Children’s Privacy, No Use of the Services by Persons Under 21 Permitted
Federal and California state law imposes special restrictions and obligations on commercial website operators who direct their operations toward, and collect and use information from children under the age of 13 and 16, respectively. We do not intend for the Services to be used by persons under the age of 21 or age of 18 with a valid medical card, and certainly not by anyone under the age of 16. Any use of the Services by persons under the age of 21 or age of 18 with a valid medical card is strictly prohibited. Do not supply to us or disclose on the Services any personal information of any person under 16 years of age. The Services are intended for a mature audience, and we do not direct any of our content at children. We understand and are committed to respecting the sensitive nature of children’s privacy online. If we learn we have collected or received personal information from a child under 16, we will delete that information immediately. If you believe we might have any information from or about a child under 16, please contact us via e-mail at or via postal mail at the address listed in the “Contact Us” section of this Policy.
Cannabis Use in General
Cannabis use is not universally acceptable and permissible. For instance, it may be disallowed by some employers or in some facilities. You acknowledge that using the Services, providing your information, allowing Catalyst to collect data about you and interact with you may bring certain unwanted social, legal, employment, economic, or other impacts, including, but not limited to, your loss of employment. You acknowledge that your use of the Services and Catalyst products are solely at your own risk and that Catalyst shall not be held liable for damages arising out of or connected with the foregoing.
Information Collection Practices
Catalyst obtains information about you when you use the Services. Please note that we need certain types of information so that we can provide the Services to you. If you do not provide us with such information, or ask us to delete it, you may no longer be able to access or use all or part of the Services.
What Information Does Catalyst Collect?
- Information You Voluntarily Provide to Us
Catalyst collects information directly from you in a variety way including:
- Requesting your personal information and your government identification card in stores;
- Information that you provide by filling in forms on our Website;
- Records and copies of your correspondence (including email addresses), if you contact us;
- Your participation in research and surveys with us, if any; and
- Requests you submit for customer support and technical assistance.
Catalyst collects the following types of information directly from you:
- Name, address, date of birth, age, gender, state of residence, e-mail address, telephone number;
- If you visit one of our retail locations or request a product, information from your government identification card when you provide it to us, including your name, address, picture, driver license or other government identification card number, and any other information on your government identification card, as well as video, audio, and images that we capture from our security cameras inside and around our retail locations;
- Online log-in credentials;
- Information about purchases or other transactions with us;
- Information about your customer service and maintenance interactions with us;
- Information available on your cannabis medical recommendation documentation, if any;
- User-generated content you post in public online forums related to the Services; and
- Any other information you choose to directly provide to us in connection with you use of the Services.
- Information We Collect Through Automated Means
As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:
- Details of your visits to our Website, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Website; and
- Information about your computer and internet connection, including your IP address, operating system, and browser type.
The information we collect automatically may be only statistical data and does not necessarily include personal information, but we may maintain it or associate it with personal information we collect in other ways or receive from third parties. It helps us to improve our Website and to deliver a better and more personalized service, including by enabling us to:
- Estimate our audience size and usage patterns;
- Store information about your preferences, allowing us to customize our Website according to your individual interests;
- Speed up your searches; and
- Recognize you when you return to our Website.
The technologies we use for this automatic data collection may include:
“Cookies” are a feature in your browser software. If enabled, we, or our service providers, may write cookies that may store small amounts of data on your computer about your visit to any of the pages of the Website. Cookies assist us in tracking which of our features appeal the most to you and what content you may have viewed on past visits. When you visit this Website again, cookies can enable us to customize our content according to your preferences.
You are free to direct your web browser to delete cookies at any time. To learn how, consult your web browser’s user instructions. Note that if you delete your cookies, you may be required to sign into Catalyst again, and stored browsing preferences you selected previously may be forgotten.
You can also disable cookies, although the Website may not function properly for you. You may read more about cookies at http://cookiecentral.com.
Pages of the Website and Catalyst’s e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Catalyst, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
As we continue to develop the Website and the Services, we may implement additional methods to gather information about the Catalyst community.
- Information We Collect From Social Media and other Content Platforms
Catalyst maintains or will make a presence on a variety of social media platforms. When you “like” or “follow” us on Facebook, Instagram, Twitter, or other social media platforms, we may collect some information about you. This information includes your name, email address, any comments or content you post that is relevant to Catalyst. We also collect your information if you sign up for a promotion and submit information to us through one of our social media accounts.
How Does Catalyst Use Your Information?
The following paragraphs describe how Catalyst uses your information in connection with the Services.
- General Use.
