1. Who we are
THCBD, LLC is a limited liability company registered in the United States that provides computer systems design and related professional, scientific and technical services. Our practice plans greenhouse bench rooms, designs batch registers and schedule systems, and runs structured advisory rounds for plant rooms and small laboratories.
Our principal place of business is 475 W 3RD Ave, Roselle - 07203-1836, United States (US). We are the controller of the personal information described in this policy, which means that we decide why and how that information is used.
This policy was written and adopted by THCBD, the developer and practice lead of THCBD, LLC. That name identifies the individual who maintains our records and who answers privacy questions sent to the contact details at the end of this document.
We take a deliberately plain approach to privacy. We collect little, we keep it briefly, and we do not build profiles of visitors in order to sell advertising. The sections below explain that approach in detail so that you can decide with confidence whether to contact us.
2. Scope of this policy
This policy applies to personal information that we handle through our website at www.thcbd.eu, including the homepage, the services pages, the contact page and the legal pages. It also applies to information you give us by email, by telephone, through a contact form, or during a visit to a client room or to our bench room in Roselle.
This policy does not apply to information that a client collects and controls inside the client own schedule systems, batch registers or greenhouse instrumentation. Where we design and install a system for a client, the client remains responsible for the personal information that system holds, and our processing of that information is governed by a separate written agreement between THCBD, LLC and the client.
This policy also does not cover information collected by third party websites that we may link to. If you follow a link away from our site, the privacy policy of the destination site will apply, and you should read it before providing any information there.
3. Information we collect
We collect personal information that is necessary to answer enquiries, prepare bench plans, provide services and keep ordinary business records. We do not ask for information that we do not need, and we do not collect information simply because a tool makes it possible.
Information you give us
- Contact details such as your name, email address, telephone number and postal address.
- The content of messages you send through our contact form, by email or by telephone.
- Details about the room or site you want us to plan, including its location, size, layout and the measurements we take during a visit.
- Billing and payment details that you provide when we issue an invoice, limited to what an accounting process requires.
- Records of appointments, site visits, walk sessions and follow up notes that we prepare during a project.
Information collected automatically
When you load a page on our site, the server that delivers the page may record technical information in a standard access log. That information can include the type of browser you use, the operating system of your device, the page you requested, the date and time of the request and the internet protocol address from which the request came. This information helps us keep the site available and secure, and it is not used to identify you personally.
Information we do not collect
We do not collect payment card numbers through this website. We do not ask for government identification numbers, health information, biometric information or information about your racial or ethnic origin through this site. If a project ever required information of that kind, we would ask for it separately, explain why it is needed and handle it under a specific written arrangement.
4. How we collect information
Most of the information we hold comes directly from you. You type it into the contact form, you send it in an email, or you tell it to us on a call or during a site visit. We prefer direct collection because it reduces the chance of error and keeps the record clear about where each fact came from.
Some technical information is collected automatically by our hosting environment when your browser requests a page. Our mail and calendar providers may also record metadata such as the time a message arrived or the address it was sent to. That metadata is used for ordinary correspondence and security, not for profiling.
We do not buy personal information from data brokers, and we do not obtain contact lists from third parties for marketing purposes. Where a client introduces us to a colleague, we treat the introduction as direct information supplied by the client and we use it only to respond to the enquiry that prompted it.
5. Why we use personal information
We use personal information for a small number of specific purposes. Each purpose is tied to work you have asked us to do or to a legal duty that applies to a business of our kind.
- To reply to enquiries and schedule first visits, walk sessions and bench planning appointments.
- To prepare bench plans, capacity notes, shelf maps and batch register designs for a client room.
- To deliver and manage the services described on our services page, including rounds, care weeks, log days and evening checks.
- To issue invoices, keep accounting records and meet tax and company reporting obligations.
- To keep the site and our communication systems secure, available and free of misuse.
- To improve our services by reviewing how projects were run and how a bench room behaved over a season.
