Welcome to cbdlogistics.ch. CBD Logistics is committed to protecting your privacy and ensuring the security and confidentiality of your personal and commercial data. This Privacy Policy describes how we collect, use, and protect your data when you interact with our website www.cbdlogistics.ch, including our forms, our newsletter and our AI assistant (AI Mode). This policy complies with the Swiss Federal Act on Data Protection (nFADP / nLPD, SR 235.1) and, where applicable, the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

1. Identity of the Company

CBD Logistics is a registered commercial brand of Orgena SA, a company registered in the Canton of Grisons, based in Stradón 116, CH-6557 Cama, Switzerland (Commercial Register UID: CHE-190.569.496 MWST / TVA). Orgena SA is the controller of the personal data processed through this website. For general and privacy-related inquiries, you can reach our team at info@cbdlogistics.ch (Attn: Data Protection) or by phone at +41 91 830 11 14. For further corporate details, please visit our Impressum section.

2. Collection of Personal and Commercial Data

When you use our website, register for a wholesale B2B account, contact us, subscribe to the newsletter, use the AI assistant or place an order, we collect the information necessary to deliver our services, process transactions, and ensure statutory compliance. The data we collect includes:

Personal identification: First and last name, email address, phone number.
Delivery and billing details: Shipping address, billing address, order records, customer account data, and your confirmation of being at least 18 years old.
B2B wholesale details: Legal company name, registered corporate seat, operating address, Commercial Register UID / VAT number, business representative contact details.
Contact and support data: The content of messages sent through our forms, by email, by phone or, if you choose to use it, through WhatsApp.
Newsletter data: Email address, language and proof of your consent.
AI assistant data: Messages you type into the AI assistant, as described in Section 4.
Technical browsing data: IP address, timestamp of access, browser type, operating system, and pages visited (server logs). Statistical analysis of browsing behavior takes place only with your consent (see Section 8).
Payment logs: Selected payment method and transaction status. Complete credit card details and private cryptocurrency keys are never stored on our servers.

3. Use of Data and Legal Bases

The personal and business data collected is processed in accordance with the principles of the nFADP (in particular lawfulness, good faith, proportionality and purpose limitation) and, where the GDPR applies, on the legal bases of Art. 6 GDPR, for the following purposes:

Processing and managing wholesale B2B and retail orders, including payment, delivery, invoicing, and customer support (performance of a contract).
Complying with Swiss fiscal, tax, and commercial accounting obligations, including agricultural traceability and anti-fraud checks (compliance with legal obligations).
Ensuring the technical stability, operational security, and cybersecurity defense of our website, preventing abuse and operating and improving the AI assistant (legitimate interests).
Sending professional communications, industry regulatory updates, newsletters, and promotional offers, and measuring website traffic with analytics cookies, where consent has been granted (consent).

4. AI Assistant (AI Mode)

Our website offers an AI assistant, available through the button at the bottom right of the pages and on the AI Mode page. It answers questions about our products, shipping, payments and wholesale conditions and helps you choose products. Please read the following information before using it.

Nature of the service: Answers are generated automatically by artificial intelligence and may contain errors or be incomplete. Please verify important information (prices, availability, legal requirements) at checkout or by contacting us. The assistant does not provide medical, legal or tax advice, and our products are not medicinal products.
What not to enter: The assistant does not ask for your email address, order number or other identification data. Please do not enter personal data, health data or other sensitive information in the chat. If you do, it will be processed as described in this section. For questions about a specific order, please contact us by email or phone.
Processing by AI providers: To generate an answer, your message, the most recent messages of the same conversation, the selected language and relevant extracts of our product catalog and knowledge base are sent from our server to an AI service provider. Our primary provider is Google (Gemini API); if the primary service is unavailable or at capacity, Mistral AI or Groq are used as fallback providers. Requests are sent by our server, so your IP address and device details are not transmitted to these providers by us. The providers process the content under their own terms and data-processing conditions; transfers outside Switzerland are described in Section 9.
Conversation storage: We do not keep an archive of conversations linked to you on our servers. The conversation history is held by the AI Mode page in your browser and sent back with each message so that the assistant can follow the discussion.
Anonymous usage statistics: To improve the assistant and our knowledge base, we record counters (number of conversations and messages, products suggested, clicks on product and cart buttons, orders attributed to the assistant) and the text of the questions asked, shortened to a maximum of 180 characters, without IP address or other identifiers. Daily records are aggregated and then deleted; aggregated summaries are kept for up to 21 days in an internal dashboard, and a periodic report is sent by email to our internal team. To prepare the report, the shortened questions may be translated by the AI providers mentioned above.
Abuse protection: To prevent abuse, the number of messages per visitor is limited. For this purpose, a technical identifier derived from your IP address (hash) is stored for 10 minutes.
Link between assistant and orders: If you reach our shop through the assistant, a technical marker is stored in your shop session and on the resulting order, only to measure how many orders originate from the assistant. No chat content is linked to your order.
Legal basis: Taking steps at your request before a contract (answering your questions about products and orders) and our legitimate interest in operating, securing and improving the assistant and measuring its effectiveness. The assistant does not take decisions with legal effects for you. If you subscribe to the newsletter through the assistant, Section 5 applies.