Catalyst will use your information as necessary to carry out and manage the Services. This includes, using your information to verify your eligibility to use our Service and administer your account, processing payments, and fulfilling orders and tracking your accumulation of rewards based on your product purchase history and Services usage (if applicable). We will use your information to communicate with you about Catalyst’s Services, your use of the Services or your inquiries related to the Services. Catalyst will use your information to ensure that content from the Services is presented in the most effective manner for you and for your computer or device, allow you to participate in interactive features of the Services (when you choose to do so), and as part of our efforts to keep the Services safe and secure.
California requires careful verification of identity before allowing you to purchase cannabis products. When you visit our store at a physical location, we will request and examine your government-issued identification card and electronically scan it in order to verify your age and your identification’s validity. Once your data has been scanned, your name, address, identification number, photo, and other data may be retained by Catalyst for the purpose of creating an electronic profile about you, analyzing your use of the Services, enforcing cannabis purchasing regulations, and to help us customize Services and experiences for you.
Similarly, we use your IP Address, location data from by web browsers and mobile devices, your physical address if you provide it to us, and similar location data to identify your location in order to provide location-based services, such as showing you Services or products available in your area.
- Improve Catalyst’s Services.
Catalyst continuously seeks to improve its Services. To do so, we may conduct research to understand the effectiveness of the Services, improve the Services, and to better understand the Catalyst community. If we publish the results of our research to others, such research will be presented in a de-identified and aggregate form such that individual users cannot be identified.
- Safety and Security.
We may use your information to protect our users, ourselves, the Services, and our affiliates from fraud, theft, hacking, phishing and other unlawful activities. Information such as photographic and audiovisual recordings of you inside and around of Catalyst retail stores and vehicles will be used for the purpose of maintaining physical security, identifying you, and complying with laws and orders that require video surveillance. The photographic and audiovisual recordings taken by the security cameras are stored with proper measures by Catalyst and automatically erased every ninety days. You acknowledge that these records may be supplied to Catalyst employees or government agencies at any time, for any purpose, with or without a legal order or subpoena, and without notice or financial compensation to you.
- Promotional Communications.
We may use your personal information to communicate with you by email, postal mail, phone, or text message about surveys, promotions, special events or our products and Services and those of our affiliates or third-party partners, and any of their related businesses. To the extent applicable, you expressly acknowledge that you are solely responsible for all charges billed by your mobile service provider. If you no longer wish to receive promotional communications by email, please follow the unsubscribe link located at the end of the email message.
- Marketing/Performance Analysis & Data Analytics.
We will use your information to help us better understand your interests and needs, such as by engaging in analysis and research regarding use of the Services. We may use your information to measure or understand the effectiveness of advertising and content we serve to you and others, and to deliver and customize relevant advertising and content to you.
- Data Analytics
We may use third-party web analytics services on the Services to collect and analyze usage information through cookies and similar tools; engage in auditing, research, or reporting; assist with fraud prevention; try to locate the same unique users across multiple browsers or devices to better tailor services and features; and provide certain features to you. You may be able to disable or prevent certain tracking and/or analytics services through your browser or device.
If you receive email from us, we may use certain analytics tools, such as clear GIFs to capture data such as when you open our message or click on any links or banners our email contains. This data allows us to gauge the effectiveness of our communications and marketing campaigns.
- Online Advertising
- Mobile Advertising
When using mobile applications from others, you may also receive tailored in-application advertisements. We may use third-party service providers to deliver advertisements on mobile applications or for mobile application analytics. Each operating system, iOS for Apple phones, Android for Android devices, and Windows for Microsoft devices provides its own instructions on how to prevent the delivery of tailored in-application advertisements. We do not control how the applicable platform operator allows you to control receiving personalized in-application advertisements; thus, you should contact the platform provider for further details on opting out of tailored in-application advertisements. You may review the support materials and/or the device settings for the respective operating systems to opt-out of tailored in-app advertisements.
- Email Marketing
By submitting your email address through the Website or in-store, you are expressly consenting to receive emails from Catalyst, including from Catalyst’s affiliates, and from third parties concerning offers and advertisements unrelated to Catalyst. To opt-out of receiving email messages from us, from our affiliates or from other third parties, click on the “Unsubscribe” link contained in each email. Please allow up to 10 business days for us to process your request. Please note if you decide not to receive marketing emails from us, you may still receive transactional email messages regarding your order(s) (i.e., order confirmation, etc.). If you have questions or concerns regarding this provision, please contact us at firstname.lastname@example.org.
