There are two distinct kinds of processing here, best kept separate: people who write to us of their own accord, and organisations that appear on the map without having asked us to publish them.

Data controller

CannaNexus, holder of the site https://cannanexus.net. Contact channel for anything data-related: contact@cannanexus.net.

1. If you write to us

What we process: the name, company, email address, reason and content of the message you send through the contact form or by email.

What for: only to reply to you and, if that leads to a deal, to manage it.

Legal basis: your consent when sending the message and, where relevant, pre-contractual measures taken at your request (GDPR art. 6.1.a and 6.1.b).

How long: for as long as the conversation lasts, and afterwards for the statute-of-limitations period of any legal or contractual obligations that may follow.

Processors: the contact form is processed through an external form-submission service, which acts as a data processor and delivers the message to our inbox. Email is hosted with a provider whose data centre is in the European Union. We do not pass your data to anyone else, do not sell it, and do not add it to any mailing list.

2. If your organisation appears on the map

What we publish: the organisation's name, country, city, activity category, licence or registration where the public register states it, certifications where they are on record, the body the data comes from, and the date it was verified.

What we never publish: email addresses or direct phone numbers, even when we hold them. This is deliberate: a large share of this sector is sole traders and one-person companies, where company data and personal data are the same thing.

Where it comes from: official public registers — medicines agencies, commercial registers, national and state regulators — and, where the profile says so explicitly, industry directories or the organisation's own corporate website. Full detail at methodology and sources.

Legal basis: legitimate interest (GDPR art. 6.1.f) in disseminating business activity information that is already public by the regulator's own decision. We have weighed that interest against the rights of those affected, and for that reason the processing is limited to data identifying the activity and excludes direct contact detail.

How long: for as long as the data remains on record in the public source, or until removal is requested.

Important note: appearing on the map does not imply any relationship with us, does not mean the organisation gave us its data, and does not mean it endorses this project.

3. Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction and portability by writing to contact@cannanexus.net. It is enough to identify the organisation or the message you are referring to; you do not need to justify the request.

For removal of a published organisation there is a specific, frictionless procedure at data removal. We resolve it within 30 days at most, usually much sooner.

If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

4. Cookies and analytics

This site does not set tracking or advertising cookies, and does not use first-party analytics cookies. Visit measurement, when active, is aggregated and cookie-free: it creates no persistent identifiers and does not allow reconstructing any one person's browsing. Detail at cookies.

5. Changes

If anything material above changes, this page is updated. The published version is always the current one.