Last updated: 19 October 2026
This Privacy Policy explains how personal data is collected, used, stored, shared and protected when you visit or use budbid.com and its language versions (together, the “Website”), when you register as a customer or vendor, and when you contact us. It also explains the rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the Irish Data Protection Acts 1988 to 2018, and the European ePrivacy rules on cookies and similar technologies as implemented in Ireland.
Please read this policy carefully. If you have any questions about it, or would like to exercise any of your rights, email privacy@budbid.com.
1. About BudBid and the scope of this policy
BudBid is an online marketplace and product comparison website for hemp-derived products, CBD products and cannabis seeds that are legal to sell in the European Union. Independent retailers, brands and seed banks (“vendors”) present their products on the Website. When you decide to buy something, you follow a link to the vendor’s own website and complete your purchase there.
BudBid does not sell products, take payments, process orders or arrange delivery. Those activities happen on the vendor’s website, under the vendor’s own terms and privacy policy.
This policy applies to personal data processed by BudBid in connection with the Website. It does not apply to vendors’ websites, affiliate networks or any other third-party website you reach from the Website, even if you reach them through a link on BudBid. We encourage you to read the privacy policies of those websites.
2. Key terms
- Personal data means any information relating to an identified or identifiable living person, such as a name, email address, IP address or online identifier.
- Processing means anything done with personal data, including collecting, storing, using, sharing and deleting it.
- Controller means the person or organisation that decides why and how personal data is processed. For the Website, the controller is BudBid (see section 12).
- Processor means a service provider that processes personal data on a controller’s behalf and on its instructions, such as our hosting provider.
- Vendor means a business that presents products on the Website. Vendors are separate businesses and act as independent controllers of the personal data they collect on their own websites.
3. Our data protection principles
We process personal data in line with the principles set out in Article 5 of the GDPR. In practice, this means we:
- collect only the personal data we need for clearly defined purposes (data minimisation);
- process personal data lawfully, fairly and transparently;
- do not use personal data for purposes that are incompatible with the purposes for which it was collected;
- keep personal data accurate and, where necessary, up to date;
- keep personal data only for as long as necessary (see section 10);
- protect personal data with appropriate technical and organisational security measures (see section 14).
We have designed the Website to work without advertising trackers. Our visitor statistics and outbound click counts are collected without cookies, and we do not use Google Analytics, social media pixels, advertising networks or data brokers.
4. Personal data we collect and how we use it
The tables and sections below describe each type of processing, the personal data involved, the purpose and the legal basis we rely on under Article 6 of the GDPR.
4.1 Visiting the Website (technical and security data)
When you visit the Website, your browser automatically sends certain technical information to our web server so the requested page can be delivered. This includes your IP address, the date and time of the request, the page or file requested, the HTTP status code, the amount of data transferred, the referring web address (if your browser sends it), and your browser type, version and operating system (the “user agent”).
Purpose: to deliver the Website to you, to keep it stable and secure, to detect and prevent misuse, attacks and fraud, and to diagnose technical faults.
Legal basis: our legitimate interests in operating a secure and functioning website (Article 6(1)(f) GDPR).
Retention: server log files are kept by our hosting provider for a short period, normally no longer than 30 days, unless a specific security incident requires us to keep particular entries for longer to investigate it.
4.2 Visitor statistics (cookie-free analytics)
We use Independent Analytics, a statistics tool that runs entirely on our own web server. It does not use cookies or similar storage on your device, and no data is sent to the provider of the software or to any other third party.
When you view a page, the tool records: the page viewed; the date and time; the referring website or search engine; any campaign parameters in the web address (for example utm_source); your approximate location at country, region and city level, worked out from your IP address; and your device type, operating system and browser.
Your IP address is not stored. To count unique visitors, the tool combines your IP address and browser details with a secret value held on our server and converts them into a one-way code (a “hash”). This code cannot be reversed to reveal your IP address.
Purpose: to understand how many people visit the Website, which pages and products are popular, how visitors find us, and how we can improve the Website.
Legal basis: our legitimate interests in measuring and improving the Website (Article 6(1)(f) GDPR). Because no cookies or device storage are used and the data cannot reasonably be used to identify you, we do not ask for consent. You can object at any time (see section 13).
Retention: statistics are kept for up to 24 months and then automatically deleted.
4.3 Clicks to vendors and other external websites
When you click a link that takes you away from the Website, for example a “Buy at …” button on a product page, we record: the type of link; the product, pack size and vendor concerned (for buy buttons); the destination web address; the page you clicked from; the language version of the Website you were using; your device category (mobile, tablet or desktop); the domain of the website that referred you to BudBid (for example google.com); and the date and time.
