Privacy policy

1. About this policy

This policy applies when a person visits Root & Season, purchases access, creates an account or contacts us. Personal information is processed in accordance with the Protection of Personal Information Act 4 of 2013, commonly known as POPIA.

2. Responsible party

The responsible party determines how and why personal information is processed.

3. Information we collect

Account and purchase information

• Name, where provided
• Email address
• Paystack payment reference, amount, date and status
• Access status, login activity and refund information

Technical information

• IP address, browser, device and operating system
• Login times, website activity, security and error logs
• Cookie and session information

Support and marketing information

• Contact forms, emails, access enquiries and guide feedback
• Marketing preferences, records of consent and unsubscribe requests

Root & Season does not receive or store complete card numbers, CVV numbers, PINs or online banking credentials.

4. How information is collected

Information may be collected directly from a customer, during payment and login, through support communication, automatically through essential website technology or from providers involved in payments, authentication, hosting and security.

5. Why we use information

• Process and verify payments and refunds
• Create and manage customer access
• Send secure login and essential service messages
• Respond to enquiries and solve access problems
• Prevent fraud, account sharing and security incidents
• Maintain, secure and improve the website
• Keep transaction and accounting records
• Meet legal and regulatory obligations
• Send marketing where permitted

6. Lawful processing

Information is processed where necessary to enter into or perform a customer agreement, where consent has been given, where processing is required by law or where it protects a legitimate interest of the customer, Root & Season or a third party.

Consent may be withdrawn where processing depends on consent. Withdrawal does not affect processing that was lawful before withdrawal.

7. Payments and login

Paystack processes payments under its own terms and privacy policy. Root & Season receives only the information needed to verify transactions, grant access and maintain records.

Supabase is intended to provide passwordless login and access management. It may process email addresses, authentication records and related technical information on behalf of Root & Season.

8. Cookies

Essential cookies or local storage may be used to keep customers signed in, protect security, maintain website functions and remember necessary preferences. Blocking essential cookies may prevent parts of the website from working.

Optional analytics or marketing cookies will not be introduced without an appropriate notice and consent mechanism where required.

9. Sharing information

Information may be shared with Paystack, Supabase, Netlify, Xneelo, professional advisers and authorities where necessary to operate Root & Season or comply with law. Providers may process information only for the agreed purpose and must protect it appropriately.

Root & Season does not sell personal information.

10. International processing

Some providers may store or process information outside South Africa. Reasonable steps will be taken to ensure that international transfers are permitted under POPIA and appropriately protected.

11. Retention

Information is kept only as long as reasonably necessary to provide access, process payments and refunds, handle disputes, prevent misuse, maintain business records and meet legal obligations. Information no longer required will be deleted, destroyed or de-identified where reasonably practical.

Deleting the email address connected to a paid account may result in the termination of access because the address is needed to identify the purchase and account.

12. Security and incidents

Reasonable technical and organisational measures are used to protect information, including encrypted connections, restricted administration, secure payment processing, passwordless authentication and secure storage of system keys. No online system can be guaranteed completely secure.

If an unauthorised person is reasonably believed to have accessed personal information, Root & Season will investigate, contain and respond. Customers and the Information Regulator will be notified where POPIA requires it.

13. Your rights

Subject to law, a person may ask whether information is held about them, request access or correction, request deletion where permitted, object to certain processing, withdraw consent, opt out of marketing or complain about the handling of their information.

Requests should be sent to hello@rootandseason.co.za. Identity may need to be verified. Some records may be retained where required by law or necessary for a legal claim.

14. Direct marketing

Marketing will only be sent where permitted by law and will include a reasonable way to unsubscribe. Messages about payments, refunds, access, security and important service updates are not marketing.

15. Children

Purchases and accounts are intended for people aged 18 or older. Root & Season does not knowingly collect personal information directly from children without authorisation from a parent, guardian or other competent person.

16. Third-party links

Root & Season is not responsible for the privacy practices of an unrelated website linked from the guide. Customers should review the external website’s privacy policy.

17. Changes to this policy

This policy may be updated when services, providers or legal obligations change. Material changes will be communicated through the website or by email where reasonably practical.

18. Contact and complaints

If a privacy concern is not resolved, a complaint may be lodged with the Information Regulator of South Africa.