Privacy Policy

Who We Are

Cannabox Co., Ltd. ("Cannabox", "we", "our", or "us") operates Fairly Good Cannabis and related digital services, including the Fairly Good Cannabis website, menu and educational pages, rewards and prescription application forms, AI recommendation tools, delivery coordination workflows, promotional landing pages, and connected in-store or mobile experiences in Thailand.

This Privacy Policy applies when you visit our websites, create an account, submit a form, interact with our recommendation tools, visit a store, join a rewards program, use a drop or location-based promotion, or otherwise communicate with us.

What We Collect

Information you give us directly

• Account and contact details, such as your name, email address, phone number, password, nationality, and profile details.
• Prescription and consultation information, such as passport or ID details, weight, height, medical condition information, previous cannabis-use history, preferred branch, preferred consultation date, service type, and delivery address.
• Rewards and purchase-related information, such as your contact details, address, rewards membership details, points balance, transaction history, and order or branch preferences.
• Messages and support requests, including emails, chat messages, contact-form submissions, and notes you choose to provide.

Information collected automatically

• Device and log data, such as IP address, user agent, browser type, session identifiers, referrer data, page paths, timestamps, and security events.
• Authentication and anti-abuse data, such as session records, refresh-token identifiers, device fingerprints, login activity, CSRF protection tokens, and fraud-prevention logs.
• Site-preference data stored through cookies or similar technologies, including age-gate confirmation, account-session continuity, and anonymous identifiers used for drop or campaign analytics.
• If you use our drop or mobile unlock features, location-related data needed to determine whether you are close enough to unlock an in-store offer. In the mobile experience, we request location only for that purpose.

Information derived from your interactions

• AI assistant conversation history, stated preferences, extracted taste or effect preferences, viewed recommendations, clicked strain pages, and email-capture status.
• Purchase, loyalty, and campaign activity, such as whether you joined rewards, redeemed points, claimed a drop, opened a campaign link, or responded to an offer.

Sensitive Data

Some of the information we process may be sensitive under applicable law, including health information, cannabis-use information, and government-issued identification details. We only collect and use this category of data when it is reasonably necessary for lawful screening, consultation or prescription coordination, delivery compliance, security, recordkeeping, or another lawful basis recognized by applicable law.

How We Use Personal Data

We use personal data to:

• operate the website, user accounts, menus, educational pages, and store-locator features;
• verify age, identity, eligibility, and access rights where needed;
• receive and review prescription or consultation requests and coordinate with licensed professionals or authorized staff;
• coordinate pickup, delivery, branch visits, and customer support;
• administer rewards memberships, points, purchases, refunds, and promotional offers;
• provide the AI recommendation assistant and improve recommendation quality and site usability;
• send transactional messages, verification codes, service notices, and, where permitted, marketing or remarketing communications;
• analyze campaign traffic, store-interest signals, and drop-promotion performance;
• maintain security, prevent fraud, investigate misuse, enforce our terms, and protect our staff, customers, and systems;
• comply with legal, regulatory, tax, accounting, public-health, traceability, or law-enforcement requirements.

Legal Bases for Processing

Depending on the situation, we rely on one or more of the following legal bases:

• your consent;
• the performance of a contract or pre-contractual steps at your request;
• compliance with legal obligations;
• our legitimate interests in operating, securing, and improving our business, where those interests do not override your rights; and
• other lawful bases available under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and applicable regulations.

Cookies, Local Storage, and Similar Technologies

We use cookies, browser storage, and similar technologies for security, authentication, basic site functionality, and analytics. Examples in our current services include:

• session and authentication cookies for login continuity;
• CSRF and security tokens;
• browser storage for age confirmation;
• anonymous identifiers for drop-campaign analytics and claim reuse controls.

You can adjust cookie or browser-storage settings through your browser or device. Disabling certain technologies may affect logins, recommendation flows, or promotional features.

When We Share Personal Data

We may share personal data with:

• licensed medical professionals, clinics, pharmacists, or authorized healthcare personnel involved in lawful screening, consultation, dispensing, or medical review;
• our staff, contractors, franchise or branch operators, and service providers on a need-to-know basis;
• technology and infrastructure providers, including hosting, database, email, analytics, AI, communications, and security vendors;
• payment, accounting, and point-of-sale service providers when needed for a transaction, refund, or audit trail;
• government authorities, regulators, courts, or law-enforcement agencies where required or permitted by law; and
• professional advisers or transaction counterparties in connection with audits, disputes, insurance, financing, or a business reorganization or sale.

We do not sell personal data in the ordinary commercial sense.

International Transfers

Some of our service providers may process data outside Thailand. Where cross-border transfers occur, we take steps intended to keep the transfer lawful and appropriately protected under the PDPA, including contractual measures, vendor due diligence, and transfer only where reasonably necessary for the service.

Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, including for:

• maintaining your active account and related support history;
• handling prescription, rewards, delivery, or campaign records;
• complying with tax, accounting, anti-fraud, traceability, complaint-handling, and legal-retention obligations; and
• establishing, exercising, or defending legal claims.

After the retention period ends, we will delete, anonymize, or archive the data as required or permitted by law.

Security

We use technical and organizational safeguards appropriate to the nature of the data we process. These measures may include access controls, hashed passwords, secure cookies, rate limiting, CSRF protections, audit logging, role-based permissions, and vendor access restrictions. No system is perfectly secure, so you should also protect your password and devices.

Your Rights

Subject to applicable law and any legal exceptions, you may have the right to:

• access your personal data and request a copy;
• request correction of inaccurate or incomplete data;
• request erasure or anonymization in some circumstances;
• request restriction or suspension of certain processing;
• object to certain processing;
• request data portability where the law grants it;
• withdraw consent where processing is based on consent; and
• lodge a complaint with Thailand's Personal Data Protection Committee or another competent authority.

To exercise a right, contact us using the details below. We may ask for information reasonably necessary to verify your identity before acting on a request.

Marketing Choices

You can opt out of marketing emails by using the unsubscribe method in the message, adjusting your account preferences where available, or contacting us. We may still send non-marketing messages needed to complete transactions, maintain your account, or comply with legal obligations.

Minors and Restricted Users

Our cannabis-related services are not intended for minors or for anyone who is not legally permitted to use them. We may refuse, suspend, or delete submissions or accounts that appear to violate age, identity, prescription, or legal-eligibility rules.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect service changes, legal requirements, or compliance improvements. When we make a material update, we will revise the "Last updated" date and may provide additional notice where appropriate.

Contact Us

For privacy questions or rights requests, contact:

• Privacy: [email protected]
• General support: [email protected]
• Corporate contact: [email protected]
• Phone: 095 862 6362