These records do not contain your name, email address, IP address or any identifier that is linked to you, and no cookies are used. To stop automated systems from flooding our records, your IP address is converted into a one-way code and held in temporary memory for no longer than 10 minutes. It is not stored with the click records.
Purpose: to understand which listings are useful to shoppers, to show vendors how many visitors the Website sends to them, to reconcile our figures with affiliate network reports, and to improve the Website.
Legal basis: our legitimate interests (Article 6(1)(f) GDPR).
Retention: click records are kept for up to 24 months and then automatically deleted.
4.4 Affiliate links
Some links to vendors are affiliate links. They are clearly labelled with a notice under the button on the product page. If you buy a product after following an affiliate link, the vendor pays BudBid a commission. This does not change the price you pay.
Affiliate links work in one of two ways:
- through the affiliate network Awin (operated by AWIN AG and its group companies), whose tracking links start with
awin1.com. When you click such a link, you pass briefly through Awin’s servers before reaching the vendor’s website; or - by adding a referral code to the vendor’s web address (for example
?af=…), which the vendor’s website reads.
When you follow an affiliate link, Awin and/or the vendor may place cookies or use similar technologies on their websites to recognise that you arrived from BudBid and to attribute any purchase to us. This processing is carried out by Awin and the vendor as controllers under their own privacy and cookie policies, and they are responsible for asking for your consent where the law requires it. Awin’s privacy policy is available at awin.com.
BudBid receives only aggregated or pseudonymous reports from affiliate networks and vendors, such as the number of clicks and sales, the commission due, and the BudBid product reference a sale came from. We never receive your name, contact details, payment details or order contents from affiliate networks or vendors.
Legal basis for adding affiliate parameters to our links: our legitimate interests in funding the Website through commissions (Article 6(1)(f) GDPR).
4.5 Reporting a problem with a listing
Every product page has a “Report a problem with this listing” form. If you use it, we receive the product concerned, the reason you selected and any details you choose to type in. The report is emailed to us. A hidden field and a temporary, one-way code made from your IP address (kept for no longer than one hour) are used to block spam and limit the number of reports that can be sent.
Please do not include personal information in the details box unless it is necessary to explain the problem.
Purpose: to keep listings accurate and links working, and to deal with problems with vendors. Legal basis: our legitimate interests (Article 6(1)(f) GDPR). Retention: up to 12 months.
4.6 Contacting a vendor through the Website
Vendor store pages include a contact form. If you use it, your name, email address and message are passed to the vendor so they can reply to you. Once the vendor receives your message, it is responsible for how it handles your personal data as an independent controller.
Legal basis: taking steps at your request (Article 6(1)(b) GDPR). Retention: messages are kept in our system for up to 12 months.
4.7 Customer accounts
You do not need an account to browse the Website. If you choose to create one, we process your username, email address and password (stored only in encrypted, hashed form), together with any optional details you add to your profile.
Purpose: to provide your account and its features, to keep it secure and to contact you about it. Legal basis: performance of a contract with you (Article 6(1)(b) GDPR). Retention: while your account is active, and deleted within 30 days of you asking us to close it.
4.8 Vendor registration and vendor accounts
If you register as a vendor, we process: your name; email address; phone number; shop name and web address; business address; company name; VAT number and company registration number; your website; whether you would like our listing upload service and, if so, the number of products to upload; and any information you add to your store profile, such as a logo, banner, description and social media links.
Purposes: to assess and approve your registration and protect the Website from fraudulent or unsuitable vendors; to create and manage your store page; to display the business identity and contact details that EU consumer protection law requires traders to provide; to provide our listing upload service; to issue invoices and keep accounting records; and to communicate with you about your account and the Website.
Legal bases: performance of a contract with you, and steps you ask us to take before entering into one (Article 6(1)(b) GDPR); compliance with legal obligations, including tax and accounting law (Article 6(1)(c) GDPR); and our legitimate interests in preventing fraud and keeping the Website trustworthy (Article 6(1)(f) GDPR).
Business details that you choose to publish on your store page, such as your shop name, business address and contact details, will be visible to everyone who visits the Website.
4.9 Protecting registration forms from spam
Our registration forms include protective measures: a hidden field that people do not see but automated programs tend to fill in; a time check that rejects forms submitted unrealistically quickly or long after the page was loaded; and a check that rejects email addresses from known temporary or throw-away email services and from domains that cannot receive email. These checks are carried out automatically when you submit the form, and no extra personal data is stored as a result.
Legal basis: our legitimate interests in preventing spam, fraud and abuse (Article 6(1)(f) GDPR). If you believe your registration was rejected in error, email privacy@budbid.com and we will review it manually.
4.10 Emails and other communications
If you email us, including at privacy@budbid.com, we process your email address, your name (if given), the content of your message and any attachments, so that we can respond. We may also send you service messages that relate to your account or registration.
