Privacy policy

01Introduction

Phytoventures Ltd ("we", "us", "our") is committed to protecting your privacy and handling your personal data transparently and lawfully. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit or interact with our website at phytoventures.net (the "Website"), use our Client Portal, or engage with any of our services.

Phytoventures Ltd (Company Number: 16388003), registered at Belmont Suite, Chorley New Road, Horwich, Bolton, BL6 6HG, is the data controller for the purposes of applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our Data Protection Officer (DPO) can be contacted at [email protected].

This policy covers all personal data processed by Phytoventures Ltd across all of our services, including the Client Portal, CannConnect events, Ask Patients surveys, the intelligence service, the free website programme, and all professional services we provide.

02Information We Collect

2.1 Account Information

When you register for a Client Portal account or engage our services, we may collect:

• Full name
• Email address
• Phone number
• Business name
• Business address
• VAT number
• Company registration number
• Industry sector

2.2 Authentication Data

To secure your account, we process:

• Magic link tokens (stored in hashed form only)
• Two-factor authentication (2FA) secrets (stored in encrypted form)
• Session data (session identifiers and expiry timestamps)

2.3 Financial Data

In connection with our billing and payment services, we may collect and process:

• Invoice records and payment history
• Bank details (for Accounts Payable purposes)
• GoCardless Direct Debit mandate references
• Revolut payment references
• Credit facility records and credit limit information

2.4 Usage Data

When you use the Website or Client Portal, we automatically collect:

• Login timestamps
• IP addresses
• User agent strings (browser type, version, operating system)
• Pages visited and actions taken
• Audit log entries (recording significant account actions for security purposes)

2.5 Communications

We collect data from your interactions with us, including:

• Support tickets and correspondence
• Comments and feedback
• Survey responses (where we act as data processor. See Section 6)
• Project files and deliverables shared through the Client Portal

2.6 Event Data

When you book or attend CannConnect events, we may collect:

• Event bookings and attendance records
• Sponsorship details and contracts
• Electronic signatures

2.7 Third-Party Data

We may receive data from third-party services we use to process payments and deliver communications:

• GoCardless: mandate status, payment status, and confirmation data
• Revolut: payment confirmation data
• Resend: email delivery status (delivered, bounced, opened)

03How We Use Your Information

We use the personal data we collect for the following purposes:

• Provide and manage our services. Delivering web development, branding, platform development, AI and automation, compliance support, consulting, and other professional services.
• Process payments and manage billing. Issuing invoices, processing payments via GoCardless and Revolut, managing credit facilities, and generating financial statements.
• Send franchise player emails. Sending news and event emails on behalf of our franchise partners to players who opted in (section 7).
• Send transactional emails. Invoices, magic link authentication emails, payment confirmations, status updates, and other service-related communications.
• Manage your Client Portal account. Account creation, authentication, session management, and account settings.
• Process event bookings and sponsorships. Managing CannConnect event registrations, sponsorship agreements, and related communications.
• Distribute surveys. Processing and distributing Ask Patients surveys on behalf of data controllers (clients).
• Generate statements and financial reports. Producing account statements, payment summaries, and financial reports for clients.
• Provide customer support. Responding to support tickets, resolving issues, and managing client communications.
• Ensure security. Audit logging, rate limiting, fraud prevention, and protecting against unauthorised access.
• Comply with legal obligations. Meeting our regulatory, tax, and legal requirements, including responding to law enforcement requests.
• Improve our services. Analysing usage patterns to enhance the Website, Client Portal, and our service delivery.