5. Newsletter and Welcome Offer

By subscribing to our newsletter, through our website forms or through the AI assistant, you consent to receive commercial communications and industry market reports via email. We utilize Moosend (Sitecore) to manage our email campaigns, with data hosted on compliant European servers. Moosend tracking is activated only if you have given your consent through the cookie banner.

If a welcome discount is offered, the discount code is sent to you by email after you submit your email address. If the code has not been used about three days later, we may send you one reminder email; for this purpose we check whether the code has been used in an order placed with that email address. A record linked to a pseudonymised identifier (hash) of your email address is kept for the duration of this welcome campaign to avoid duplicate emails and to compile statistics. The welcome and reminder emails are sent from our website mail system; newsletter campaigns are sent through Moosend.

You can revoke your consent and unsubscribe at any time using the direct link provided in each email. Unsubscribing will not affect administrative notifications regarding active or past orders.

6. Data Retention

We retain your personal data strictly for as long as necessary to fulfill the purposes for which it was gathered, in full alignment with Swiss statutory retention periods:

Invoices, commercial contracts, and transaction records are retained for ten (10) years following the close of the financial year, pursuant to the mandatory corporate record-keeping provisions of Article 958f of the Swiss Code of Obligations (CO).
Customer account and wholesale registration data are retained while the account is active and until you request deletion, subject to statutory retention duties.
Customer inquiries submitted via forms or email are retained for up to twelve (12) months after resolution, unless leading to an ongoing commercial contract.
Newsletter registration data is retained until you unsubscribe.
Bank details provided for refunds (for example for payments made in cryptocurrency) are used only to process the refund and kept only as long as needed or required by law.
AI assistant statistics are retained as described in Section 4.
Technical server log files are automatically purged within thirty (30) days.

7. Data Security

CBD Logistics implements technical and organizational security measures to protect your data against unauthorized access, loss, alteration, or disclosure. All data transmissions on our website, including shopping cart operations and B2B registrations, are protected using modern TLS (Transport Layer Security) encryption. Our IT systems, databases, and website are securely hosted on enterprise servers provided by Infomaniak Network SA (Geneva, Switzerland), with physical data centers located within Swiss territory.

8. Cookies and Tracking Technologies

Our site uses cookies and similar technologies to ensure security, improve navigation, and evaluate technical performance. We manage cookie consent through an automated consent banner that prevents non-essential cookies from firing without prior consent. Your consent choice is stored for up to 365 days:

Strictly Necessary Cookies: Essential for shopping cart functionality, user sessions, B2B account login, system security and storing your consent choice.
Functional / Preference Cookies: Store interface settings, such as language or display preferences.
Statistical / Analytical Cookies (GA4): Deployed via Google Tag Manager (container GTM-KZ49MVZ) to collect anonymized website traffic statistics without tracking individuals across external platforms. They are activated only with your consent. We do not deploy Meta Pixel or third-party behavioral advertising remarketing trackers.
Newsletter tracking (Moosend): Activated only with your consent, as described in Section 5.

You can manage, configure, or revoke your cookie choices at any time via the on-site consent banner or through your browser settings.

