Privacy Policy

1. Who is responsible for your information

Bobo's Cana Cartel ("we", "us") is the responsible party for the personal information described in this policy. Our shop is at Shop Nr 3, Voortrekker Street, Grabouw, between ABSA and Onse Winkel, Western Cape. You can reach our information officer at [email protected].

2. What we collect

• First name and surname
• Cell phone number
• South African ID number (only to check that you are 18 or older - we are legally not allowed to sell to minors)
• Passport number and country of issue, if you are a foreign national and you show us a passport instead of an ID number
• Date of birth - taken from your ID number, or typed in by our staff when you gave us a passport
• E-mail address and notes, only if you give them to us
• Your POPIA consent, and the date and time you gave it

We do not collect bank card details in this system and we do not use cookies for advertising.

3. Why we collect it

• To keep a customer record for the shop and to stay in contact about products and promotions
• To confirm that customers are 18 or older before any age-restricted sale
• To prevent duplicate records and to answer your questions about your record

We process this information on the basis of your consent, and - for the age check - because the law requires us to verify age before selling age-restricted products.

4. How we protect it

• ID numbers are encrypted at rest with AES-256-GCM. Staff only ever see a masked version (for example 900101*****08).
• Passport numbers get exactly the same treatment: encrypted at rest, and shown masked (for example AB*****89).
• Duplicate checks and document searches use a salted SHA-256 hash, not the plain ID or passport number.
• The customer system is behind a staff login. Passwords are stored as bcrypt hashes.
• Every view, change, deletion or ID reveal is written to an audit log with the staff member's name and a timestamp.
• Traffic to the site is encrypted with HTTPS.

5. How long we keep it

We keep customer records while you are a customer of the shop and for as long afterwards as we need them for our records and for the law. If you ask us to delete your information we will do so, unless we are required to keep it (for example for a legal claim or a regulatory record).

6. Who we share it with

We do not sell your personal information and we do not share it for advertising. We use a small number of service providers to run the shop's systems (a hosting provider and a database provider). Where a provider stores data outside South Africa, we rely on section 72 of POPIA and the provider's contractual safeguards. We may also disclose information where the law requires it.

7. Your rights

You may ask us to:

• confirm what personal information we hold about you, and give you a copy of it
• correct or update information that is wrong
• delete information we no longer need, or withdraw your consent
• object to the way we use your information

Send any request to [email protected]. We will answer within a reasonable time, and we may ask you to prove your identity first.

If you are unhappy with how we handled your information you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

8. Cookies

We use two cookies, and nothing else:

• an age-gate cookie that remembers that you confirmed you are 18 or older (it lasts about a year)
• a staff session cookie, which only exists after a staff member logs in

9. Changes to this policy

We will update this page if our practice changes, and we will show the new date at the top of the page. This policy is written in plain language on purpose - please ask us if anything is unclear.