- Notice Concerning Do Not Tract
Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We do not currently recognize or respond to browser-initiated DNT signals.
- Combined Information.
- Aggregate/De-Identified Data.
We may aggregate and/or de-identify any information collected through the Services so that such information can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including for research and marketing purposes, and may also share such data with any third parties, including advertisers, promotional partners, and sponsors.
How Does Catalyst Share Your Information?
- To Affiliates & Related Business Entities. We may share the information we collect with our affiliates or related business entities, who are subject to certain common control with us, for the purposes of delivering the Services to you, ensuring a consistent level of service, and to enhance the Services and your customer experience.
- To Service Providers and Third-Party Vendors. We provide access to or share your information with select third parties who provide a variety of services to us, including billing, sales, marketing, advertising, analytics, research, customer service, shipping and fulfillment, data storage, IT and security, fraud prevention, payment processing, and auditing and legal services.
- During Business Transfers. As Catalyst continues to grow, we may buy, merge, or partner with other companies. In such transactions, your information may be among the assets that are transferred.
- In Public Forums. Any information that you submit through public forums is not confidential, and we may use it for any purpose (including in testimonials or other marketing materials). For example, if you submit a product review on one of our Websites or social media pages, we may display your review (along with the name provided, if any) on other Catalyst websites and on third-party websites. Any information you post openly in these ways will be available to the public at large and potentially accessible through third-party search engines.
- Aggregate/De-Identified Information.
If you would like to opt out of information sharing, please email your request to email@example.com. Note that Catalyst’s website and other Services require some information gathering in order to function properly, and in some cases, in order to meet cannabis regulatory requirements, so Catalyst’s Services may not be available for your use if you opt out of all information sharing.
We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. Such measures include, but are not limited to, access controls, monitoring, and the utilization of encryption to securely transmit sensitive information. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of the Website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
While we strive to protect your personal information, unfortunately, the transmission of information via the internet or method of data storage is not completely secure, and we cannot guarantee the absolute security of your personal information. Any transmission of personal information to us is at your own risk.
Third Party Data Practice
We do not control these third parties’ tracking technologies or how they may be used. It is your responsibility to review the third parties’ privacy policies to confirm that you understand and agree with their policies. If you have any questions about the third parties’ data collection and usage, you should contact the responsible provider directly.
Submitting Information from Outside the United States
Rights to Opt-In / Opt-out
You have the right to “opt in” and/or “opt out” of certain uses of your personal information. For example, you may have the opportunity to elect whether you would like to receive correspondence from us for marketing purposes, and how your information may be shared with third parties. To make an opt out request, send your request via email to firstname.lastname@example.org.
Your Choices in Accessing and Correcting Your Information
You can contact us by sending an email to email@example.com, to request access to, correct, or delete any personal information that you have provided to us. In some cases, we may not be able to fulfill your request if we believe the change would violate any law, any legal requirement, Catalyst’s policies, or cause the information to be incorrect. To protect your privacy and security, we will take reasonable steps (such as checking your state-issued government I.D. card) to verify your identity before granting you profile access or making corrections.
Please note that opting out, or asking that your data be deleted, may disable your access to some or all Services, and result in the loss of any Catalyst rewards points you may have accrued.
Privacy Rights for California Residents
If you are a California resident, California law may provide you with additional rights regarding our use of your personal information.
California “Shine the Light” law
California Civil Code Section 1798.83, also known as California’s “Shine the Light” law, allows individual California resident customers who have provided their personal information to us in obtaining products or services for personal, family or household use to request information about our disclosure of certain categories of personal information to third parties for their direct marketing purposes.
Such requests must be submitted to us by contacting us in accordance with the “Contact Us” section below. Within thirty (30) days of receiving an express written request, we will provide a list of the categories of personal information disclosed to third parties for third party direct marketing purposes during the immediately preceding year, along with the names and addresses of those third parties. This request may be made no more than once per calendar year. We reserve the right not to respond to requests submitted in ways other than those specified above.
California Consumer Privacy Act (CCPA) Disclosures
The California Consumer Privacy Act of 2018 (“CCPA”) requires us to provide additional privacy-related information to residents of California.
