Your privacy choices

Last updated: October 23, 2025

Who we are

We’re Curaleaf, Inc. (collectively, “Curaleaf”, “Company” or “us” or “we” or “our”), a leading cannabis company operating dispensaries and related services across multiple US states including Florida, Arizona, Illinois, Maryland, Massachusetts, Nevada, New York, New Jersey.

This privacy policy (“Privacy Policy”) describes how we collect, disclose, and use your personal information when using our website florida.thehempcompany.com or any subdomains of curaleaf.com (collectively, the “Site”), use our mobile applications, shop at our dispensaries, join our loyalty program, or use related services (collectively, the “Products” and/or “Services”).

We may update this Privacy Policy over time. Any changes will be reflected by updating the date at the top of this Privacy Policy. The Company reserves the right in its sole discretion to amend this Privacy Policy at any time, and you should check this Privacy Policy periodically for any amendments.

This Privacy Policy applies only to our United States operations. For information about Curaleaf operations outside of the United States, including within the European Union, United Kingdom, Canada, or Switzerland, please refer to the Curaleaf International Privacy Notice at: www.curaleafinternational.com/privacy.

Section 1 – Personal Information We Collect:

Information You Give Us. When you contact us, register to receive alerts or other information via email, text, or instant message, or purchase something from our Site, as part of the buying and selling process, we collect the personal information you give us such as your name, postal address, phone number, email address; government-issued identification information, including driver's license or state ID details for age verification; medical marijuana card information and patient identification numbers where applicable; loyalty program enrollment and membership information; delivery instructions and preferences for our delivery services; payment information, such as your credit or debit card number and other card information, billing and other account authentication information; Products purchased, as well as any other information that you directly give us.

Information Automatically Collected. When you visit our Site, we automatically collect certain information through cookies and similar technologies, including:

Your IP address (which may indicate your general location)
Device and browser information (operating system, browser type and language)
How you interact with our Site (pages visited, time spent, referring website)
Your preferences and settings

Cookies are small data files stored on your device that help us remember your preferences, understand how you use our Site, and improve your experience. We and our trusted third-party service providers use cookies to analyze site traffic and enhance our Services.

For more details about the cookies we use and how to manage your preferences, please see our Cookie Policy.

Information Related to Cannabis Purchases. When you make purchases at our dispensaries or online, we collect information required by state cannabis regulations, including verification of your age and eligibility to purchase adult-use or medical cannabis products, transaction details required for state tracking systems, and distinction between adult-use and medical purchases.

Section 2 – How We use Personal Information:

We use the information we collect primarily to provide, maintain, protect and improve our current Site, Products and Services, and to develop new products. We use personal information collected through our Site and/or when providing you with our Products and Services as described in this Policy to:

Create and secure your account and identify you as a user in our system;
Improve our Products, Site, Services and business;
Understand and enhance your experience with us;
Facilitate your order and deliver the Products you request;
Verify your age and eligibility to purchase cannabis products in compliance with state laws;
Validate medical marijuana patient status and ensure appropriate product access;
Manage and administer loyalty program benefits and rewards;
Comply with state cannabis tracking and reporting requirements;
Process wholesale orders for our B2B customers;
Maintain separate records for adult-use versus medical cannabis purchases as required by law;
Respond to your comments or questions and provide Products and Services;
Send you information, including confirmations, invoices, updates, support and other messages;
Communicate with you about promotions, upcoming events and news about Products and Services, and for other marketing purposes;
Link or combine your information with other information we get from third parties to help understand your needs and provide you with better service;
Protect, investigate and deter against fraudulent, unauthorized or illegal activity;
Transfer your information to new owners if our Company is acquired or merged so that we may continue to sell Products and provide Services to you; and
For any additional purposes for which we have obtained your consent to the use or disclosure of your personal information.

Legal Basis for Processing:

We collect and use your personal information as reasonably necessary to provide our Products and Services, comply with legal obligations (including cannabis regulations), protect our business interests, and communicate with you. Certain uses, such as data sharing with partners, or the collection of sensitive health-related information, are based on your consent or as otherwise required or permitted by law.

Consent & Choice:

We collect and use your personal information only when there is a clear legal reason to do so. In most cases, this is necessary to fulfill your request, to complete a transaction, or comply with applicable law. Where you have provided consent, you may change or withdraw your consent at any time by following the instructions provided in this Privacy Policy or by contacting us at privacy@curaleaf.com. Please note that in some circumstances, withdrawing your consent may limit our ability to provide certain Services, but it will not impact the lawfulness of processing conducted prior to your withdrawal.

If you opt-out of marketing communications, we may still send you non-marketing messages.

By providing your email address, you are giving us permission to send you updates, offers, or news about our Products and Services, consistent with applicable law. You may unsubscribe at any time by clicking the “Unsubscribe” link at the bottom of each email.

How do I withdraw my consent?

If you change your mind after you opt-in, you may withdraw your consent for us to contact you, for the continued collection, use or disclosure of your information, at any time, by contacting us at legal@curaleaf.com, clicking the “Unsubscribe” button at the bottom of each email, or mailing your request to:

Curaleaf, Inc.

290 Harbor Drive

Stamford, CT 06902

How Long We Keep Your Information

Generally, we retain information in accordance with our document retention policy and the applicable legal requirements. We retain your personal information only for as long as necessary to provide our services and meet legal requirements. Cannabis purchase records are retained as required by state law (typically 2-7 years depending on your state). Marketing and account information is retained until you request deletion or close your account, plus any additional period required by law.

Section 3 – Disclosure of Personal Information:

Because we operate in multiple U.S. States, your information may be used and stored in a different state from where it was collected. While we do not sell your personal information, we may share it with our partners and third parties to support our own operational purposes in providing Services to you, as described in our Privacy Policy, and when required to comply with laws, court orders, subpoenas, or other legal process. These operational and other sharing purposes are described below.