We do not send marketing emails or newsletters unless you have specifically asked to receive them. If we introduce a newsletter, it will be strictly opt-in and every message will include an easy way to unsubscribe.
Legal bases: our legitimate interests in responding to enquiries (Article 6(1)(f) GDPR), or performance of a contract where the communication relates to your account (Article 6(1)(b) GDPR). Retention: for as long as needed to deal with your enquiry and for up to 24 months afterwards, unless a longer period is needed for a legal claim.
4.11 Email authentication reports
To protect budbid.com from email spoofing, we receive automated DMARC reports from email providers. These reports describe which servers have sent email claiming to come from budbid.com and whether that email passed authentication checks. They contain technical information about sending servers rather than information about individual email recipients.
5. Summary of legal bases
| Processing activity | Legal basis (GDPR) |
|---|---|
| Delivering and securing the Website (server logs) | Legitimate interests, Art. 6(1)(f) |
| Cookie-free visitor statistics | Legitimate interests, Art. 6(1)(f) |
| Outbound click records | Legitimate interests, Art. 6(1)(f) |
| Affiliate parameters in outbound links | Legitimate interests, Art. 6(1)(f) |
| “Report a problem” form | Legitimate interests, Art. 6(1)(f) |
| Messages to vendors | Steps at your request, Art. 6(1)(b) |
| Customer and vendor accounts | Contract, Art. 6(1)(b) |
| Invoices and accounting records | Legal obligation, Art. 6(1)(c) |
| Spam and fraud prevention | Legitimate interests, Art. 6(1)(f) |
| Responding to emails | Legitimate interests, Art. 6(1)(f), or contract, Art. 6(1)(b) |
| Strictly necessary and preference cookies | ePrivacy exemption for strictly necessary storage; legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and concluded that the processing is proportionate, particularly because we minimise the data collected, avoid cookies and identifiers wherever possible, and keep data only for limited periods. You can ask us for more information about this balancing test by emailing privacy@budbid.com.
6. Cookies and similar technologies
Cookies are small text files that a website stores on your device. BudBid uses only cookies that are strictly necessary for the Website to function, or that remember a choice you have made. Under the ePrivacy rules these do not require consent, which is why we do not show a cookie banner. We do not use advertising, tracking, social media or third-party analytics cookies.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
wordpress_logged_in_*, wordpress_sec_* | Keep you signed in to your account (only set if you sign in) | Strictly necessary | Session, or up to 14 days if you choose “Remember me” |
wordpress_test_cookie | Checks that your browser accepts cookies when you sign in | Strictly necessary | Session |
wp_woocommerce_session_* | Keeps your shopping session and basket working | Strictly necessary | Up to 2 days |
woocommerce_items_in_cart, woocommerce_cart_hash | Remember whether your basket has items in it | Strictly necessary | Session |
bb_per_page | Remembers how many products per page you chose to view | Preference | 30 days |
dokan_*, wp-settings-* | Store settings for vendors and signed-in users | Strictly necessary | Up to 1 year |
You can view, block and delete cookies in your browser settings. If you block strictly necessary cookies, signing in and the basket will not work.
Vendor websites and affiliate networks that you visit from BudBid may use their own cookies, including advertising and tracking cookies. These are governed by their own cookie policies and consent tools, not by this policy.
7. Who we share personal data with
We do not sell, rent or trade personal data. We share it only in the following circumstances:
- Hosting provider: our website, database and email are hosted by LayerIP, which acts as our processor under a data processing agreement and may only process personal data on our instructions.
- Vendors: when you send a message to a vendor through the Website, we pass your message and contact details to that vendor. When you click through to a vendor’s website, the vendor will receive the technical information your browser sends to any website you visit.
- Affiliate networks: when you click an affiliate link, Awin receives the technical information your browser sends to any website you visit (see section 4.4). We do not send Awin any additional personal data about you.
- Professional advisers: such as accountants and lawyers, where necessary and under a duty of confidentiality.
- Authorities: regulators, law enforcement or courts, where we are legally required to disclose information, or where disclosure is necessary to establish, exercise or defend legal claims or to protect the rights, property or safety of BudBid, our users or others.
- Business transfer: if the BudBid business, or substantially all of its assets, is transferred to another party, personal data may be transferred as part of that transaction. The new owner will be bound by this policy or will notify you of any changes.
8. International data transfers
We aim to keep personal data within the European Economic Area (EEA). Some service providers may process limited data outside the EEA. Where this happens, we make sure appropriate safeguards are in place as required by Chapter V of the GDPR, such as an adequacy decision of the European Commission (for example, the decision covering the United Kingdom) or the European Commission’s Standard Contractual Clauses, supported by additional measures where needed. You can request more information about these safeguards by emailing privacy@budbid.com.
