PRIVACY & POPIA NOTICE

1. Responsible parties and separation of roles

1.1Rolling Stoner Travel and Tours (Pty) Ltd (Reg. 2025/700740/07) is the primary responsible party for personal information processed to operate route-420.com, Route 420 accounts, business listings, paid listing subscriptions, itinerary-download tools and Smoke Signals, except where another notice expressly identifies a different responsible party.

1.2Rolling Stoner (Pty) Ltd (Reg. 2024/450808/07) is the responsible party for personal information collected directly through rollingstoner.co.za for Rolling Stoner media, the Authenticated programme, magazine/newsletter interactions and the Route 420 Travel Club form hosted on the Rolling Stoner website, unless the form expressly states otherwise.

1.3The two companies are separate responsible parties for their own purposes. Information may be shared between them where necessary to deliver a requested Route 420/Travel Club service, administer a cross-brand benefit, meet a legal obligation, or where the user has been given appropriate notice or consent. Internal group access is not unrestricted.

2. Information we may collect

3. Information we should not routinely collect

3.1Route 420 is designed for adults, and we do not knowingly collect personal information from children for membership or interactive posting.

3.2We should not routinely ask users to provide ID documents, precise live location, cannabis-purchase history, cannabis-consumption preferences, medical diagnoses, prescriptions or other special/sensitive information unless there is a clearly documented lawful need, appropriate notice and adequate safeguards.

3.3If a user voluntarily includes health, criminal, biometric or other special personal information in content, Route 420 may reject, redact or remove it to protect the data subject and reduce unnecessary processing.

4. Why we process personal information

• Create, verify, secure and administer user accounts.
• Process business-listing applications, subscriptions, payments and renewals.
• Publish and manage business information and user-authorised public profile content.
• Receive, moderate, publish and socially share approved Smoke Signals in accordance with the Smoke Signals Terms.
• Provide maps, route tools, itinerary functions, downloads and requested member benefits.
• Communicate service notices, security notices, payment status, moderation decisions and support responses.
• Prevent fraud, impersonation, unlawful activity, abuse, security incidents and platform manipulation.
• Handle complaints, corrections, takedowns, disputes and regulatory requests.
• Measure platform performance and improve services using proportionate analytics.
• Send optional direct marketing where lawful and where the required consent or customer-relationship basis exists.

5. Public information and user-generated content

5.1A business listing and an approved Smoke Signal are intended for public display to the extent described before submission. Do not submit confidential information or another person's personal information unless you have a lawful basis and the right to make it public.

5.2Public content may be indexed by search engines, screenshotted, copied or reshared by third parties. Route 420 can control its own future use but cannot guarantee removal from independent third-party copies or archives.

5.3Exact locations may be reduced, delayed or hidden where publication could expose a private home, private cultivation/production site, vulnerable person, wildlife, sacred site, security-sensitive premises or fragile environment.

6. Smoke Signals social-media sharing

6.1When a member submits a Smoke Signal and accepts the Smoke Signals Terms, RSTT may share the approved content with Rolling Stoner (Pty) Ltd and approved service providers for publication across Route 420 and Rolling Stoner websites, newsletters, magazine/editorial channels and social-media channels within the licence described in the Smoke Signals Terms.

6.2The user should be told clearly before submission that approved content may be republished publicly and that ordinary submissions do not create a right to payment or royalties.

6.3Where practical, the user may be credited using the display name or username supplied for public credit. Route 420 may omit attribution where required by format, privacy, safety or editorial context.

7. Sharing with operators and third parties

7.1We may use vetted operators/service providers for hosting, cloud storage, security, email, CRM, analytics, map services, payment processing, media publishing, technical support and professional advice. They may process information only for authorised purposes and must be subject to appropriate confidentiality/security arrangements where required.

7.2Payment data is processed by the payment provider under its own security and privacy framework. RSTT should not store full card details where the payment architecture does not require it.

7.3We may disclose information where required by law, court order, regulator request, fraud/safety investigation or to establish, exercise or defend legal rights.

7.4We do not sell personal information to advertisers. Partner offers or direct marketing using personal information must have a lawful basis and an opt-out mechanism.

8. Direct marketing and consent

8.1Optional marketing consent must be separate from acceptance of platform terms. An unticked checkbox is recommended for email, SMS, WhatsApp or similar promotional messages where consent is required.

8.2A person may withdraw marketing consent or opt out at any time. Service communications needed to administer an account or transaction may continue while the relevant service relationship exists.

8.3Route 420 and Rolling Stoner should maintain suppression/opt-out records so that a person who has objected is not repeatedly re-added to marketing lists without a new lawful basis.

9. Retention

9.1We retain personal information only for as long as reasonably necessary for the purpose collected, a legitimate operational or evidential need, or a legal/accounting requirement.

9.2After cancellation, non-public account/profile data may be retained for a short reactivation/support period, suggested as approximately 30 days, after which information no longer required should be securely deleted, destroyed or de-identified.

9.3Transaction records, consent records, complaints, security logs, contractual evidence and records required by law may be retained for longer. Published editorial material and already-published Smoke Signal compilations may also be retained where lawful, subject to valid rights and takedown requests.

10. Security

10.1We must use appropriate technical and organisational safeguards, including access controls, password protection, role-based administration, secure hosting, backups, logging and vendor controls appropriate to the risk.

10.2No system is completely secure. If a security compromise involving personal information creates notification duties, the responsible party will follow applicable POPIA and regulator requirements.

10.3Users must use strong passwords, keep credentials private and notify support promptly if they suspect account compromise.

11. Cross-border processing

11.1Some hosting, analytics, communications or cloud providers may process information outside South Africa. Where personal information is transferred across borders, the responsible party must use a lawful mechanism and appropriate protection consistent with POPIA section 72.

12. Your rights

• Ask whether we hold personal information about you and request access, subject to applicable procedures and lawful exceptions.
• Request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained information.
• Object to processing where POPIA permits objection.
• Withdraw consent where processing is based on consent, without affecting prior lawful processing.
• Opt out of direct marketing.
• Complain to the responsible party and, where appropriate, the Information Regulator.

13. Information Officer and PAIA

13.1Each private body must maintain the required POPIA/PAIA governance, including a registered Information Officer and an up-to-date PAIA manual where required. The contact details should be linked from the relevant website footer.

13.2The public Privacy Notice must identify the correct Information Officer / privacy contact for RSTT and for Rolling Stoner where their processing activities differ.

14. Cookies and analytics

14.1Route 420 may use essential cookies and similar technologies for login, security and functionality and may use analytics/marketing cookies where appropriate. The cookie interface should explain the categories used and obtain consent where legally required by the chosen technologies and data-processing model.

15. Changes and version control

15.1This Notice may be updated when data flows, service providers, law or features change. The effective date and version should be displayed. Material changes should be communicated in a reasonable manner.

16. Contact details

Route 420 · Rolling Stoner Travel and Tours (Pty) Ltd · Privacy & POPIA Notice