The section entitled “Information Collection Practices” above lists the categories of personal information we have collected about California residents in the preceding 12 months. These categories of personal information correspond with the following categories of personal information provided under the CCPA:
|A. Identifiers.||A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, driver’s license number, passport number, or other similar identifiers.|
|B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).||A name, signature, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, medical information, or health insurance information.Some personal information included in this category may overlap with other categories.|
|C. Protected classification characteristics under California or federal law.||Age (40 years or older), race, color, ancestry, national origin, citizenship, medical condition, gender, veteran or military status|
|D. Commercial information.||Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.|
|F. Internet or other similar network activity.||Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement, click stream or telemetry data or location data about your devices, browsers, and online behavior|
|G. Geolocation data.||Physical location or movements.|
|H. Sensory data.||Audiovisual footage and images that we capture from our security cameras inside and around our retail locations|
|K. Inferences drawn from other personal information.||Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.|
The section entitled “How Does Catalyst Use Your Information?” above lists the business and commercial purposes for which we collect California residents’ personal information. We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
As described above in the section entitled “How Does Catalyst Share Your Information?” we also share and/or disclose your personal information as follows:
- Sharing your personal information for business purposes. We may share the following categories of your personal information with subsidiaries, affiliated companies, subcontractors, service providers, third parties, public or government (including enforcement) authorities, creditors, and successors for our business purposes: government-issued identification card content; purchase histories; website preferences; and, contact information such as name, phone number, and email address. As described above, examples of business purposes include sending marketing messages to you, executing payment transactions, delivering products to you, registering your accounts, analyzing your purchasing histories, and maintaining and enhancing the Services.
- Sharing your personal information for commercial or other purposes. We may share the following categories of your personal information with third parties, subsidiaries, and affiliated companies in a manner that constitutes a “sale” under California law: government-issued identification card content; cannabis purchase histories; website preferences; and, contact information such as name, phone number, and email address. This information may be shared for the purposes of sending marketing messages, executing payment transactions, registering accounts, analyzing purchasing histories, executing product deliveries to you, and maintaining and enhancing the Services. Note that for the purposes of this paragraph, “sale” refers to any exchange of value, however, while an affiliate may gain value (in the form of knowledge) from analyzing the purchasing habits of customers (therefore constituting a “sale” under California law), Catalyst DOES NOT sell your personal information to others for money.
California Residents’ Privacy Rights and Choices
The CCPA provides California residents with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.
Right to Know and Data Portability
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months (the “right to know”). Once we receive your request and confirm your identity (see Exercising Your Rights to Know or Delete), we will disclose to you:
- The categories of personal information we collected about you.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose for collecting or selling that personal information.
- The categories of third parties with whom we share that personal information.
- If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
- sales, identifying the personal information categories that each category of recipient purchased; and
- disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
- The specific pieces of personal information we collected about you (also called a data portability request).
We do not provide a right to know or data portability disclosure for business-to-business personal information, where the information is collected while you are acting on behalf of a business, and the communications or transactions solely relate to providing or receiving a product or service to or from another business (“B2B personal information”).
Right to Delete
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions (the “right to delete”). Once we receive your request and confirm your identity (see Exercising Your Rights to Know or Delete), we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
- Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
- Comply with a legal obligation.
- Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
We will delete or de-identify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.
We do not provide these deletion rights for B2B personal information.
Exercising Your Rights to Know or Delete
To exercise your rights to know or delete described above, please submit a request by either:
- Calling us at (562) 370-3780
- Emailing your request to firstname.lastname@example.org
- Visiting https://catalyst-cannabis.com/privacy-policy/.
Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your personal information.
You may only submit a request to know twice within a 12-month period. Your request to know or delete must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include:
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. You do not need to create an account with us to submit a request to know or delete.
We will only use personal information provided in the request to verify the requestor’s identity or authority to make it. For instructions on exercising your sale opt-out or opt-in rights, see Personal Information Sales Opt-Out and Opt-In Rights.
Response Timing and Format
We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact [CONTACT].
We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.
Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Personal Information Sales Opt-Out and Opt-In Rights
You have the right to direct us to not sell your personal information at any time (the “right to opt-out”). Consumers who opt-in to personal information sales may opt-out of future sales at any time.
To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by visiting the following Internet Web page link:
Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and opt back in to personal information sales at any time by:
You do not need to create an account with us to exercise your opt-out rights. We will only use personal information provided in an opt-out request to review and comply with the request.
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:
- Deny you goods or services.
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of goods or services.
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time. We currently provide the following financial incentives: a rewards program (the “Program”) that provides discounts when customers accrue points by purchasing Catalyst products, subject to the terms of the Program. In exchange for offering discounts through Program, Catalyst uses data acquired through the Program to help identify sales trends. You can opt out of the Program at any time by contacting Catalyst at email@example.com. Note that if you opt out of the Program, any rewards points you have accrued will become unavailable for use.
If you have any questions or comments about this notice, the ways in which Catalyst collects and uses your information described here, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at: