Privacy Notice
C-The-Way · Effective date: 8 October 2026
Overview
Responsible Party:
C-The-Way (An Application “App” developed by and trading under Mars Technologies (Pty) Ltd) — responsible for processing personal information to facilitate bookings, visits and events at wine farms, camping sites and other tourism venues in South Africa. This notice explains what information we collect, why, how long we keep it, who we share it with, your rights under POPIA, and how to contact us.
Information Officer: Gert Cronje. Email: privacy@marstech.co.za, Phone: 083 226 0787 (Information Officer), or 087 287 4486 (Mars Technologies switchboard).
Registration of the Information Officer with the Information Regulator of South Africa is in progress.
Information Collected
We collect only the personal information necessary to provide services, ensure safety, process payments, and comply with legal obligations.
Categories of personal information we collect
- Identity and contact: full name; email; phone number; profile photo and cover image; short biography; language and currency preference.
- Booking and visit details: reservation dates; number of guests; special requests; the notes you add to a booking.
- Payment: payment transaction references and payment confirmations. Full card data is processed and stored only by our third-party payment provider; we never receive or store it.
- Location and device: IP address; device type; browser; coarse location; precise GPS only with explicit opt-in consent.
- Emergency contacts: where you choose to add one, the name, relationship and phone number of a person you nominate. This is information about somebody else, so please add a contact only if they are willing to be listed, and tell them we hold it. You or they may ask us to remove it at any time using the contact details below.
- Safety and SOS: if you use the in-app SOS feature, we record the time of the alert and your precise location at that moment, so that help can be directed to you.
- Your activity in the app: saved and visited places; itineraries and planned routes; reviews and ratings you write; accounts you follow and who follows you; loyalty account balance, vouchers and badges.
- Media and images: photos or videos you upload or consent to be taken at events.
- Communications and support: messages, complaints, support tickets and your notification preferences.
- Usage and analytics: cookies (see the cookie section below), analytics and attribution identifiers, app error reports, and — on our websites — page and event records used to understand how the service is used.
What we do not collect. We do not ask for or store a postal address, vehicle registration, identity or passport number, copies of identity documents, or dietary and accessibility requirements. If a form ever appears to request one of these, please do not provide it and tell us using the contact details below.
How we obtain information
- Directly from you when you register, book, check in, upload media, or contact us.
- From venue partners, travel agents, or event organisers when you book through them.
- Automatically via the app or website (cookies, analytics, device data).
- From third-party identity or verification services when required.
Cookies and similar technologies
We use very little of this, so it is short and specific rather than generic.
| Where | What is stored | Purpose | Consent |
|---|---|---|---|
| This website | No cookies. Campaign values only (utm_source, utm_medium, utm_campaign) held in your browser's session storage until you close the tab. | So that a campaign you arrived from is still known if you move to a second page. | Not required — no identifier is stored and you cannot be recognised from it. |
| This website (third parties) | No cookies set by us. Fonts and icons are loaded from Google Fonts and jsDelivr, which receive your IP address as part of that request. | Page appearance. | Not required, but noted here so you know the request happens. |
| Business portal and admin panel | A single sign-in cookie holding your session. | Keeping you signed in. These are staff and business-owner tools, not traveller facing. | Strictly necessary — without it you cannot sign in. |
| Mobile app | No cookies. Analytics and attribution identifiers, described above. | Understanding how the app is used and which campaigns lead to installs. | Only with your consent, which you can change at any time in the app under Profile › Privacy. |
How We Use Personal Information and Lawful Basis
We process personal information for the purposes below and rely on the lawful bases indicated under POPIA.
Primary purposes and lawful bases
- To provide and manage bookings and visits — Performance of contract; POPIA conditions: purpose specification, minimality.
- To process payments — Performance of contract; payment data handled by our third-party payment provider.
- To ensure safety and compliance (identity checks, emergency contact, incident handling) — Legal obligation and legitimate interests; POPIA conditions: accountability, security.
- To communicate transactional information (confirmations, receipts, safety notices) — Performance of contract.
- To send marketing and promotional offers — Consent; you may withdraw consent at any time.
- To improve services and prevent fraud (analytics, fraud detection) — Legitimate interests balanced against your rights; you may object to profiling for direct marketing.
- To store photos/media for promotional use — Consent; we will obtain explicit consent before using your images publicly.
POPIA conditions
We comply with POPIA’s eight conditions for lawful processing:
- accountability;
- processing limitation;
- purpose specification;
- further processing limitation;
- information quality;
- openness;
- security safeguards; and
- data subject participation.
Sharing, Cross-Border Transfers, and Processors
Who we share with
- Cloud hosting provider located in South Africa (primary storage).
- Payment processor (third party) for card and payment processing: Paystack — full card data is handled by them under their security controls.
- Venue partners and event organisers to fulfil bookings and on-site services.
- Service providers: analytics, customer support, identity verification, email/SMS providers.
- Law enforcement or regulators when required by law or to protect rights and safety.
Data Processing Agreements (DPAs)
We enter into written DPAs with all processors requiring POPIA-level safeguards, limiting processing to specified purposes and requiring appropriate technical and organisational measures.
Cross-border transfers
Your data is primarily stored in South Africa. If we transfer personal information outside South Africa we will do so only where:
- an adequate level of protection exists;
- appropriate contractual safeguards are in place; or
- you have given explicit consent. We will document and assess any transfer and inform you where required.
