Privacy Policy

Cape Cannabis NPC ("Cape Cannabis", "we", "us", or "our") is committed to protecting your privacy and ensuring that your personal information is handled in accordance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Cape Cannabis app and related services (collectively, the "App"). By using the App, you consent to the practices described in this Privacy Policy.

If you do not agree with this Privacy Policy, please do not use the App. We may update this Privacy Policy from time to time, and we will notify you of any changes by posting the new version on the App. Your continued use of the App after such changes constitutes your acceptance of the updated policy.

1. Information Officer

In compliance with POPIA, Cape Cannabis NPC has appointed an Information Officer responsible for overseeing our data protection compliance. The Information Officer can be contacted at:

• Email: hello@capecannabis.org
• Address: Cape Town, South Africa, 8001

You may direct any privacy-related queries, complaints, or requests to the Information Officer.

2. What is Personal Information?

Under POPIA, "personal information" means information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person. This includes, but is not limited to:

• Information necessary to identify you (e.g., name, email address, phone number, ID number).
• Information relating to race, gender, sex, pregnancy, marital status, national or ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language, and birth.
• Information relating to your education, medical, financial, criminal, or employment history.
• Your opinions, beliefs, or views; correspondence sent by you that is implicitly or explicitly of a private or confidential nature; and your name if it appears with other personal information relating to you or your views or opinions.

We only collect personal information that is relevant and necessary for the purposes outlined in this policy.

3. How We Collect Personal Information

We collect personal information in the following ways:

• Directly from you: When you register an account, provide details during the registration process, upload content, post updates, interact with other users, or contact our support team. This may include your name, email address, phone number, age, location, profile picture, and any content you share (e.g., text, images, videos).
• Automatically: Through cookies, device identifiers, IP addresses, browser type, usage data, and analytics tools when you use the App. This helps us improve functionality and user experience.
• From third parties: Such as social media platforms if you link your account, or service providers (e.g., payment processors) with your consent.

We will always inform you of the purpose of collection at the time of gathering your information and obtain your consent where required.

4. How We Use Personal Information

We process your personal information lawfully, fairly, and transparently, in line with POPIA's eight conditions for lawful processing (accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation). Specifically, we use your information to:

• Provide and maintain the App's services, including user profiles, social interactions, and content sharing.
• Process registrations, verify identities, and manage your account.
• Communicate with you (e.g., notifications, support responses).
• Analyze usage patterns to improve the App (anonymized where possible).
• Comply with legal obligations, prevent fraud, or enforce our Terms and Conditions.
• Send marketing communications, but only with your explicit, informed consent, which you can withdraw at any time.

We will not use your information for any purpose incompatible with the one for which it was collected, unless we obtain your further consent or it is permitted by law.

5. Legal Basis for Processing

Under POPIA, processing is lawful if:

• You have consented to it (e.g., explicit opt-in for marketing).
• It is necessary to fulfill a contract with you (e.g., providing App services).
• It is required to comply with a legal obligation.
• It protects your legitimate interests or those of a third party (e.g., security measures), provided it does not override your rights.

Where consent is the basis, it must be voluntary, specific, informed, and unambiguous. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

6. Sharing Personal Information

We do not sell your personal information. We may share it with:

• Service providers: Third parties who assist us (e.g., cloud hosting, analytics tools, payment gateways) under strict confidentiality agreements that require them to comply with POPIA.
• Legal authorities: If required by law, court order, or to protect rights, property, or safety.
• Business transfers: In the event of a merger, acquisition, or sale of assets.

All sharing is limited to what is necessary and done securely.

7. International Transfers

Cape Cannabis NPC is based in South Africa, and your information is primarily processed here. If we transfer personal information outside South Africa (e.g., to cloud servers), we ensure the recipient country has adequate data protection laws (e.g., EU countries) or we implement appropriate safeguards, such as binding corporate rules or standard contractual clauses, as required by POPIA Section 72.

8. Your Rights as a Data Subject

POPIA grants you the following rights regarding your personal information. You may exercise these by contacting our Information Officer:

• Access: Request confirmation of whether we hold your information and access to it (subject to fees for copies).
• Correction: Request correction or deletion of inaccurate or incomplete information.
• Deletion ("Right to be Forgotten"): Request deletion if it is no longer needed or you withdraw consent.
• Objection: Object to processing based on legitimate interests, direct marketing, or for statistical purposes.
• Restriction: Request restriction of processing while we verify disputes.
• Data Portability: Receive your information in a structured, commonly used format.
• Lodge a Complaint: With the Information Regulator if you believe we have violated POPIA.

We will respond to requests within a reasonable time (typically 30 days) and free of charge, unless the request is manifestly unfounded or excessive.

9. Security of Your Personal Information

We implement appropriate, reasonable technical and organizational measures to protect your information against loss, unauthorized access, alteration, or destruction, as required by POPIA Condition 7. This includes encryption, access controls, firewalls, and regular security audits. Despite these measures, no system is completely secure, and we cannot guarantee absolute security.

In the event of a security compromise that may result in significant harm, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in line with POPIA Section 22.

10. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law (e.g., tax or audit records). Once no longer needed, we securely delete or anonymize it. Retention periods vary by data type (e.g., account data until deletion request).

11. Cookies and Tracking Technologies

The App uses cookies and similar technologies to enhance functionality, analyze usage, and personalize content. These may collect personal information. You can manage preferences via your browser settings, but disabling them may limit App features. We use a cookie consent banner to obtain your explicit consent before deployment, as required for compliance.

12. Children's Privacy

The App is not intended for individuals under 18 years of age without parental/guardian consent. We do not knowingly collect personal information from children. If we become aware of such collection, we will delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will post the revised version on the App with the updated effective date. Significant changes will be notified via email or in-app notification.

14. Governing Law

This Privacy Policy is governed by the laws of the Republic of South Africa, including POPIA. Any disputes will be subject to the non-exclusive jurisdiction of the South African courts.

15. Contact Us

For questions about this Privacy Policy or our data practices, please contact our Information Officer at the details provided in Section 1.

Thank you for trusting Cape Cannabis with your information. We are dedicated to safeguarding your privacy.