04Legal Basis for Processing

We process your personal data on the following legal bases under the UK GDPR:

• Contract performance (Article 6(1)(b)). Processing necessary to perform our contractual obligations to you, including delivering services, managing your Client Portal account, and processing payments.
• Legitimate interests (Article 6(1)(f)). Processing necessary for our legitimate business interests, including operating and improving our Website and services, ensuring security, preventing fraud, and maintaining audit logs. We ensure these interests do not override your fundamental rights and freedoms.
• Legal obligation (Article 6(1)(c)). Processing required to comply with our legal obligations, including tax record-keeping (HMRC requirements), anti-money laundering regulations, and responding to law enforcement requests.
• Consent (Article 6(1)(a)). Where we process data based on your consent, such as for marketing communications, including the franchise player emails in section 7 (consent is also required for marketing emails by the Privacy and Electronic Communications Regulations 2003). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

05Data Sharing

We share your personal data only with the following categories of recipients, and only to the extent necessary:

• GoCardless. Payment processing service. We share mandate and payment data to process Direct Debit payments. See the GoCardless privacy policy.
• Revolut. Payment processing service. We share payment references to process and reconcile payments. See the Revolut privacy policy.
• Resend. Email delivery service. We share email addresses and email content to send our transactional emails (invoices, magic links, status updates) and, for people who opted in, the franchise player emails described in section 7. Resend acts as our processor. See the Resend privacy policy.
• Cloudflare. Content delivery and DDoS protection. Cloudflare may process IP addresses and request headers to protect our Website from malicious traffic. See the Cloudflare privacy policy.
• Debtist. Debt collection service. Where an invoice remains unpaid for 30 days past its due date, we may share your name, company name, email address, phone number, postal address, and details of the outstanding debt (invoice number, amount, and due date) with Debtist GmbH for the purpose of debt recovery. This processing is carried out on the basis of our legitimate interest in recovering monies owed under Article 6(1)(f) UK GDPR. See Debtist Privacy Policy.
• Law enforcement. We will only share personal data with law enforcement agencies when we are legally compelled to do so, such as in response to a valid court order or statutory obligation. For more information, see our Law Enforcement & Data Disclosure Policy.

We do NOT sell your personal data. We do NOT share your personal data with third parties for their marketing purposes. Franchise partners do not receive the email addresses of the players we email for them.

06Ask Patients: Data Processor Role

When clients create and distribute surveys through our Ask Patients service, the following data protection arrangements apply:

• The client is the data controller for all survey respondent data. The client determines the purposes and means of processing survey respondent personal data.
• Phytoventures Ltd is the data processor, processing survey respondent data solely on behalf of and in accordance with the instructions of the client.
• Survey respondents consent to the client's privacy policy, not ours. It is the client's responsibility to provide respondents with a clear and lawful privacy notice.
• We do not use survey response data for our own purposes. We do not access, analyse, or share survey response data except as necessary to provide the Ask Patients service to the client or as required by law.
• A Data Processing Agreement (DPA) is included as part of the Ask Patients contract with each client.

07Franchise Player Emails

Phytoventures Ltd licenses game servers to franchise partners (for example RoleplayProject Balkan). Through our Partner Portal, a franchise partner can write news and event emails for the players of its server. Phytoventures Ltd sends those emails on the partner's behalf and is the controller of the personal data used to send them. We hold the mailing list and the consent records, decide how the emails are sent, and apply the rules in this section. The franchise partner decides what its emails say and which of the audience groups below receive them, and we check its first email and any large send before it goes out.

Franchise partners never see your email address or any other personal data about you. They only see totals, such as how many people opted in or how many an email went to.

7.1 What we use

• Your email address. Either the address you give on the franchise's email page on our site, or the address on your account on that franchise's game server.
• Your opt-in record. What you agreed to, the exact wording you saw, when, and where you did it (the email page on our site, your account settings on the franchise server, the in-game settings, or the box at account sign-up). On our email page we keep a one-way scrambled (hashed) form of the IP address used, not the address itself. Opt-ins made on a franchise server are recorded in that server's own consent records, which keep the IP address used.
• The franchise you signed up to. Your choice applies to that franchise only.
• Activity, for audience groups. If your email address matches an account on the franchise server, we use when you joined and the date you last played to decide whether you fall into a group the partner picked, such as "played in the last 30 days", "not played for 30 days or more" or "joined in the last 30 days". We do not use anything else about your account.
• Delivery records. Whether each email was sent, delivered, bounced or marked as spam, and whether you unsubscribed from it.
• Opens and clicks, only if you agreed separately (section 7.4).

