Privacy Policy
Plain-English Summary — Read This First
This section is plain language. The full legal terms govern in Sections 1–13.
FAQ (Pty) Ltd looks after your account data. Your registration profile (name, email, town, login) sits in a central regional database, shared across every Vendor store on this Network so you only register once.
Vendors only see what they need to fulfil your order. When you buy from a Vendor, they receive your delivery details for that order — nothing more. They don't get access to the central database.
We use Google Analytics/Site Kit and Meta Pixel to understand traffic and run ads. See Section 6 for full detail and how to opt out.
Your data stays in South Africa, hosted locally. One exception: transactional emails are sent via Amazon Simple Email Service (Amazon SES), which may process data outside South Africa under contractual safeguards — see Section 9.
You have rights under POPIA — access, correction, deletion, objection — and the right to complain to South Africa's Information Regulator at any time. See Sections 10 and 12.
1. Definitions & Parties
- FAQ / Route62 / "we", "us", "our" — FAQ (Pty) Ltd, trading as Route62.fans, the Responsible Party (as defined by POPIA) for the Portal and the central regional customer database.
- Portal — The main Route62.fans site at route62.fans.
- Vendor — An independent business operating a Vendor Subsite on this Network, and a separate Responsible Party for the order data you give them directly. See that Vendor's own Privacy Policy on their subsite.
- You / Data Subject — Any person whose personal information is collected or processed via the Portal.
- Personal Information — Information that identifies or relates to you, as defined in POPIA — for example your name, email, phone number, town, and order history.
- POPIA — The Protection of Personal Information Act 4 of 2013 (South Africa).
- Information Regulator — South Africa's independent body responsible for POPIA enforcement, to whom you may complain at any time.
2. Who Is Responsible For What
This Policy covers the Portal and the central regional customer database only. It does not cover a Vendor's handling of your order once you've purchased from their store — that's covered by that Vendor's own Privacy Policy, displayed on their Vendor Subsite.
| Data | Responsible Party | Governing Policy |
|---|---|---|
| Registration profile, login, central CRM, newsletters | FAQ (Pty) Ltd | This Policy |
| Order placed with a specific Vendor | That Vendor | The Vendor's own Privacy Policy |
This mirrors the roles set out in Section 3 of our Terms & Conditions — FAQ is the Mall Operator, each Vendor is an independent seller.
3. What We Collect
- Registration data — name, email address, town, login credentials.
- Browsing & interaction data — pages viewed, products browsed, wishlist/"Help Me Find" requests, used to personalise your experience and route anonymised demand to Vendors.
- Newsletter preferences — which newsletters (Town, and any Vendor-specific list) you've opted into, and engagement stats (opens/clicks).
- Technical data — IP address, browser/device information, and cookie identifiers, collected automatically for security and analytics (see Section 6).
- Comments — if you leave a comment on the site, the comment content, your name/email as provided, and your IP address for spam detection.
We do not collect or store payment card details — those are handled directly by each Vendor's own payment gateway (see Section 5.2 of the Terms & Conditions).
4. Why We Process It & Our Lawful Basis
| Purpose | Lawful Basis (POPIA) |
|---|---|
| Creating and managing your account, shared login across Vendor Subsites | Performance of a contract with you (our Terms & Conditions) |
| Sending newsletters you've opted into | Consent (double opt-in) |
| Routing "Help Me Find" / wishlist demand to Vendors (anonymised) | Legitimate interest — operating the marketplace |
| Site security, fraud prevention, spam detection | Legitimate interest |
| Analytics and advertising (Google, Meta) | Consent, via cookie preferences — see Section 6 |
| Complying with tax/record-keeping law (order records) | Legal obligation |
5. Who We Share It With
- The Vendor you order from — receives your order and delivery details for that order only, to fulfil it. They do not receive access to your full account profile.
- Service providers acting on our instruction — hosting, our central CRM (customer database and newsletters), Amazon SES (transactional email delivery), SMS gateway, and backup storage. These providers process data only as we instruct and may not use it for their own purposes.
- Analytics and advertising partners — Google (Site Kit/Analytics, Google Ads/Shopping) and Meta (Pixel, Business Manager), where you've consented to non-essential cookies. See Section 6.
- Legal or regulatory bodies — where required by law, court order, or to protect our rights or the safety of our users.
We do not sell your personal information to third parties.
6. Cookies & Tracking
6.1 Essential Cookies
Used for login sessions, shopping cart state, and security (e.g. determining whether your browser accepts cookies). These cannot be disabled without breaking core site functionality.
