Privacy Policy

Last updated: November, 8th 2025

This Privacy Policy explains how Emprezaa Agency, an unincorporated business operated by Antonio Lacruz, under the commercial brand “Weeds Studio” (“Weeds Studio”, “we”, “us”) collects and processes personal data in connection with the platform weeds.studio, apps, dashboards and APIs (collectively: the “Service”).

1. Controller

For GDPR purposes, the Controller is:

Emprezaa Agency — Weeds Studio
Barcelona, Spain
Contact: service@weeds.studio

2. Categories of Data we process

We process the following data:

(i) User Account Data

• login credentials
• location (city/country level)
• contact details (email and/or phone)
• account recovery data (hashed)

(ii) User Activity Data

• Buds balance and Buds transfers
• transaction logs (timestamp, event, partner location)

(iii) Partner/Location Data

• legal registration and entity data
• identity of legal representative(s)
• contact details
• business information (opening hours, description, pictures)
• bank account details for settlement of Buds

We do not collect or store health data.
We do not collect precise GPS data unless user explicitly opts in.

---

3. Purpose of Processing + Legal Basis

Purpose	Legal Basis
Create and maintain User accounts	Art. 6(1)(b) GDPR — contract
Track Buds balances and transactions	Art. 6(1)(b) GDPR — contract
Provide platform analytics and anti-fraud	Art. 6(1)(f) GDPR — legitimate interest
Onboard Partners (Locations) and verify identity	Art. 6(1)(b) + (c) GDPR — contract + legal obligation where applicable
Process Buds settlements (EUR payouts to Partners)	Art. 6(1)(b) GDPR — contract
Comply with tax and accounting duties	Art. 6(1)(c) GDPR — legal obligation
Maintain security and prevent abuse	Art. 6(1)(f) GDPR — legitimate interest

We do not process personal data for advertising profiling.

---

4. Sharing of Data

We share data only with:

• cloud infrastructure providers (hosting, DB)
• third party authentication services (if enabled)
• financial services providers to execute EUR settlement to Partners

We do not sell personal data.

We may disclose data if required by law or court order.

---

5. International Transfers

Some service providers may be located outside the EEA.
In those cases, we only use providers under:

• adequacy decisions; or
• Standard Contractual Clauses (SCCs) approved by the EU Commission.

---

6. Data Retention

Data Type	Retention
User account data	while account active + 2 years
User transaction logs (Buds)	6 years (anti-fraud / accounting)
Partner KYC + banking	6 years after termination (AML/accounting)
Support communications	3 years

When retention expires, data is deleted or irreversibly anonymised.

---

7. Rights of Data Subjects

Under GDPR, you have the right to:

• access your data (Art. 15)
• rectify inaccuracies (Art. 16)
• erase your data (Art. 17)
• restrict processing (Art. 18)
• data portability (Art. 20)
• object to certain processing (Art. 21)

You can exercise these by contacting: service@weeds.studio

You also have the right to lodge a complaint with your supervisory authority.
In Spain: Agencia Española de Protección de Datos (AEPD).

---

8. Children

Weeds Studio is 18+ only.
We do not knowingly process data of minors under 18.

---

9. Security

We implement industry-standard technical and organisational measures to protect personal data, including:

• encryption in transit
• access-control by role
• pseudonymisation of transaction identifiers where possible
• multi-factor authentication for admin level accounts

---

10. Changes

We may update this Privacy Policy.
New versions will be published at weeds.studio/privacy-policy with an updated date.

---

11. Contact

For any privacy questions:

Weeds Studio — Emprezaa Agency
Barcelona, Spain
service@weeds.studio

---