Privacy Policy

1. Controller

Stonedhenge Club ("the Club", "we", "us") is the data controller responsible for your personal data. Contact: info@stonedhenge.club

2. Data we collect

• Membership application: full name, date of birth, email, WhatsApp, document type, document number, document expiry date, a photo of your document and your handwritten signature.
• Account: name, email address, role (member / VIP), session data.
• Newsletter: email address (only after confirmed double opt-in).
• Technical: IP address (for security logging), browser/device info in sessions.

Document numbers and signatures are encrypted at rest. Document photos are kept in private storage that is never publicly reachable and can only be opened through a short-lived staff link. Every view of a document is written to the access log.

3. Purpose and legal basis

• Membership management: performance of a contract (GDPR Art. 6(1)(b)). Verifying member eligibility as required by Spanish CSC regulation.
• Identity verification: performance of a contract (GDPR Art. 6(1)(b)) — Spanish cannabis social club rules require us to confirm that every member is an identified adult before granting access.
• Email communications: consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time.
• Security logging: legitimate interest (GDPR Art. 6(1)(f)) — protecting club members and preventing fraud.

4. Data retention

• Active member accounts: retained while membership is active.
• Membership applications: 2 years from submission date.
• Document number, document photo and signature: erased 30 days after your application is approved or rejected.
• Applications we never review: their document number, photo and signature are erased after 180 days.
• Newsletter subscriptions: until you unsubscribe.
• Security/audit logs: 1 year.

5. Your rights

Under GDPR and Spanish LOPD-GDD (Ley Orgánica 3/2018), you have the right to:

• Access your data — request a full export via your account settings or email us.
• Rectification — correct inaccurate data.
• Erasure ("right to be forgotten") — delete your account via settings or email us.
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive your data in machine-readable format (JSON export available in settings).
• Object — object to processing based on legitimate interest.

To exercise any right, contact us at info@stonedhenge.club. We will respond within 30 days.

You may also lodge a complaint with the Spanish data protection authority: AEPD (Agencia Española de Protección de Datos) — aepd.es

6. Data sharing

We do not sell or share your personal data with third parties for marketing. Data is processed by the following sub-processors under GDPR-compliant data processing agreements:

• Supabase (database) — EU data residency (eu-west-1)
• Vercel (hosting) — SOC 2 certified
• Resend (email delivery) — GDPR compliant

7. Cookies

We use strictly necessary cookies for authentication sessions. Analytics cookies (PostHog) are only set after your explicit consent via the cookie banner.