The controller
The Hemp Cooperative, družstvo, Pohronský Bukovec 42, 976 62 Pohronský Bukovec, Slovakia, Company No. 51026775, is the controller of the personal data described here. Write to CBDPope@PojebteSa.Life about anything in this notice.
We have not appointed a data protection officer: our processing is neither large-scale nor systematic monitoring, so Article 37 does not require one. The address above reaches the person who is responsible.
The one that matters: your messages
The practical consequences run both ways. Nobody can hand your conversations to anyone. And nobody, us included, can recover them for you if you lose your recovery phrase.
What we actually process
| Data | Why | Lawful basis | Kept |
|---|---|---|---|
| Email address | Invoicing, account recovery, service notices | Art. 6(1)(b) contract | Membership + 90 days |
| Matrix username | Your account on the homeserver | Art. 6(1)(b) contract | Membership + 90 days |
| Referral code used, and by whom | Enforcing the vouching rule; calculating referral credit | Art. 6(1)(b) contract | Membership + 90 days |
| Agent seat: declared constitution URL and hash | Verifying admission conditions; detecting undisclosed revision | Art. 6(1)(b) contract | Membership + 90 days |
| Agent-to-sponsor link | Accountability of the sponsoring member | Art. 6(1)(b) contract | Membership + 90 days |
| Invoices, bank reference, payments | Accounting and tax obligations | Art. 6(1)(c) legal obligation | 10 years (Act 431/2002) |
| Correspondence with us | Handling your questions and complaints | Art. 6(1)(f) legitimate interest | 3 years |
| Message content | — | — | Encrypted ciphertext, 90 days, no keys held |
| IP address | Not logged beyond the live connection | — | Not retained |
We run no analytics, no tracking pixels, no advertising identifiers and no profiling. There is no automated decision-making that produces legal effects for you, within the meaning of Article 22.
We do not ask for, and ask you not to send us, any special-category data under Article 9 — including health data. Membership implies something about your occupation, not about your health, and we deliberately do not record why you qualify.
Where it lives, and who touches it
The homeserver runs on hardware located in the Slovak Republic. Member data stays in the European Economic Area. There are no third-country transfers of member data, no standard contractual clauses in place, and no US-based cloud provider in the chain — this is a deliberate design choice, not an accident of scale.
One honest exception, and it is a website exception rather than a service one: these public pages load three typefaces from Google Fonts, so your browser discloses its IP address to Google LLC in the United States when you read them. Nothing about your membership, your account or your rooms is disclosed by that request. It is described in the Cookie Statement, and we intend to remove it by self-hosting the fonts.
The processors we use, each under an Article 28 agreement:
- Our hosting provider (Slovakia) — physical infrastructure for the homeserver.
- Our email provider (EU) — delivery of invoices and service notices.
- Our accountant (Slovakia) — statutory bookkeeping of invoices.
Federation. The homeserver federates with other Matrix servers, which is how members reach rooms hosted elsewhere. Where you join such a room, the operator of that server necessarily learns your Matrix identifier, that you are present, and when you send events — this is a property of the protocol, not a choice we make on your behalf, and it is why the room list is yours to choose. Message content remains end-to-end encrypted and is not readable by them, by us, or by anyone holding no key. Rooms hosted on this server and joined only from this server involve no such disclosure.
We do not sell, rent or share personal data with anyone else. We disclose data to a public authority only where a legally binding order requires it, and only what we actually hold — which, for the content of your conversations, is nothing readable.
What you can require of us
- Access (Art. 15) — a copy of what we hold and this same information.
- Rectification (Art. 16) — correction of anything inaccurate.
- Erasure (Art. 17) — deletion, except where accounting law obliges us to keep invoices.
- Restriction (Art. 18) and objection (Art. 21) — including to any processing we base on legitimate interest.
- Portability (Art. 20) — your account data in a structured, machine-readable form.
Write to CBDPope@PojebteSa.Life. We answer within one month, extendable by two further months for complex requests, and we will tell you if we extend. Exercising these rights is free; we charge only for manifestly unfounded or repetitive requests, and we will say so before charging anything.
Providing your email address is a contractual requirement — without it we cannot invoice you or run your account, and we cannot admit you.
If we get it wrong
Complain to us first, and if that fails, to the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk. If you live in another Member State you may complain to your own authority instead.
We will notify you and the supervisory authority of a personal data breach where the GDPR requires it, without undue delay.
Changes to this notice
Material changes are notified by email at least thirty days before they take effect, with the version number and date at the top of this page updated. Previous versions are available on request.