- To send follow up messages about a project you have asked us to handle, or about a service you have purchased.
We do not use personal information for unrelated purposes, and we do not use project information to market the services of other organizations. If we ever wanted to use information for a purpose that is not described here, we would ask for your agreement first or set out a new policy that explains the change.
6. Legal bases for processing
Where data protection law requires a legal basis, we rely on the following bases. Performance of a contract applies when we handle information to deliver a service you have engaged us to provide. Legitimate interests applies when we keep the site secure, answer an enquiry you have sent us or improve the way our practice works, provided that those interests are not outweighed by your rights.
Consent applies when you clearly agree to a specific use, such as opting in to occasional project updates. Legal obligation applies when we keep accounting records, respond to a lawful request from a public authority or comply with a court order.
You may withdraw consent at any time by writing to the contact address at the end of this policy. Withdrawing consent does not affect the lawfulness of processing that took place before the withdrawal, and it does not affect processing that relies on another legal basis.
8. Site measurement and diagnostics
We look at aggregate information about site traffic so that we know which pages are useful and which pages fail to load. Aggregate information counts visits and page requests and does not identify any individual visitor. We do not combine aggregate information with contact details to build a personal profile.
When a page fails, our hosting provider may record an error with the time and the address of the request. We use those error records only to fix the failure, and we delete them once the incident has been resolved and the cause has been documented.
We do not use session recording, heat map tools, fingerprinting libraries or any technique that reconstructs how an individual visitor moved through the site. Our policy is that measurement should describe the site, not the person.
10. Service providers and processors
Where a provider processes personal information on our behalf, we treat that provider as a processor. We choose providers that offer appropriate security and we require them to use information only for the purpose we set. Providers that host our site, carry our mail and keep our accounts all operate under written terms that reflect those expectations.
We review our providers at least once a year and whenever a provider changes its practices in a material way. If a provider can no longer meet our standard, we move the relevant service elsewhere and update this policy if the change affects how information is handled.
Some providers are located outside the United States. Where that is the case, we rely on the safeguards described in the international transfer section below and we keep a record of the safeguard that applies to each provider.
11. How long we keep information
We keep personal information only for as long as we need it for the purpose that justified its collection. Enquiries that do not lead to a project are removed within twelve months of the last contact. Project correspondence and bench plans are kept for the duration of the engagement and for a further period that allows us to answer questions about the work.
Accounting records are kept for the period required by tax and company law, which is generally several years. Batch registers that we design for a client belong to the client, and where we keep a copy for archival reference we keep it only with the client agreement and only for the period stated in the engagement letter.
When a retention period ends, we delete the information or remove the details that could identify a person, so that the remaining material can no longer be linked to an individual. We apply the same rule to backups within a reasonable period after a scheduled rotation.
12. How we protect information
We protect personal information with technical and organizational measures that are proportionate to the small scale of our practice. Access to our records is limited to the people who need it for a specific task. Accounts are protected by strong passwords and multi factor authentication where the provider supports it, and devices are kept patched and encrypted.
Paper records, including signed registers and bench plans, are kept in a locked cabinet in our bench room. Photographs of signed registers are stored in a folder that is available only to the practice lead and the project owner, and they are removed when the retention period ends.
No system is perfect, and we do not claim that a breach is impossible. If a security incident affects personal information, we will act promptly to contain it, assess the risk and notify affected people and any relevant authority where the law requires notification. We will also explain what happened in plain language and what we have changed to prevent a repeat.
13. International transfers
THCBD, LLC is based in the United States, and our own records are kept there. Some service providers may process information in other countries, which means that information can cross a border during ordinary delivery of a service.
Where we transfer personal information from a jurisdiction that restricts such transfers, we rely on a recognized safeguard such as a standard contractual clause or an adequacy decision, and we require the receiving organization to protect the information to a standard that is materially equivalent to the one we apply ourselves.
