Privacy Policy

We collect information that you provide directly, including:

• Account details — name, email address, phone number and password.
• Order details — delivery address, order history and payment reference (we do not store full card numbers).
• Communications — messages you send via our contact form, chat widget or customer support.
• Where applicable, medical practitioner recommendation details required for regulated purchases.

We also automatically collect limited technical information — such as device type, browser and approximate location — via cookies and similar technologies, to keep the site secure and improve performance.

• To process and fulfil your orders, including delivery and support.
• To verify age and, where required, medical eligibility to purchase.
• To manage your account, rewards balance and order history.
• To send order updates and, with your consent, marketing communications.
• To detect fraud, secure our systems and comply with legal obligations.

We process your personal information where it is necessary to perform our contract with you (e.g. fulfilling an order), to comply with a legal obligation (e.g. regulatory record-keeping for cannabis sales), on the basis of your consent (e.g. marketing emails), or where we have a legitimate interest that is not overridden by your rights (e.g. fraud prevention).

We do not sell your personal information. We may share it with:

• Delivery and logistics partners, to fulfil your order.
• Payment processors, to complete transactions securely.
• Regulatory bodies, where required by South African cannabis and health legislation.
• Service providers who support our platform (e.g. hosting, analytics) under confidentiality obligations.

We retain personal information for as long as necessary to fulfil the purposes outlined in this policy, including applicable statutory retention periods for regulated cannabis sales records, after which it is securely deleted or anonymised.

We apply reasonable technical and organisational measures — including encryption in transit, access controls and regular security reviews — to protect your information against unauthorised access, loss or misuse.

Under POPIA, you have the right to:

• Access the personal information we hold about you.
• Request correction or deletion of inaccurate or outdated information.
• Object to processing for direct marketing purposes.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact our Information Officer at hello@cannaplug.co.za.

We use essential cookies to keep the site functional (including remembering items in your cart) and, with your consent, analytics cookies to understand site usage. You can control cookies through your browser settings at any time.

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be communicated via the site or by email where appropriate.