6.2 Analytics — Google Site Kit / Analytics / Google Tag Manager
We use Google Site Kit, Google Analytics, and Google Tag Manager to understand traffic, measure which pages and products perform well, and improve the site. Google may set cookies and collect data as described in Google's own Privacy Policy.
6.3 Advertising — Meta Pixel
We use the Meta Pixel (Facebook/Instagram) to measure ad performance and show relevant ads to people who've visited the Portal, via Meta Business Manager. See Meta's Privacy Policy.
6.4 Managing Cookies
You can control or delete cookies through your browser settings at any time. Blocking non-essential cookies will not prevent you from using the Portal, but may affect personalisation and how ads are shown to you elsewhere.
7. Data Security
We use industry-standard technical and organisational measures to protect your personal information, including SSL encryption in transit, CageFS filesystem isolation per hosting account, access controls on the central database, and regular backups. No system is completely secure; we will notify affected users and the Information Regulator without undue delay if we become aware of a data breach affecting your personal information, as required by POPIA.
8. How Long We Keep It
- Your registration profile is retained for as long as your account is active, plus a reasonable period afterward for security and legal purposes.
- Imported customer lists that don't opt in after 3 weeks are deleted, never added to the marketing database.
- Comments and their metadata are retained indefinitely to support spam/moderation history, unless you request removal.
- Order records (held by the relevant Vendor, with FAQ retaining operator/hosting-level access) are kept for 5 years in line with SARS record-keeping requirements, regardless of any account deletion request.
9. Cross-Border Transfers
Our hosting, the central customer database, and backups are based in South Africa. One exception: transactional emails (order confirmations, password resets, newsletters) are sent via Amazon Simple Email Service (Amazon SES), operated by Amazon Web Services, which may process your email address and message content on infrastructure located outside South Africa.
Where this happens, it is done under Amazon's standard contractual data-protection safeguards, and only for the purpose of delivering that email — not for Amazon's own marketing or profiling. This is disclosed here in line with POPIA Section 72's requirements for cross-border transfer of personal information.
10. Your Rights Under POPIA
You have the right to:
- Access the personal information we hold about you.
- Correct inaccurate or outdated information.
- Request deletion of your personal information, subject to information we're legally required to keep (e.g. tax records).
- Object to processing based on legitimate interest, or withdraw consent at any time (e.g. unsubscribe from a newsletter) without affecting the lawfulness of processing before withdrawal.
- Complain to our Information Officer, and/or to the Information Regulator directly — see Section 12.
To exercise these rights, use the POPIA removal form or your account area, or contact the Information Officer directly (Section 12). We aim to respond within a reasonable time, with an internal target of 21 days; more complex requests may take longer.
11. Children's Information
The Portal is not directed at children. In line with Section 4.2 of our Terms & Conditions, you must be 18 or older to register an account, or have a parent/guardian register and consent on your behalf if you are under 18. We do not knowingly collect personal information from children without such consent.
12. Information Officer & Complaints
Our Information Officer, appointed under POPIA and registered with the Information Regulator, handles data protection queries and complaints for FAQ (Pty) Ltd.
The Information Officer
FAQ (Pty) Ltd
Contact: Support page
If you're not satisfied with our response, you have the right to lodge a complaint directly with South Africa's Information Regulator:
The Information Regulator (South Africa)
Email: enquiries@inforegulator.org.za · inforegulator.org.za
13. Changes to This Policy
We may update this Policy from time to time. Where a change is material, we will give at least 30 days' notice by emailing registered account holders and displaying a notice banner on this page, consistent with how we handle material changes to our Terms & Conditions. The current version, with its effective date, is always published at this page.
Common Questions
These answers are derived from the sections above and are provided for ease of reference. The full clauses govern in all cases.
Who is responsible for my personal information?
FAQ (Pty) Ltd is the Responsible Party for your registration profile and the central customer database. Each Vendor you buy from is a separate Responsible Party for the order data you give them directly — see that Vendor's own Privacy Policy.
Do Vendors see my full account details?
No. A Vendor only receives the delivery details of the specific order you place with them — never access to the central customer database or your full profile.
Is my data sent outside South Africa?
Hosting and the customer database are based in South Africa. Transactional email is sent via Amazon SES, which may process data on infrastructure outside South Africa under contractual safeguards — see Section 9.
How do I stop tracking cookies?
Block or delete cookies via your browser settings at any time. This won't stop you using the Portal, but may affect personalisation and ad relevance.
Who do I complain to if I'm not satisfied?
Start with our Information Officer via the Support page. You may also complain directly to South Africa's Information Regulator at any time — this Policy doesn't limit that right.
FAQ (Pty) Ltd, trading as Route62.fans · route62.fans
Privacy Policy Version 1.1 — Effective 9 August 2026.