7.2 Lawful basis

We send these emails only with your consent (Article 6(1)(a) UK GDPR and regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR)). You can withdraw it at any time (section 7.7), which does not affect emails sent before you withdrew. We keep consent records and the list of people who have unsubscribed because the law requires us to be able to show consent (Article 7(1) and Article 5(2) UK GDPR) and in our legitimate interest in never emailing someone who has said no (Article 6(1)(f)).

7.3 Double opt-in

When you sign up on the franchise's email page on our site, in your account settings on the franchise server, or in the server's in-game settings, we send one email with a confirmation link. You are only added once you press it. The link works for 72 hours; if you ignore it, nothing else is sent. That confirmation email is a service email about your request, not marketing. Players who ticked the news emails box when they created their account on a franchise server are treated as opted in from that tick, without a separate confirmation email.

7.4 Counting opens and clicks (optional, separate consent)

Our email page has a second, separate box asking whether we may count when you open an email and which links you click. Only if you tick it do your emails include a tiny image that tells us when the email was opened, and links that pass through our server so a click can be counted before you are taken to the page. We record the time against that email only; we do not store your IP address or device for this, although, like any web request, the request reaches our web server. Without that tick, and for everyone who opted in from a franchise server's settings or sign-up, emails carry no tracking image and links go straight to their destination. To stop the counting, unsubscribe and sign up again without the second box, or email [email protected].

7.5 Resend

Resend (Resend, Inc.) sends these emails for us as our processor, the same provider that sends our transactional emails. For each email it receives your email address, the email itself and the sender details, and it tells us whether the email was delivered, bounced or marked as spam. Resend acts only on our instructions. See section 12 for transfers.

7.6 How long we keep it

• Addresses given on our email page: stored encrypted while you are subscribed and deleted when you unsubscribe. If you never press the confirmation link, the address is deleted after 7 days.
• Addresses of franchise players: stay in the franchise server's account records under that server's privacy policy. We read them only when an email is about to be sent.
• Per-email send records: the address is stored encrypted only until that email has been sent and is then wiped. The record keeps a one-way code of the address, the delivery result, and opens and clicks if you agreed to them. We have not yet set a fixed period for these records; we will publish one here.
• Consent records and the unsubscribe list: a one-way code of your address, what happened and when. We keep these for as long as we need them to show we had your consent and to make sure we never email you again after you unsubscribe. If you ask us to delete them, we will, but we may then be unable to stop someone signing your address up again.

7.7 Unsubscribing and withdrawing consent

• Use the unsubscribe link in any email, or your email app's own unsubscribe button. It works in one click.
• Turn news emails off in your account settings on the franchise server, or in the in-game settings.
• Ask for an unsubscribe link on the franchise's email page on our site.
• Email [email protected].

An unsubscribe takes effect straight away: we check again just before each email is sent, so it applies even to an email that is already going out. We also pass it back to the franchise server so your account there shows you as unsubscribed. A hard bounce or a spam complaint stops all franchise emails to that address. Opting in again later, with a new confirmation, starts them again.

7.8 Your rights

You have the rights in section 9 for this data too. Send requests to [email protected], not to the franchise partner: it does not hold your email data.

08Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are as follows:

• Account data: retained while your account is active, plus 6 years after account closure (to meet legal and tax obligations).
• Financial records: 6 years from the date of the transaction (as required by HMRC).
• Audit logs: 2 years from the date of the log entry.
• Magic link tokens: deleted immediately after use or upon expiry (15 minutes), whichever occurs first.
• Session data: automatically expires after 8 hours of inactivity.
• Support tickets: retained while your account is active. Deleted upon account closure, subject to any legal retention requirements.
• Franchise player emails: see section 7.6.
• Survey responses (Ask Patients): retained until the data controller (client) requests deletion. As data processor, we delete survey data in accordance with the client's instructions.

09Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access. Request a copy of the personal data we hold about you.
• Right to rectification. Request correction of inaccurate or incomplete data.
• Right to erasure. Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Right to restrict processing. Request that we limit how we use your data in certain circumstances.
• Right to data portability. Request your data in a structured, commonly used, machine-readable format.
• Right to object. Object to our processing of your personal data where we rely on legitimate interests as the legal basis.
• Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to complain. Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.

How to exercise your rights: You may submit a request by emailing [email protected], or by using our Subject Access Request page. We will respond to your request within one month. In complex cases, we may extend this by a further two months, and we will inform you if this is necessary.

10Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

• HTTPS everywhere. All data transmitted between your browser and our servers is encrypted using TLS.
• Helmet security headers. HTTP security headers to protect against common web vulnerabilities.
• Bcrypt password hashing. Where passwords are used, they are hashed using bcrypt with appropriate salt rounds.
• Encrypted sessions. Session data is encrypted and stored securely.
• Rate limiting. Protection against brute-force attacks and abuse on all authentication endpoints and forms.
• Two-factor authentication (2FA). Available for all Client Portal accounts for enhanced security.
• Regular security audits. Periodic reviews of our security practices and infrastructure.
• Access controls. Strict role-based access controls to limit who can access personal data within our organisation.
• Data minimisation. We only collect and process personal data that is necessary for the stated purpose.

11Cookies

Our Website uses only essential session cookies required for the site and Client Portal to function correctly:

• connect.sid. A session cookie used for authentication in the Client Portal. This cookie is essential for maintaining your logged-in state and expires when your session ends or after 8 hours of inactivity.

We do not use analytics cookies, advertising cookies, or tracking cookies.

Cloudflare, which provides content delivery and security for our Website, may set its own security cookies (such as __cf_bm) to distinguish between humans and bots. These are strictly necessary cookies and do not track you for advertising purposes.

12International Transfers

Your personal data is primarily stored on servers located in the United Kingdom and the European Union.

Some of our third-party service providers may process data in the United States or other countries outside the UK. Where international transfers occur, we ensure appropriate safeguards are in place:

• GoCardless. May process data in the EU/UK under their own GDPR compliance framework.
• Resend. May process data in the United States under Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner.
• Cloudflare. Operates a global network and may process data in various jurisdictions under Standard Contractual Clauses and their own data processing addendum.
• Debtist. Based in Germany (EU). Data transfers are covered by the UK-EU adequacy decision and Debtist's own GDPR compliance framework.

13Children

Our Website and services are not directed at anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe that we have inadvertently collected personal data from a person under 18, please contact us immediately at [email protected] and we will take steps to delete the data promptly.

14Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Any changes will be published on this page with an updated "Last updated" date.

Where we make material changes that significantly affect how we process your personal data, we will notify you via email or through a notification in the Client Portal, in addition to updating this page.

Summary of changes

12 October 2026.

• New section 7, Franchise Player Emails: we send news and event emails for our franchise partners as controller, only with consent and double opt-in; what data we use, optional open and click counting with separate consent, Resend as our processor, how long we keep it, how to unsubscribe, and that partners never see email addresses.
• Section 3 lists franchise player emails as a purpose; section 4 names PECR for marketing consent; section 5 now says Resend also sends franchise player emails; section 8 points to the new retention rules.
• Sections 7 to 14 are renumbered 8 to 15.

30 March 2026. Previous version.

15Contact

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how we handle your personal data, please contact us:

• Company: Phytoventures Ltd
• Address: Belmont Suite, Chorley New Road, Horwich, Bolton, BL6 6HG
• Privacy enquiries: [email protected]
• Data Protection Officer: [email protected]
• Company Number: 16388003
• Registered in: England and Wales

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113