Privacy policy
Last updated: June 2026 · This policy explains how Kushr processes personal information in terms of the Protection of Personal Information Act, 4 of 2013 (POPIA).
Who we are
Kushr ("we") operates a directory of private members' cannabis clubs in South Africa. We are the responsible party for the personal information processed on this platform. Each club you join is a separate responsible party for the member records it holds about you.
What we collect and why
We collect your name, email address, phone number, date of birth and South African ID number when you create an account. Your ID number is used solely to verify that you are 18 or older and to identify you on club membership letters, as private clubs are required to keep accurate member records. It is stored encrypted (AES-256-GCM) and is never displayed in full. We also collect delivery addresses, your drawn signature (which appears on your membership letters), your club membership applications and order history, and technical logs (such as IP addresses in our audit trail) kept for security and compliance.
Consent and lawful basis
We process your information on the basis of the explicit consent you give at signup, the performance of your membership agreements with clubs, and our legitimate interest in operating a safe, age-gated platform. You may withdraw consent at any time by deleting your account.
Sharing
When you apply to join a club, we share your application details (name, ID number, date of birth, address and signature) with that specific club only. We never sell personal information, and we never enrol you in a club you did not yourself apply to. Service providers that process data on our behalf (hosting, email delivery) are bound by operator agreements.
Your rights
You may access, correct, export or delete your personal information. Use "Download my data" and "Delete my account" in Account → Privacy & data. Deleted accounts are disabled immediately and permanently purged within 30 days. You may also lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.
Retention and security
We keep membership and order records only as long as needed for the club-membership relationship and legal compliance, after which they are deleted. Sensitive fields are encrypted at rest, access is controlled with row-level security, and administrative actions are recorded in an append-only audit log.
Contact
Information officer: privacy@kushr.example — please contact us before approaching the Information Regulator so we can try to resolve your concern first.