You may ask us for more information about the safeguard that applies to a particular transfer by writing to the contact address at the end of this policy. We will explain the mechanism in plain language and, where appropriate, provide a copy of the relevant terms.
14. Your privacy rights
Subject to the law that applies to you, you may have the right to ask for a copy of the personal information we hold about you, to ask us to correct information that is wrong, to ask us to delete information that we no longer need, and to ask us to restrict or object to certain uses.
You may also have the right to receive information in a portable format, to withdraw consent where processing relies on consent, and to lodge a complaint with a supervisory authority in your country. We will not discriminate against you for exercising a privacy right, and we will not charge a fee unless a request is manifestly unfounded or excessive.
To make a request, write to contact@thcbd.eu or call +16189341334 and tell us what you would like us to do. We may ask for a small amount of information to verify that the request comes from you. We aim to respond within thirty days and will tell you if a request needs more time because it is complex.
15. Privacy for children
Our website and services are intended for businesses and professionals. They are not directed to children, and we do not knowingly collect personal information from a child under the age of thirteen. If a message reaches us that appears to come from a child, we will not use it for any purpose beyond replying to explain that our services are meant for adults.
If you believe that a child has provided personal information to us, please contact us and we will delete the information promptly. We keep this section short because the safest approach for a professional practice is simply not to collect information from children at all.
16. Email and marketing choices
We send project related messages to clients and enquirers because those messages are part of the service. We do not send promotional newsletters unless you have asked to receive them. If you do opt in to occasional updates, each message includes a simple way to stop receiving them.
You can also ask us to stop contacting you for any purpose by writing to contact@thcbd.eu or calling +16189341334. We will keep a short suppression record so that we do not contact you again by mistake, and that record will contain only the minimum needed to honor the request.
Transactional messages, such as a reply to a question you have asked or an invoice for work you have commissioned, are not marketing and will continue while a project is active.
17. Third party sites and links
Our site may link to a third party website when a link is useful to a reader, for example a mapping service or a professional body. We do not control those sites, and we are not responsible for their content or their privacy practices.
When you follow a link, the destination site may set cookies or ask for information under its own policy. We encourage you to read that policy before providing personal information. A link from our site is not an endorsement of the privacy practices of the destination.
If you find a link on our site that points somewhere unexpected or unsafe, please tell us so that we can review it and remove it if necessary.
18. Automated decision making
We do not use automated decision making that produces legal or similarly significant effects for an individual. Our bench plans and schedules are prepared by people who look at a room and speak with the people who work there, and no software makes a decision about a client on its own.
Some scheduling tools use simple rules to highlight a crowded week or a missing log line. Those rules are prompts for a person to review, not decisions. A planner always looks at the underlying record before acting on a prompt, and the final choice stays with the practice.
If we ever introduce a tool that makes a decision without a person in the loop, we will describe it here and provide a way to request human review before the tool affects you.
19. Changes to this policy
We review this policy at least once a year and whenever our services or our providers change in a way that affects personal information. When we make a material change, we will update the effective date at the top of the page and, where the change is significant, we will add a short note on the homepage for a reasonable period.
If a change would affect how we use information that we already hold, we will explain the change and, where the law requires consent, ask for it before the new use begins. Continuing to use our site after an update means that you have had the opportunity to read the revised policy.
Earlier versions of this policy are kept with our records and can be provided on request in order to show how our practices have evolved.
20. How to contact us
If you have a question about this policy, a request about your personal information or a concern about the way we have handled information, please contact the practice lead directly. We treat privacy questions as ordinary correspondence and we aim to reply within a few business days.
THCBD, LLC
475 W 3RD Ave, Roselle - 07203-1836, United States (US)
Email: contact@thcbd.eu
Phone: +16189341334
You may also raise a concern with a data protection authority in your country if you believe that we have not resolved a matter fairly. We would appreciate the chance to address the issue first, and we will cooperate fully with any authority that reviews it.