Privacy Policy & POPIA Notice

1. Responsible Party

Responsible Party: [TBC: company legal name] (Pty) Ltd
Information Officer: [TBC: name / contact details]
Address: [TBC: registered address]
Email: [email protected]

Our Information Officer is registered with the Information Regulator as required by section 55 of the Protection of Personal Information Act 4 of 2013 (“POPIA”).

2. Personal Information We May Collect

• Name, contact details and account information.
• Booking, payment and transaction information. Booking fees are processed by our payment processor, Paystack; we don't store your card details ourselves.
• Special personal information, such as allergy, dietary or other health-related information you or your guests choose to share when making a booking (see clause 4A).
• Communication records and customer-support information.
• Technical information such as IP address, browser/device information and website usage data, collected via our analytics provider, PostHog, and our bot-protection provider, Cloudflare Turnstile.
• Information you voluntarily provide through forms, promotions or customer interactions.

3. Purposes of Processing

We may process personal information to create and manage accounts, process bookings and payments, communicate with customers, provide support, improve our services, prevent fraud, comply with legal obligations and conduct marketing where permitted by law.

4. Lawful Basis and What We Tell You When We Collect Information

Personal information is processed in accordance with POPIA and other applicable South African law, including where necessary for performance of a contract, compliance with a legal obligation, protection of legitimate interests, or with your consent.

Providing your contact and payment details is necessary to create an account or complete a booking. Providing dietary or allergy information is voluntary, if you do not provide it, we and the Restaurant simply will not be able to accommodate that requirement. Where we did not collect information directly from you (for example, where a Restaurant shares booking details you gave to them directly), we will let you know the source where practicable.

4A. Special Personal Information (Health / Allergy Data)

Allergy and dietary information is “special personal information” under section 26 of POPIA. We only process it with your explicit consent, given when you choose to share it, and only to pass it on to the relevant Restaurant so they can accommodate your requirements. We do not use this information for any other purpose, including marketing.

4B. Children

Our services are not directed at, and we do not knowingly collect personal information from, persons under the age of 18 without the consent of a parent or guardian, as required by sections 34 and 35 of POPIA. If you believe a child has provided us with personal information without appropriate consent, please contact our Information Officer so that we can delete it.

5. Sharing Information

We may share relevant information with restaurants, payment providers, technology/service providers and professional advisers where necessary to provide the service or fulfil a lawful purpose. We do not authorise third parties to use personal information for unrelated purposes.

Service providers who process personal information only on our instructions act as “operators” under POPIA, and we have written agreements with them requiring appropriate security safeguards. These currently include:

• Paystack, to process booking fee payments.
• PostHog, to understand how the Website is used so we can improve it. The analytics cookies it sets are only used with your consent (see clause 8).
• Cloudflare (Turnstile), to protect sign-up and login from automated abuse.
• Amazon Web Services (S3), to store restaurant photos, logos and menus.
• SendGrid, to deliver account and booking emails.
• LocationIQ, to convert a restaurant's address into map coordinates. This processes the Restaurant's business address, not a diner's personal information.
• [TBC: Sentry, planned before this Website goes live, to catch and diagnose errors].

A Restaurant that receives your booking and dietary information becomes an independent responsible party for its own subsequent use of that information (for example, preparing your order), and its own privacy practices apply to that use.

6. Cross-Border Transfers

Some of the service providers listed in clause 5 operate outside South Africa. Where personal information is transferred outside South Africa (for example, to [TBC: cloud hosting region/country]), we take the steps required by section 72 of POPIA to ensure an appropriate level of protection and a lawful basis for the transfer.

7. Direct Marketing

If you are not yet a customer of ours, we will only send you electronic direct marketing (such as email or SMS) with your prior opt-in consent, as required by section 69(1) of POPIA.

If you are an existing customer, we may send you direct marketing about similar goods or services, relying on the exemption in section 69(3) of POPIA, provided we gave you a free and easy opportunity to object when we first collected your details, and with every subsequent marketing communication.

You can opt out or withdraw consent at any time, free of charge, using the unsubscribe link in our communications or by contacting [email protected].

8. Cookies

We use strictly necessary cookies to operate and secure the Website; these do not require consent. Analytics cookies (PostHog) are only set once you accept them in the cookie banner shown on your first visit, and you can decline them there. We don't yet have a way to change that choice afterwards without clearing your cookies in your browser settings; a dedicated cookie-preferences page is planned.

9. Security, Retention and Breach Notification

We implement reasonable technical and organisational measures designed to protect personal information. Information is retained only for as long as reasonably necessary for the relevant purpose, legal obligations, dispute resolution and legitimate business requirements.

If we become aware of a security compromise that has led, or may lead, to unauthorised access to your personal information, we will notify the Information Regulator, and you where required, as soon as reasonably possible, in accordance with section 22 of POPIA.

10. Data Subject Rights

Subject to applicable law, you may request access to, correction or deletion of your personal information, object to certain processing, withdraw consent where processing is based on consent, and exercise other rights provided by POPIA. We aim to respond to such requests within 20 business days.

11. Complaints

You may contact our Information Officer first, using the details in clause 1. You may also lodge a complaint with the Information Regulator of South Africa where appropriate.

12. Access to Information (PAIA)

A manual describing the categories of records we hold, prepared in terms of the Promotion of Access to Information Act 2 of 2000, is available on request from our Information Officer.

13. Updates

We may update this Privacy Policy from time to time. Each version will show a version number and effective date, and the latest version will be published on the Website.