Third-Party Services

We share personal information only with service providers and contractors who perform services on our behalf. They are contractually obligated to use the information provided solely for our purposes, maintain confidentiality, and implement safeguards consistent with applicable privacy and security laws. We do not sell personal information.

Some of our third parties may include payment gateways and other payment transaction processors, software or other IT providers, and various vendors, contractors and consultants engaged by us to provide services.

Some parts of our website may link to other companies that help us process payments or provide services. When you leave the Curaleaf site, you’ll be notified and will be subject to that company’s own privacy policy and terms. We encourage you to review their policies to understand how they handle your information.

Cookies and Similar Technologies

Our Site uses cookies and similar technologies. We’ve described the cookies we collect and why we use them within our Cookie Policy available on this Site. Please refer to this for more information.

Other Sharing

We may also share your personal information as follows:

We may share personal information if you opt-in to receiving our marketing materials. For example, you may let us share personal information with our partners and others for their own marketing uses. Those uses will be subject to their privacy policies.
We may share your information with vendors, service providers, contractors and agents in connection with the performance of Services on our behalf. These service providers are prohibited from using your information except as needed to perform our work or as required by law.
We may share personal information when we do a business deal, or negotiate a business deal, involving the sale or transfer of all or a part of our business or assets. - These deals can include any merger, financing, acquisition, or bankruptcy transaction or proceeding.
We may share personal information for legal, protection, and safety purposes.
We may share information to comply with laws or as permitted by laws, including (but not limited to) state cannabis regulations that require us to report transaction data to state tracking systems and regulatory agencies.
We may share information with other companies and brands owned or controlled by Curaleaf, Inc., including our subsidiaries.
We may share information to protect the rights and property of the Company, our agents, customers, and others. This includes enforcing our agreements, policies, and terms of use.
We may share information in an emergency. This includes protecting the safety of our employees and agents, our customers, or any person.

Section 4 – How We Secure Your Information:

We take the security of your personal information seriously and use reasonable electronic, personnel and physical measures to protect it from loss, theft, alteration or misuse. While no system is completely secure, we follow generally accepted security standards and respond promptly to potential incidents.

Wherever we or a trusted third-party service collects sensitive information (such as credit card data), that information is encrypted and transmitted in a secure way. You can verify this by looking for a closed lock icon at the bottom of your web browser or looking for “https” at the beginning of the address of the web page. When you make a purchase at our store with a credit card, the information is encrypted using transport layer security technology (TLS) and stored with AES-256 encryption. We follow all PCI-DSS requirements and implement additional generally accepted industry standards.

Section 5 – Your Privacy Rights:

We operate across multiple states, and comply with applicable state privacy laws. Several states where we operate have enacted comprehensive privacy laws granting residents specific rights regarding their personal information. For example, California residents, under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), have specific rights regarding their personal information.

Depending on your state of residence and where we operate, you may also have similar rights under that state’s privacy laws. In addition, medical marijuana patients may have extra privacy protections under state medical cannabis laws and certain health privacy regulations.

These rights may include:

Right to Know: You can request that we disclose the categories and specific pieces of personal information we have collected, used, disclosed, sold, or shared in the past 12 months, the sources of that information, the business or commercial purposes for its collection, and the categories of third parties with whom it was shared.
Right to Delete: You can ask us to delete personal information we collected and retained, subject to legal exceptions.
Right to Correct: You can request that we correct inaccurate personal information.
Right to Opt Out: You can opt out of the sale or sharing of your personal information for targeted or cross-context behavioral advertising.
Right to Limit Use of Sensitive Information: You can request that we limit the use and disclosure of your sensitive personal information.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

EXERCISING YOUR RIGHTS

To submit a request to review, verify, or correct your personal information, email us at legal@curaleaf.com or mail your request to:

Curaleaf, Inc., 290 Harbor Drive, Stamford, CT 06902.

Only you, or a person legally authorized to act on your behalf (an “Authorized Agent”), may make a verifiable consumer request related to your personal information. You have the right to request this information up to two times in a 12-month period. Before completing your request, we may need to verify your identity or authority to ensure the security of your personal information.

AUTHORIZED AGENTS

If you use an Authorized Agent to submit a request to know or a request to delete, we may require the Authorized Agent to submit proof that they have been authorized to act on your behalf. We may accept as proof either:

Written permission from you; or
A power of attorney. We may also require the Authorized Agent to verify their identity directly with us.

ACCESSIBILITY

We recognize the need to develop electronic and information technology (E&IT) products and services that are accessible and usable by all people, including those with disabilities and special needs. We provide technical and customer support to accommodate the needs of users with disabilities and address issues related to the accessibility of our Products.

Our services include:

General Customer Support: (781) 451-0150. Available Monday-Friday from 8:30 a.m. to 5pm EST, excluding holidays
Privacy Policy: (781) 451-0150. Available Monday-Friday from 8:30 a.m. to 5pm EST, excluding holidays

NON-DISCRIMINATION

We will not discriminate against you for exercising any of your rights under the applicable laws including state privacy laws such as the CCPA. To meet this requirement, we will not:

Deny you Products or Services.
Charge you different prices or rates for Products or Services, including through the use of discounts or other benefits or imposing penalties.
Provide you with a different level or quality of Products or Services.
Suggest that you will receive a different price or rate for Products or Services or a different level or quality of Products or Services.

Section 6 - Questions and Contact Information:

If you any questions about this Privacy Policy or simply want more information, please contact:

legal@curaleaf.com; or

Curaleaf, Inc.
290 Harbor Drive
Stamford, CT 06902

Phone: (781) 451-0150