Security, Retention, and Breach Handling
Security measures
We maintain technical and organisational measures to protect personal information, including: encryption in transit; role-based access controls; a documented process for periodic security review and vulnerability management; staff training on data handling; and least-privilege access. Processors are contractually required to maintain equivalent safeguards. We do not currently use multi-factor authentication for privileged administrative access; this is a planned improvement, not yet in place.
Breach response and notification
We maintain an incident response plan. In the event of a data breach that poses a risk to your rights and freedoms we will:
- contain and investigate the incident;
- notify affected individuals without undue delay; and
- notify the Information Regulator where required by POPIA.
Retention schedule
This table describes what our systems actually do today. Where a period is stated, it is enforced by an automated job; where retention is tied to your account, the data is removed or anonymised when your account is deleted. We are extending automated retention to more categories, and this table will be updated as that work lands rather than in advance of it.
| Data category | Examples | Retention period | Legal basis |
|---|---|---|---|
| Account and profile | Name; email; phone; profile photo; preferences | Until you delete your account. Deletion is held for 7 days so it can be cancelled, then the profile is anonymised and the sign-in identity erased automatically. | Performance of contract; consent |
| Booking and transactional records | Reservation details; payment references; receipts | Retained for as long as the account exists, and after account deletion where we are required to keep transaction records for accounting and tax purposes. | Performance of contract; legal and accounting obligations |
| Your activity in the app | Saved places; itineraries; reviews; follows; loyalty, vouchers and badges | Retained while your account is active. Reviews you have published may remain visible in anonymised form so that other travellers' ratings stay meaningful. | Performance of contract; legitimate interests |
| Emergency contacts | Name, relationship and phone number you nominate | Until you remove the contact, or your account is deleted. Removable on request by the nominated person. | Legitimate interests (traveller safety) |
| Safety and SOS records | Time and precise location of an SOS alert | Retained while the account is active. We do not currently delete these on a fixed schedule, because an incident record may be needed after the event. | Legitimate interests; protection of a vital interest |
| Technical error reports | Application error and diagnostic records | 30 days, then deleted automatically. | Legitimate interests (keeping the service working) |
| Analytics and consent records | Analytics identifier; whether you consented to tracking, when, and by what means | Retained while the account is active. Withdrawing consent rotates the analytics identifier, which breaks the link to earlier activity. | Consent |
| Photos and media | Images you upload or consent to be taken at events | Until you remove them or your account is deleted. | Consent; legitimate interests for promotion |
We will securely delete or anonymise personal information when no longer required, except where retention is necessary for legal claims, fraud investigations, or regulatory obligations.
Children and Minors
C-The-Way is intended for adults. The service is built around wine tastings, bookings and travel arrangements, and it is not designed or directed at children.
We do not knowingly collect personal information from anyone under 18. We do not ask for a date of birth, and we hold no information from which we could determine a user's age.
If you believe a child has created an account or that we hold a child's personal information, contact the Information Officer using the details below. We will delete the account and the associated personal information promptly.
Where a parent or guardian books on behalf of a family, please give us only the information needed for the booking itself. Do not include a child's personal details in booking notes or special requests.
Your Rights, Consent, PAIA and How to Exercise Rights
Your rights under POPIA
- Access: request a copy of personal information we hold about you.
- Correction: ask us to correct inaccurate or incomplete information.
- Deletion: request deletion where we are not required to retain the data.
- Object or restrict processing: object to processing based on legitimate interests or request restriction.
- Withdraw consent: withdraw consent for marketing, precise location, or media use at any time.
- Data portability: request a machine-readable copy of data you provided.
- Lodge a complaint: complain to the Information Regulator if you are not satisfied.
How to exercise your rights
Contact our Information Officer at privacy@marstech.co.za or 083 226 0787.
Provide sufficient information to identify yourself and the request. We will verify your identity before responding. We will respond within POPIA-aligned timeframes and inform you if we need more information.
Consent mechanics and recordkeeping
For optional processing (marketing, precise GPS, promotional photos) we obtain explicit, informed opt-in consent via clear checkboxes or consent screens at the point you take the action. For analytics and tracking specifically, we go further and store consent metadata — what you consented to, when, and by what means — so that consent can be demonstrated, not merely assumed.
You can withdraw consent at any time; withdrawal does not affect processing already lawfully carried out.
PAIA and complaints
Our PAIA Manual is still being finalised. In the meantime, you can request access to any record by contacting our Information Officer directly using the details below.
You have the right to lodge a complaint with the Information Regulator of South Africa: https://inforegulator.org.za/complaints
Changes, Contact and Additional Information
Changes to this notice
We may update this privacy notice to reflect changes in our practices or legal requirements. We will publish the revised notice with a new effective date and notify users of material changes where required.
Contact details
Information Officer: Gert Cronje
Email: privacy@marstech.co.za
Postal address: Suntyger Building, 313 Durban Road Unit 201A,
Tygervalley, 7530
Phone: 083 226 0787
Third-party privacy pages
For details about how our payment provider handles card data, see Paystack's privacy notice at paystack.com/privacy.
Acknowledgement
By using our app or services you acknowledge that you have read this privacy notice and that we will process your personal information as described, where consent is required, you will be asked to opt in.