The Library of New Jersey ("The Library," "we," "us," or "our") operates a licensed cannabis dispensary. We are committed to protecting your personal information and respecting your privacy rights. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

1. Information We Collect

We collect the following types of information:

• Identity Information: Government-issued ID details (name, date of birth, address) for age verification
• Contact Information: Email address, phone number, mailing address
• Account Information: Username, password, order history, preferences
• Payment Information: Payment method details (processed securely by third parties)
• Usage Data: IP address, browser type, pages visited, device information

2. How We Use Your Information

• Legal compliance and age verification
• Processing orders and fulfilling purchases
• Customer service and support
• Marketing communications (with your consent)
• Website improvement and analytics
• Security and fraud prevention

3. Cannabis-Specific Privacy

As a cannabis dispensary, we take extra precautions to protect your information:

• Purchase records are encrypted and stored securely
• We never share cannabis purchase history for marketing purposes
• Medical marijuana patient data has enhanced protections
• We comply with NJ Cannabis Regulatory Commission requirements

4. Data Sharing

We may share your information with:

• Regulatory agencies (as required by law)
• Service providers (payment processors, e-commerce platforms)
• Law enforcement (when legally required)

We do not sell your personal information to third parties.

5. Your Rights

You have the right to:

• Access your personal information
• Request correction of inaccurate data
• Request deletion (subject to legal requirements)
• Opt-out of marketing communications
• Data portability

6. Data Security

We implement industry-standard security measures including SSL/TLS encryption, access controls, physical security, and regular audits. However, no method of transmission over the internet is 100% secure.

7. Data Retention Schedule

We retain your personal information only as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Purchase Records: 7 years from date of purchase (required by NJ Cannabis Regulatory Commission and state tax law)
• Account Information: Duration of active account plus 2 years after account closure or last activity
• Marketing Data: Until you opt-out or after 3 years of inactivity, whichever comes first
• Analytics Data: 26 months (Google Analytics default retention period)
• Age Verification Records: Session-based only; not permanently stored beyond regulatory compliance requirements

After the retention period expires, we securely delete or anonymize your personal information in accordance with our data protection procedures.

8. Third-Party Services

To operate our website and business, we use the following third-party service providers who may process your personal information on our behalf:

We have Data Processing Agreements (DPAs) in place with service providers where required by GDPR and other applicable data protection laws. These agreements ensure that third parties process your data only for specified purposes and maintain appropriate security measures.

9. California Consumer Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose:
  • Categories of personal information we have collected about you
  • Specific pieces of personal information we have collected about you
  • Categories of sources from which we collect personal information
  • Business or commercial purposes for collecting or selling personal information
  • Categories of third parties with whom we share personal information
• Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions such as:
  • Cannabis purchase records required to be retained for 7 years under NJ law
  • Information necessary to complete transactions or provide requested services
  • Information required to comply with legal obligations
  • Information necessary for security and fraud prevention
• Right to Opt-Out of Sale: We do not sell your personal information to third parties for monetary or other valuable consideration.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights, including by:
  • Denying goods or services
  • Charging different prices or rates
  • Providing a different level or quality of service

10. GDPR Lawful Basis for Processing (European Visitors)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal information under the following lawful bases as required by the General Data Protection Regulation (GDPR):

• Legitimate Interest: We process your information to operate our licensed cannabis business, including:
  • Providing you with information about our products and services
  • Improving our website functionality and user experience
  • Fraud prevention and security measures
• Legal Obligation: We process certain information to comply with laws and regulations, including:
  • Age verification requirements for cannabis products
  • 7-year record retention mandated by New Jersey Cannabis Regulatory Commission
  • Tax reporting and financial record-keeping requirements
  • Regulatory compliance and licensing requirements
• Consent: For analytics cookies and marketing communications, we obtain your explicit consent, which you may withdraw at any time through:
  • Cookie consent banner settings on our website
  • Unsubscribe links in marketing emails
  • Contacting us at privacy@thelibrarynj.com
• Contract Performance: When you create an account or place an order, we process your information to fulfill our contractual obligations to you.

Under GDPR, you have additional rights including the right to object to processing, right to data portability, and the right to lodge a complaint with your local supervisory authority. To exercise these rights, please contact us using the information provided below.

11. Contact Us