] REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)