Privacy Policy
Last updated: April 2026
1. Data Controller
The controller for Gateway privacy matters is Cannaworld Co., Ltd., 140 One Pacific Place, Suite 1705, Bangkok 10110, Thailand. Privacy requests can be sent to info@cannaworld-thailand.com. Depending on the service scope, CannaWorld may also act as processor for business-customer data under a Data Processing Addendum.
2. Data we process
We process B2B account data, company data, professional contact data, licenses, permits, facility information, product and batch data, trade-case records, lead and CRM data, marketplace listing data, evidence files, audit/QMS records, training records, notifications, support messages, security logs, device/session data and cookie preferences.
3. Sources and lawful bases
Data may come from users, counterparties, public registers, public company websites, licensed business directories, professional sources, event lists, service providers and customer-approved imports. Legal bases may include contract performance, legal obligation, legitimate interests, consent, establishment or defense of claims, and compliance with Thailand PDPA or similar regional rules.
4. Public B2B data and opt-out
We may process publicly available company and professional data to identify licensed stakeholders, prevent fraud, enrich business profiles, route trade cases and support lawful B2B communications. We do not authorize unlawful scraping, paywall circumvention, access-control bypassing or ToS-violating collection. Contact us to request correction, suppression or opt-out.
5. User-uploaded evidence and trade documents
User-uploaded documents may include sensitive commercial, regulatory and quality evidence. We process these files for evidence management, audit trails, document intelligence, readiness workflows, counterparty review, trade coordination, dispute handling, security and retention obligations. Users must only upload data they are entitled to share.
6. AI-assisted processing
AI tools may extract text, classify documents, summarize files, translate content, score readiness, detect inconsistencies and recommend next steps. AI output is not an official decision, certification, QP release, legal opinion or authority determination. Human review remains required before operational or regulatory reliance.
7. Sharing and recipients
Data may be shared with authorized users, counterparties selected by the customer, auditors, QPs, laboratories, logistics providers, payment providers, hosting providers, communication providers, professional advisors, authorities where legally required, and subprocessors operating under appropriate confidentiality and data-protection obligations.
8. International transfers
CannaWorld operates from Thailand and supports EU/EEA/UK-facing workflows. Data may be transferred between Thailand, the EU/EEA, the UK and other service locations where necessary. For EU/EEA/UK personal data, we use appropriate safeguards such as contractual transfer terms, access controls, minimization and regional hosting where available.
9. Cookies and consent
We use necessary cookies and local storage for authentication, security, language, consent state and platform operation. Optional analytics or marketing technologies should only run after consent where required. Users can adjust preferences through the cookie banner or browser controls.
10. Retention
We retain account, contract, tax, payment, audit, QMS, training, batch, evidence and security records for as long as required for platform operation, customer instructions, legal obligations, regulatory auditability, dispute defense and legitimate business records. Deletion requests may be limited by statutory or regulatory retention duties.
11. Rights, security and review
Depending on jurisdiction, individuals may have rights of access, correction, deletion, restriction, objection, portability, consent withdrawal and complaint to a supervisory authority. CannaWorld applies reasonable technical and organizational safeguards, but no system is absolutely secure. This statement describes CannaWorld Gateway's general privacy principles. Mandatory law and signed data processing agreements and customer-specific privacy agreements take precedence. It does not replace legal advice tailored to the specific processing activity.