In addition, to display and operate the website we use the following technical services, which may receive your IP address and device data when pages are loaded:

GTranslate: Automatic translation of the website into English, German, French and Italian. When you select a language, the page content is processed by the translation service and a language preference is stored. The brand and product names are excluded from translation.
Google Fonts: Web fonts loaded from Google servers.
Font Awesome: Icons loaded from the Font Awesome content delivery network.
Google reCAPTCHA: Protects our forms against spam and abuse. reCAPTCHA analyzes technical data such as IP address, browser data and interaction behavior. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

9. Data Transfers

Your data is hosted and processed primarily in Switzerland and the European Economic Area (EEA), jurisdictions recognized as ensuring an adequate level of data protection. Where service providers process data in third countries (such as Google analytics, Google services and the AI provider Groq in the United States), transfers are secured through recognized Standard Contractual Clauses (SCCs), adequacy frameworks where available, and robust technical safeguards. Mistral AI processes data in the European Union.

10. Third-Party Data Processing and External Service Providers

We utilize trusted external service providers bound by contractual confidentiality and data processing agreements, strictly to the extent required to execute their functions:

Payment Gateways: PostFinance AG (PostFinance Pay / E-Finance), TWINT AG, Worldline / Saferpay (credit cards), NOWPayments (cryptocurrency settlement), and Powerpay / MF Group AG (purchase on invoice). If you choose payment on invoice, the data required for an automated creditworthiness check is transmitted to Powerpay, which issues the invoice and to which we may assign the claim. If you are affected by an automated decision, you can ask for it to be reviewed by a person by writing to info@cbdlogistics.ch.
Logistics and Freight Couriers: Swiss Post (Die Post / La Posta) and, where used, FedEx Express for parcel and freight delivery.
AI Assistant: Google (Gemini API), Mistral AI and Groq, as described in Section 4.
Newsletter: Moosend (Sitecore), as described in Section 5.
Analytics: Google Analytics 4 and Google Tag Manager, only with consent.
Website tools: GTranslate, Google Fonts, Font Awesome, Google reCAPTCHA and Google Maps (interactive location display on the Contacts page).
Customer communication: Email, telephone and, if you choose to contact us through the link on our website, WhatsApp (Meta Platforms Ireland Ltd.).
Hosting: Infomaniak Network SA (Geneva, Switzerland).

11. Your Rights

Under the Swiss nFADP and applicable GDPR provisions, you have the right to:

Request access and obtain confirmation and a copy of your personal data processed by us.
Request the correction of inaccurate or outdated data.
Request the deletion of your personal data, provided statutory retention duties (e.g., 10-year accounting rules under Swiss CO) do not apply.
Object to or restrict the processing of your data for direct marketing or legitimate business interests.
Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Request data portability to receive your personal data in a structured, commonly used format.
Lodge a complaint with the competent supervisory body: the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, CH-3003 Bern, Switzerland (www.edoeb.admin.ch).

To exercise any of these rights, please contact our team at info@cbdlogistics.ch specifying “Attn: Data Protection” in the subject line.

12. Links to External Sites

Our site may contain links to external third-party websites, social media profiles (Instagram, YouTube), WhatsApp or official Swiss and European authorities. We assume no responsibility for the content, privacy practices, or policies of third-party platforms and encourage you to review their respective privacy statements.

13. Changes to the Privacy Policy

CBD Logistics reserves the right to amend or update this Privacy Policy at any time to reflect legal, regulatory, or technical developments. Amendments become effective immediately upon publication on this page. Significant revisions will be notified via our website or directly to registered B2B account holders.

14. Applicable Law and Jurisdiction

This Privacy Policy and all related matters shall be governed exclusively by the substantive laws of Switzerland, excluding conflict-of-law principles. In the event of any dispute arising from the interpretation or execution of this Privacy Policy, the exclusive place of jurisdiction shall be the competent courts of the Moesa District (Canton of Grisons), Switzerland, without prejudice to any mandatory statutory venues provided by federal law.

For further information or questions regarding this Privacy Policy, please contact our team at info@cbdlogistics.ch (Attn: Data Protection) or by phone at +41 91 830 11 14 (Monday to Friday, 8:30–12:30 and 13:30–18:30).

Last updated: October 22, 2026