Written by DROPS.ST.
For cannabis-shop teams and nicotine-vape businesses, information collected for a verification task should not drift into a marketing list simply because staff can access it. Before any proposed reuse, identify the original purpose, the new purpose, necessary information and actual authority for the change.
DROPS connects Customer Accounts with orders and items, giving staff useful context for shop work. That connection makes information handling easier to explain, but it does not turn an order record, contact detail or verification result into permission for another use.
This guide retains a French nicotine-vape context for the regulatory examples. Cannabis operations and other jurisdictions need their own product, privacy and communication review.
Identify the information actually held
Start with categories and sources, not customer values. Ask whether the business actually holds a verification result, a document copy, a provider reference or none of those. Do not infer a stored identity file from an age prompt or successful checkout.
Record why each category was obtained, who needs it for that task and which copies exist. Distinguish an approved verification purpose from an employee’s later idea for a campaign.
The CNIL’s purpose guidance connects collection and use to a defined objective, necessary information and retention. Use that principle to question a proposed second use rather than silently expanding the original file. CNIL purpose guidance.
Use a proposed-reuse record
This original aid is an owner-managed review record, not a native DROPS privacy engine.
| Review entry | What to establish | Decision needed |
|---|---|---|
| Original information | Category, actual source and existing copies | Confirm what is really held |
| Original purpose | Verification task and responsible owner | Preserve required use and evidence |
| Proposed second use | Exact marketing activity and intended audience | Avoid a vague “customer engagement” label |
| Necessary information | Fields the new activity would actually need | Challenge excessive copies |
| Recipient and access | Staff, partner or tool receiving it | Verify actual supported boundaries |
| Legal and channel basis | Applicable review, information and preferences | Hold unresolved authority |
| Retention and outcome | Separate treatment for each purpose and copy | Name the action owner and review point |
A documented proposal is not approval. Keep unresolved entries open with a named person instead of marking them complete because the information is available.
Review communication rules and product rules separately
CNIL’s June 2026 electronic-prospecting guidance distinguishes communications to individuals and professionals, with conditions and exceptions. It specifically warns that creating an online account alone does not establish the existing-customer exception it describes. Review the actual recipient, purpose, information and choice process. CNIL electronic-prospecting guidance.
Privacy or messaging review does not settle whether the proposed nicotine-vape communication itself is allowed. French DGCCRF guidance identifies separate restrictions on vaping-product advertising. Check the actual content, audience and channel with the responsible reviewer. DGCCRF vaping-product guidance.
Do not apply those French examples as Canadian cannabis rules or universal permission for a campaign.
For a sensitive service enquiry, identify the approved restricted receiver and original purpose before campaign use. Keep intake routing and proposed reuse decisions separate; shop access does not establish a clinical system or a legally sufficient marketing basis.
Hypothetical example: a verification result enters a proposed segment
A fictional business has an approved verification record for its original task. An employee proposes using a detail from that record to select a promotional audience.
The owner records the new purpose and asks what information it requires, which people or tools would receive it and what applicable basis and communication conditions support the proposal. Until those questions are resolved, the proposed transfer remains held.
The original required record is handled under its own approved treatment. Holding the campaign does not authorize deleting verification evidence. This example describes no actual DROPS identity store, segment feature or lawful campaign.
Check permissions and copies independently
Current DROPS catalogue-edit access includes customer-account edits and wallet adjustments. It is not a privacy-restricted marketing or verification role. Order actions have separate controls; neither fact proves field masking or isolated marketing lists.
Use the permissions checklist to review actual grants and the export-scope worksheet before creating another copy. Ask about actual transferred fields and recipient access; a hidden menu link is not a boundary.
If reuse is rejected or stopped, record the approved treatment of proposed copies and any existing copies separately. Do not assume automatic deletion or suppression across providers.
Keep connected shop records tied to explained purposes
Choose DROPS when Customer Accounts and order-item context should support coherent daily shop work. Pair that foundation with a deliberate review whenever another purpose is proposed.
Explore DROPS.ST and the shop demos. Bring a fictional information category and two purposes. Identify the necessary fields, responsible reviewers and actual boundaries before treating access as permission to reuse.