Effective Date: September 1, 2025
Frostbite Cannabis, Inc. (“Frostbite,” “Company,” “we,” or “our”) recognizes the importance of safeguarding the confidentiality, integrity, and availability of personal information collected in the course of its business operations. This Privacy Policy is adopted pursuant to the Minnesota Consumer Data Privacy Act (“MCDPA”), Minn. Stat. ch. 325O, and in conformity with all applicable laws and regulations governing the collection, use, retention, and disclosure of personal data in connection with licensed cannabis retail operations in the State of Minnesota.
1. Categories of Personal Data Collected
Frostbite shall collect, process, and retain only the minimum categories of personal data reasonably necessary to fulfill lawful business and regulatory purposes, including but not limited to:
Identifying information: full legal name, as verified against a government-issued identification document at the time of order fulfillment.
Date of birth: for the sole purpose of verifying that the consumer has attained the minimum lawful age of twenty-one (21) years.
Contact information: telephone number and/or email address, for the limited purpose of providing order confirmations and operational communications.
Transactional information: product orders, purchase details, and records required to demonstrate compliance with Minnesota cannabis statutes and rules.
No additional personal data shall be collected absent a lawful basis and necessity. Frostbite does not sell, rent, or otherwise transfer personal data to unaffiliated third parties for monetary or other valuable consideration.
2. Permissible Uses of Personal Data
Personal data shall be used solely for the following purposes:
a. Verification of age and eligibility to lawfully purchase cannabis products under Minnesota law.
b. Processing and fulfillment of orders placed via Frostbite’s electronic commerce platforms.
c. Compliance with statutory and regulatory obligations imposed by the Office of Cannabis Management (“OCM”) or other competent authorities.
d. Provision of order-related communications to the consumer.
e. Internal recordkeeping consistent with state law and generally accepted business practices.
Personal data shall not be used for marketing, promotional, or advertising purposes absent the consumer’s informed, written, and revocable opt-in consent.
3. Data Retention and Disposal
Personal data shall be retained only for so long as is reasonably necessary to accomplish the purposes identified herein and to satisfy applicable statutory or regulatory recordkeeping obligations. Upon expiration of such retention period, data shall be securely destroyed, deleted, or anonymized in accordance with industry best practices and Minn. Admin. R. ch. 9810.
4. Data Security and Safeguards
Frostbite shall maintain administrative, technical, and physical safeguards designed to ensure the confidentiality, integrity, and security of personal data. Specifically:
All consumer data is maintained within Blaze POS and Blaze eCommerce, third-party platforms contractually obligated to employ encryption, secure servers, and access controls consistent with industry standards.
Access to personal data within Frostbite is restricted to duly authorized employees utilizing unique login credentials and role-based permissions, ensuring access only to the minimum data required to fulfill assigned responsibilities.
Audit logs and monitoring shall be maintained to detect and deter unauthorized access.
5. Consumer Rights Under Minnesota Law
Pursuant to the MCDPA, consumers domiciled in Minnesota shall have the following rights, exercisable upon written request to Frostbite:
Right of Access: to obtain confirmation whether personal data concerning the consumer is being processed and to receive a copy thereof.
Right of Rectification: to require correction of inaccurate or incomplete personal data.
Right of Deletion: to request deletion of personal data, subject to legal and regulatory retention obligations.
Right of Data Portability: to receive personal data in a structured, commonly used, and machine-readable format.
Right to Opt Out: to decline the processing of personal data for marketing or targeted advertising purposes.
Frostbite shall respond to verified consumer requests within the time periods prescribed by Minn. Stat. § 325O.07.
6. Third-Party Processors
Frostbite contracts with Blaze Solutions, Inc. (“Blaze”) for point-of-sale and eCommerce services. Blaze is bound by written agreement to process personal data solely on behalf of Frostbite, to implement reasonable security measures, and to return or securely destroy personal data at Frostbite’s direction or upon termination of the services agreement. Frostbite does not authorize Blaze to disclose, sell, or otherwise use personal data for independent purposes.
7. Legal Disclosures
Frostbite may disclose personal data when compelled to do so by applicable law, regulation, subpoena, administrative order, or directive of the Minnesota Office of Cannabis Management or other governmental authority of competent jurisdiction.
8. Modifications to Policy
Frostbite reserves the right to amend or update this Privacy Policy at any time to ensure ongoing compliance with applicable law. Material revisions shall be posted conspicuously on Frostbite’s website with an updated effective date. Continued use of Frostbite’s services after the effective date shall constitute acknowledgment of such revisions.
9. Contact Information
Questions, concerns, or consumer rights requests pertaining to this Privacy Policy may be directed to:
Frostbite Cannabis, Inc.
2218 County Road D West, Suite 200
Roseville, MN 55112
Telephone: 612-440-9991
Email: info@frostbitecannabis.com