PRIVACY POLICY

Effective Date: February 2026

1. Introduction

Welcome to Galaxia Vertical. We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how Galaxia Vertical SA ("we," "us," or "our") collects, uses, discloses, and safeguards your information when you visit our website https://www.galaxiavertical.com/, including any other media form, media channel, mobile website, or mobile application related or connected thereto (collectively, the "Site").

We are a Portuguese-based service provider for the medical cannabis industry. We process your personal data in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable Portuguese laws.

2. Data Controller

The entity responsible for the processing of your personal data (Data Controller) is:

  • Legal Entity: Galaxia Vertical SA

  • Address: Quinta Verde, Rua das Fazendas 8-C, 2130-338 Benavente, Portugal

  • Email: info@galaxiavertical.com

  • Phone: +351 281 024 241

3. Personal Data We Collect

We may collect and process the following types of information about you:

  • Personal Identification Information: Name, email address, phone number, and job title when you voluntarily provide it to us via email or by contacting us directly (e.g., for B2B service inquiries).

  • Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, and platform.

  • Usage Data: Information about how you use our website, products, and services, including traffic data used for GMP compliance and security analysis.

  • Cookies: Data collected via cookies to ensure the security of our pharmaceutical portal and to analyze traffic.

4. How We Use Your Data

We use your personal data for the following purposes:

  • To Provide Services: To respond to your inquiries regarding our GMP Manufacturing, GDP Wholesaling, and other medical cannabis services.

  • Legal Compliance: To comply with regulatory obligations inherent to the medical cannabis industry (e.g., INFARMED regulations) and GMP/GDP standards.

  • Security: To maintain the security of our website and prevent fraud.

  • Analytics: To understand how users interact with our website to improve our B2B services (based on your consent via our Cookie Banner).

5. Legal Basis for Processing

Under the GDPR, we rely on the following legal bases to process your data:

  • Consent: When you have explicitly agreed to the use of non-essential cookies or marketing communications.

  • Contract: When processing is necessary for the performance of a contract or to take steps at your request before entering into a contract.

  • Legal Obligation: When we are required to comply with Portuguese and European laws regarding pharmaceutical and medical cannabis activities.

  • Legitimate Interests: For running our business, network security, and fraud prevention.

6. Cookies

Our website uses cookies to distinguish you from other users. This helps us to provide you with a good experience when you browse our website and allows us to improve our site.

  • Essential Cookies: Necessary for the operation of the website and secure user sessions. These are always active.

  • Non-Essential Cookies: Used to analyze traffic and improve our services. You can choose to Accept or Decline these via our cookie manager.

7. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

8. Sharing Your Data

We do not sell your personal data. We may share your data with:

  • Service Providers: IT and system administration service providers who process data on our behalf.

  • Regulatory Authorities: If required by law or to report safety/regulatory concerns mandated by the medical cannabis industry.

9. International Transfers

Your data is primarily processed within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the specific safeguards approved by the European Commission is implemented.

10. Your Data Protection Rights

Under the GDPR, you have the following rights:

  • Right to Access: You have the right to request copies of your personal data.

  • Right to Rectification: You have the right to request that we correct any information you believe is inaccurate.

  • Right to Erasure: You have the right to request that we erase your personal data, under certain conditions.

  • Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data.

  • Right to Object: You have the right to object to our processing of your personal data.

  • Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you.

To exercise any of these rights, please contact us at info@galaxiavertical.com.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

  • By Email: info@galaxiavertical.com

  • By Phone: +351 281 024 241

  • By Mail: Galaxia Vertical SA, Quinta Verde, Rua das Fazendas 8-C, 2130-338 Benavente, Portugal