Privacy Notice
Draft. Placeholders in [brackets] are completed before launch.
Who we are
Bakery is operated by [Company name] (Pty) Ltd, registration [number], [address]. We are the responsible party under POPIA. Information Officer: [name], [email].
This website
This website is for dispensaries. It doesn't sell or list products. We collect what you submit in the application and sign-in forms (business, licence and contact details), plus basic technical logs (IP address, browser) to keep the site secure. We don't use advertising trackers.
Partner applications
We use application details to assess your dispensary, verify your licence or registration and the owner's identity, contact you, and set up your account. Lawful basis: your consent and steps towards a contract.
The Bakery apps
Patients' personal information (including ID and selfie used for age verification) is processed in the Bakery app under the app's own privacy notice. Dispensaries receive only what they need to fulfil an order, never ID images.
Where data is stored
On servers in South Africa. We don't transfer personal information outside South Africa.
How long we keep it
Unsuccessful applications: [12 months]. Partner records: for the partnership and as long as tax and other laws require afterwards. ID images: deleted 90 days after verification.
Your rights
You may ask for access to, correction or deletion of your information, object to processing, and withdraw consent. Email [privacy@getbakery.co.za].
Complaints
Contact us first. You may also complain to the Information Regulator: JD House, 27 Siemens Street, Braamfontein, Johannesburg, 2017 · POPIAComplaints@inforegulator.org.za · inforegulator.org.za.