Last updated: 10/04/2026
Rezz Limited, trading as Peoples CBD (“we”, “us”, “our”), is the controller of your personal data for this website and our retail activities. Our registered office is 71–75 Shelton Street, London WC2H 9JQ. If you have any privacy questions or want to exercise your data protection rights, please contact us at support@peoplescbd.co.uk.
This privacy policy explains how we use your personal data when you visit our website, create an account, place an order, contact us, subscribe to marketing, leave a review or testimonial, or complete age verification. For more detail about how we check age, please also read our Age Verification Policy.
What personal data we collect
We may collect and use the following categories of personal data:
- identity and contact information, such as your name, billing address, delivery address, email address and telephone number;
- account details, including login information and order history;
- order, payment and transaction information;
- delivery and tracking information;
- records of communications with us, including emails, messages and customer support enquiries;
- marketing preferences and consent records;
- review and testimonial content that you choose to submit;
- technical information about your device, browser, IP address and how you use our website, including cookies and similar technologies;
- age-verification information, such as your date of birth, the outcome of an age check and limited audit information;
- fraud-prevention and risk information supplied by relevant service providers.
How we use your personal data
We use your personal data to:
- create and manage your account;
- process and fulfil orders, take payment and arrange delivery;
- provide customer support, handle returns and deal with complaints;
- carry out age verification where required;
- prevent fraud, misuse and unlawful activity;
- operate, secure, maintain and improve our website and services;
- send service communications about orders, delivery, returns, account activity or important product information;
- send marketing emails or text messages where we are allowed to do so;
- manage customer reviews and testimonials;
- comply with legal, tax, accounting and regulatory obligations;
- establish, exercise or defend legal claims.
Our lawful bases
We rely on one or more of the following lawful bases under UK data protection law:
- Contract — where we need your information to take steps at your request or to perform our contract with you, such as processing your order, taking payment, delivering goods and handling returns.
- Legal obligation — where we need to keep records or carry out checks required by law.
- Legitimate interests — where we need to run and protect our business, manage customer service, prevent fraud, keep our website secure, improve our services and maintain suppression lists so we do not send marketing to people who have opted out.
- Consent — where consent is required, including for non-essential cookies and certain direct marketing.
Where you submit a review or testimonial containing health information or other special category data, we will only process or publish that information where we have an appropriate lawful basis and additional condition under data protection law, which will usually be your explicit consent.
Reviews and testimonials
If you choose to submit a review or testimonial, we may use that content in connection with your purchase and, where appropriate, display it on our website or marketing materials. Please do not include medical or health information in any public review or testimonial unless you are happy for us to assess whether we can lawfully use it. We may decline to publish or may remove or redact special category information where appropriate.
Age verification
Some products or transactions may require age verification. In those cases, we may verify your age ourselves or use a specialist age-verification provider. This may involve processing your name, address, date of birth, order details and, where required, additional proof of age. We may receive the result of the check and limited supporting information needed to record the outcome. More detail is available in our Age Verification Policy.
Marketing
We will only send you marketing by email or text message where:
- you have given us consent; or
- the law allows us to rely on the soft opt-in for our own similar products and services.
You can opt out of marketing at any time by using the unsubscribe link in an email, the opt-out method in a text message, or by contacting us.
Where we get personal data from
Most of the personal data we use comes directly from you. We may also receive limited information from payment providers, finance providers, delivery partners, age-verification providers, anti-fraud tools, review platforms and other service providers involved in fulfilling or supporting your order.
Who we share personal data with
We may share personal data with trusted service providers and partners where necessary, including:
- website hosting and ecommerce platform providers;
- payment processors;
- finance or buy-now-pay-later providers where you choose that payment method;
- age-verification providers;
- delivery and logistics partners;
- email, SMS and customer communication providers;
- review and feedback tools;
- IT, fraud-prevention and security suppliers;
- accountants, insurers, legal advisers and other professional advisers;
- regulators, law-enforcement agencies or other third parties where we are required or permitted to do so by law.
International transfers
Some of our service providers may process personal data outside the UK. Where that happens, we will ensure that a valid transfer mechanism is in place, such as a UK adequacy regulation or appropriate contractual safeguards, and we will take reasonable steps to make sure your information remains protected.
How long we keep personal data
We keep personal data only for as long as necessary for the purposes described in this policy. In general:
- order, tax and accounting records are kept for up to 6 years after the end of the relevant financial year;
- account information is kept while your account is active and for a reasonable period afterwards;
- customer service enquiries are kept for up to 24 months after closure unless a longer period is needed for a complaint or claim;
- marketing preferences and suppression records are kept for as long as needed to respect your choices;
- age-verification outcome records are kept for up to 6 years;
- cookie consent records are kept for up to 12 months;
- reviews and testimonials may remain published until removed, and limited internal records of submission or consent may be kept for compliance purposes.
When you must provide data
You do not have to provide all personal data to us. However, if you do not provide the information we need for checkout, payment, delivery, customer support or age verification, we may not be able to supply products or services to you.
Automated checks
Some payment, finance, fraud-prevention or age-verification providers may use automated checks as part of their own services. We may also receive automated pass/fail or risk outputs from those checks. Where an automated outcome significantly affects your order and we are responsible for acting on it, you may contact us to ask for a review.
Your rights
You have the right to:
- request access to your personal data;
- ask us to correct inaccurate or incomplete data;
- request deletion in certain circumstances;
- ask us to restrict processing in certain circumstances;
- object to certain processing, including direct marketing;
- ask for portability where applicable;
- withdraw consent at any time where we rely on consent.
To exercise any of these rights, please contact support@peoplescbd.co.uk.
Complaints
If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office (ICO).
Cookies
We use cookies and similar technologies on our website. Strictly necessary cookies are used to operate core functions such as basket, checkout, security and preference management. Non-essential analytics, advertising or similar cookies will only be used where you have given consent through our cookie settings. More detail is available in our Cookie Policy / Cookie Settings.
Changes to this policy
We may update this privacy policy from time to time. When we do, we will post the updated version on this page and update the “Last updated” date.