Privacy Notice
Effective date: 13 October 2026 · Version: 2026-10-13
Responsible party: Food by K. Before publication, insert the full registered/legal name and physical or service address, and publish a monitored privacy contact. The Information Officer’s current contact details must also be published here; these details were not supplied for this draft.
Information we handle
Depending on how you use the platform, we process your name, email address, phone number, password hash, saved delivery addresses and geocoded coordinates, cart contents, order items and status, delivery/collection selection, payment status and PayFast tokenized payment reference, policy acknowledgments, cookie preference, and security/session information. We do not receive or store your full card number through this platform.
Why we use it
- Create and secure accounts, support sign-in and password recovery.
- Prepare and manage pre-orders, contact customers about order progress, deliver or prepare collection orders, and provide support.
- Tokenize and, after staff acceptance, charge payment through PayFast; reconcile payments and handle disputes.
- Check delivery eligibility using address geocoding and distance calculations.
- Protect the service, prevent abuse, troubleshoot, and meet legal and accounting obligations.
- Record policy acknowledgments and remember cookie choices.
Depending on the activity, our lawful basis may include providing the requested service or performing a contract, compliance with a legal obligation, or a documented legitimate interest. We request consent where required, including direct electronic marketing where applicable. Acknowledging this notice is not blanket consent to unrelated processing or marketing.
Who may receive information
Access is limited to authorized staff and service providers needed to operate the platform. These may include Railway (backend/database hosting), Netlify (website hosting), PayFast (payment processing), Resend (transactional email), Twilio (WhatsApp/SMS), a geocoding provider, object storage for menu images, and the limited FAQ assistant provider. Provider usage, locations, contracts, and cross-border safeguards must be verified by Food by K before launch.
The FAQ assistant is intended for menu and approved policy questions; do not enter account, address, payment, or other sensitive information into it.
Retention and security
We keep personal information only as long as needed for its purpose or a lawful retention requirement. If an account is deleted, profile identifiers, saved addresses, cart, reset links, and reusable payment tokens are removed or cleared. Order and payment records that must remain for legal, accounting, security, or dispute purposes are retained in pseudonymized form for the applicable period. Backups may expire on their scheduled rotation. We use access controls and technical safeguards, but cannot guarantee perfect security.
Your rights and contact
Subject to applicable law, you may request access, correction or deletion, object to processing, withdraw consent where applicable, or complain to the Information Regulator. You can delete your customer account from the Account page; unresolved active orders must first be resolved. Contact the Information Officer using the business contact details that must be completed above. The South African Information Regulator is at inforegulator.org.za.
Changes
Updates will be published here and signed-in users may be asked to review material changes. Current version: 2026-10-13.