9. Vendors and other websites
Vendors are independent businesses. Product information, prices, stock, shipping, returns, payment and customer service are the vendor’s responsibility. When you buy from a vendor, the vendor collects and processes your personal data, such as your name, address, payment details and order history, as an independent controller under its own privacy policy.
The Website also contains links to other websites, such as vendors’ social media pages. We are not responsible for the privacy practices or content of those websites.
10. How long we keep personal data
We keep personal data only for as long as necessary for the purposes described in this policy, after which it is deleted or irreversibly anonymised. The main retention periods are:
| Data | Retention period |
|---|---|
| Web server log files | Normally up to 30 days |
| Visitor statistics | Up to 24 months, then automatically deleted |
| Outbound click records | Up to 24 months, then automatically deleted |
| Temporary spam-protection codes (from IP addresses) | 10 minutes (clicks) to 1 hour (problem reports) |
| “Report a problem” submissions | Up to 12 months |
| Messages sent to vendors through the Website | Up to 12 months |
| Customer accounts | While active; deleted within 30 days of a closure request |
| Vendor accounts and store data | While active; deleted within 30 days of a closure request, except as below |
| Invoices and accounting records | As required by Irish tax law, generally 6 years from the end of the relevant tax year |
| Email correspondence | Up to 24 months after the enquiry is resolved |
We may keep particular data for longer where it is needed to establish, exercise or defend legal claims, or where the law requires it.
11. Children
The Website lists hemp products and cannabis seeds intended for adults. It is not directed at, and may only be used by, people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact us at privacy@budbid.com and we will delete it.
12. Data controller and contact details
The controller responsible for the processing of personal data described in this policy is R. Jones, trading as BudBid, 51 Bracken Road, Dublin, D18 CV48, Ireland.
For all questions about this policy or about your personal data, and to exercise your rights, please email privacy@budbid.com. This is the quickest way to reach us. We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR.
13. Your rights
Under the GDPR you have the following rights in relation to your personal data:
- Right of access (Article 15): to find out whether we process personal data about you and, if so, to receive a copy of it together with information about how it is processed.
- Right to rectification (Article 16): to have inaccurate personal data corrected and incomplete data completed.
- Right to erasure (Article 17): to have your personal data deleted, for example where it is no longer needed or you have successfully objected to its processing, unless we need to keep it to comply with a legal obligation or for legal claims.
- Right to restriction of processing (Article 18): to ask us to limit how we use your data, for example while we check its accuracy or consider an objection.
- Right to data portability (Article 20): to receive personal data you provided to us, which we process by automated means on the basis of contract or consent, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
- Right to object (Article 21): to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests, or the processing is needed for legal claims. You have an absolute right to object to direct marketing.
- Right to withdraw consent (Article 7(3)): where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
How to exercise your rights
To exercise any of these rights, email privacy@budbid.com and tell us which right you wish to exercise. We may need to ask for information to confirm your identity before acting on your request, to protect your data from being disclosed to someone else.
We will respond without undue delay and in any event within one month of receiving your request. If a request is complex, or we receive several requests from you, we may extend this by up to two further months, and we will tell you if we do so and why. We do not charge a fee unless a request is manifestly unfounded or excessive.
Please note that our visitor statistics and outbound click records do not contain names, email addresses or IP addresses. In most cases we will therefore be unable to identify which of those records relate to you.
14. How we protect personal data
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include: encrypted connections (HTTPS) for the entire Website; passwords stored only in hashed form; restricted, role-based access to administrative areas; regular software updates; spam and abuse protection on public forms; and email authentication (SPF, DKIM and DMARC) for our domain.
No method of transmission over the internet or of electronic storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours where required, and we will inform you without undue delay where the breach is likely to result in a high risk to you.
15. Automated decision-making and profiling
We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. The automatic spam checks on our registration forms (section 4.9) only reject submissions that show clear signs of automated abuse, and you can always ask for a manual review.
16. Right to complain to the supervisory authority
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA country where you live or work, or where you believe the infringement took place.
Our lead supervisory authority is the Data Protection Commission (DPC) in Ireland. You can find its contact details and online complaint form at dataprotection.ie.
We would appreciate the opportunity to address your concerns before you approach the DPC, so please consider contacting us first at privacy@budbid.com.
17. “Do Not Track” and Global Privacy Control
Because we do not use advertising or cross-site tracking technologies on the Website, there is no tracking for browser “Do Not Track” or Global Privacy Control signals to switch off. Our cookie-free statistics and click records are collected in the same way regardless of these signals, and you can object to them at any time by emailing privacy@budbid.com.
18. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to the Website, our services or the law. The “Last updated” date at the top of the page shows when it was last revised. If we make significant changes, we will display a prominent notice on the Website and, where appropriate, notify registered users by email.