Privacy

1. Data controller

The data controller is the association Platinum CBD, 9 rue de Beaulieu, 44340 Bouguenais, France, who can be reached at [email protected]. The association has not appointed a data protection officer: requests are handled directly at this address.

2. What we collect, and why

We only collect what is needed to run the competition. No data is sold, rented or passed on for advertising purposes.

All accounts. Email address, name, password (stored as an encrypted hash, never in plain text), role, chosen display language, IP address and browser of open sessions. Purpose: to create and secure access, and to write to you in your language. Legal basis: performance of the registration contract, and legitimate interest in account security.

Participating producers. Company name, brand, SIRET (company number), address, telephone, website and the products entered. Purpose: to manage entries, sample anonymisation and invoicing, and to contact the producer about their samples. Legal basis: performance of the contract, and legal obligation for accounting records.

Producer visuals. Logo and photo of the producer or their team, if they choose to provide them. Purpose: to publish them on the Platinum CBD Cup's social media to announce their participation. Legal basis: their consent, given before any upload and revocable at any time from their profile; we then stop using them for new posts.

Jurors. Display name, area of expertise, biography, scores and written comments. Purpose: to form the juries and produce the results. Legal basis: performance of the contract between us and the juror.

Contact form. Name, email address, subject and message. Purpose: to answer your request. Legal basis: legitimate interest in handling the requests sent to us.

Newsletter. Email address and name. Purpose: to send you news about the competition. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in every email.

Payments. We keep the amount, date, transaction reference and invoice number. No card data passes through or is stored on our servers: card details are entered entirely on the secure page of our payment provider.

3. How long

Account and profile

Duration of participation, then 3 years of inactivity

Scores and results

Kept permanently: they make up the public results

Invoices and accounting records

10 years (legal obligation)

Contact messages

3 years after the last exchange

Newsletter

Until you unsubscribe, then deleted

Connection logs

12 months

Scores and awards remain linked to the product and the producer: results from which lines could be removed would have no value. If an account is deleted, identifying data is anonymised, but published results remain.

4. Who else has access

Our data is hosted on our own hardware, in France. We use a small number of processors, each for a specific function:

• Resend — sending transactional emails (address verification, password reset, invitations, results). Data processed in the European Union.
• Viva.com — collection of entry fees. The only recipient of card data, which it collects directly.
• Cloudflare — website distribution and protection against attacks. Processes visitors' IP addresses as a network intermediary.

No other transfer takes place. The competition results, however, are public by nature: producer name, brand, product and award are published on this website.

5. Cookies

This website uses no advertising cookies and no audience trackers. We only set the cookies strictly necessary for it to work: the session cookie that keeps you signed in, the security tokens of the forms, and the NEXT_LOCALE cookie that remembers the display language you chose. They do not require your prior consent; the first expire at the end of the session, the language cookie after one year.

Fonts are loaded from Google Fonts, which passes your IP address to Google when the page is displayed.

6. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to give instructions regarding what happens to your data after your death.

From your account, the profile page lets you export your data and request the deletion of your account. You can also write to [email protected]: we reply within one month.

If you are not satisfied with our answer, you can contact the French data protection authority (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or file a complaint at cnil.fr.

7. Security

Exchanges with the website are encrypted end to end. Passwords are never stored in plain text. Our providers' credentials are encrypted at rest. Access to the database is restricted to the people who need it, and the data is backed up daily.

Products are anonymised before scoring, with a different code for each of the two juries: no juror knows either the brand or the producer. This separation is technical, not merely organisational.

8. Changes

This policy may change. The date of the last update is shown at the top of the page. Any substantial change will be notified to you by email if you have an account. The conditions of participation are set out in the competition rules.