Vendor Privacy Risk Review
Most cannabis operators have no idea what their POS system, loyalty platform, or delivery app does with customer data once it leaves their control. This service maps every vendor with access to personal data and tells you exactly where your exposure sits.
It's particularly important for operators using platforms like Dutchie, Treez, Flowhub, Leafly, or Weedmaps each of which has its own data-sharing practices that may create CCPA obligations you're unaware of.
What the assessment covers
-
Full inventory of all vendors and platforms accessing personal or operational data
-
Review of existing data processing agreements (DPAs) — or absence thereof
-
Data-sharing analysis: what each platform collects, retains, and shares downstream
-
CCPA 'sale or sharing' trigger assessment for loyalty, analytics, and marketing tools
-
Metrc-integrated software access review
-
Risk rating for every vendor relationship
What you receive
-
Vendor risk register with ratings for every platform
-
DPA gap report: which vendors need agreements, and what those agreements should include
-
Recommended next steps per vendor
-
20-minute debrief call