Privacy Policy (PAIA & POPIA)

This policy applies to:

• (i)
  Customers who browse or order through the Platform;
• (ii)
  Restaurant Partners and their staff who use the Platform to receive and manage orders; and
• (iii)
  Drivers who use the Platform to receive and fulfil delivery assignments.

Customers:

• (i)
  Identity and contact details: name, mobile number, and email address.
• (ii)
  Delivery information: delivery addresses, including any notes or access information such as gate codes. If you tap ‘Use my current location’, your device location is read for up to 10 seconds to find where you are, one position is sent to Google Maps to find your street address, and nothing is kept unless you save that address.
• (iii)
  Order information: order history, items ordered, order value, and delivery feedback or ratings.
• (iv)
  Payment information: a payment token and limited transaction metadata provided by our payment processor, PayFast. We do not collect, see, or store your full card number, expiry date, or CVV, or any other payment method details.

Restaurant Partners:

• (i)
  Business or trading name and company registration details, and VAT registration number where registered.
• (ii)
  The identity details of the owner or authorised representative, and business contact details.
• (iii)
  Banking details for payouts, verified by a bank confirmation letter.
• (iv)
  Health and food-safety certification (such as a municipal Certificate of Acceptability), and a liquor licence where the Restaurant Partner sells alcohol.
• (v)
  Menu content, pricing, and images.
• (vi)
  Staff user accounts — the login details of any staff the Restaurant Partner authorises to use the Platform on its behalf.
• (vii)
  Public liability and product liability insurance: where the Restaurant Partner chooses to provide them, the details of any such insurance policies it holds. Providing these is optional and at the discretion of the restaurant.

Drivers:

• (i)
  Full name and identity number (for South African citizens) or passport details (for non-citizens), and a work permit or visa where the Driver is not a South African citizen.
• (ii)
  Driver’s licence and, where required, a Professional Driving Permit (PrDP).
• (iii)
  Vehicle details, vehicle licence/registration, and vehicle insurance details.
• (iv)
  Banking details for payouts, verified by a bank confirmation letter or recent bank statement.
• (v)
  Real-time or last-known location while an active delivery is in progress.
• (vi)
  Public liability and vehicle insurance: where the Driver chooses to provide them, the details of any such policy it holds. Providing these is optional and at the discretion of the driver.

All account holders (Customers, Restaurant Partners, and Drivers).

• (i)
  Account credentials: the email address and password you use to sign in (your password is stored only in hashed form — see section 9), and any sign-in links we send you by email or one-time verification codes we send you by SMS or email.
• (ii)
  Technical information: device information, app usage data, and push-notification tokens, collected automatically through your use of the Platform.

We process personal information for the following purposes, each of which has a lawful basis under POPIA (performance of a contract with you, our legitimate business interests, compliance with a legal obligation, or your consent, as indicated):

• (i)
  To create and manage your account, and to authenticate you when you sign in — for example by email and password, by an email verification link, or by a one-time code sent by SMS or email (contract).
• (ii)
  To confirm your eligibility to order age-restricted items such as alcohol, which our delivery drivers verify by checking your ID on delivery (compliance with a legal obligation).
• (iii)
  To process, allocate, prepare, and deliver your orders, including sharing limited order details with the relevant Restaurant Partner and Driver (contract).
• (iv)
  To process payments and refunds via PayFast (contract).
• (v)
  To provide customer support and respond to queries or complaints (contract / legitimate interest).
• (vi)
  To send order-related communications via SMS (Twilio), email (Resend), and push notification (Firebase), including one-time codes, order status updates, and receipts (contract).
• (vii)
  To personalise offers and send marketing communications about offers, new restaurants, or promotions — only where you have opted in, and you may opt out at any time (consent).
• (viii)
  To detect, investigate, and prevent fraud, money laundering and other financial crime, abuse of promotional offers, and security incidents (legitimate interest / legal obligation).
• (ix)
  To verify the identity of Restaurant Partners and Drivers, and to confirm that the bank account we pay belongs to them, before making payouts — for example by means of a bank confirmation letter, a recent bank statement, or an electronic bank-account verification check (legitimate interest / legal obligation).
• (x)
  To pay Restaurant Partners and Drivers, and to meet our own tax, accounting, and regulatory obligations, including obligations to SARS (legal obligation).
• (xi)
  To improve and maintain the Platform, including analysing aggregated, de-identified usage data (legitimate interest).
• (xii)
  To use the insurance information that a Restaurant Partner or Driver provides only where an incident, claim, or dispute arises — for example, to refer the matter to the relevant party’s insurer and to establish, exercise, or defend a legal claim or responsibility (legitimate interest / establishing or defending a legal right).

We share personal information only as necessary for the purposes described in section 4, with the following categories of recipient:

• (i)
  Restaurant Partners and Drivers: for an active order only, the assigned Restaurant Partner and Driver receive the information needed to fulfil that order (such as your name, delivery address, and contact number). Drivers’ access to your name, contact number, and address lasts for the active delivery and for up to 20 minutes after the Driver marks the delivery complete, after which it is removed.
• (ii)
  PayFast: our payment processor, for processing payments and refunds.
• (iii)
  Supabase Inc. / Supabase entities (database and backend hosting, EU – Ireland region): hosts our application database, including personal information described in section 3. See section 7 for cross-border transfer information.
• (iv)
  Twilio: for sending one-time codes and order-related text messages by SMS, and for automated phone calls alerting Drivers to new orders.
• (v)
  Resend: for sending transactional emails (such as receipts and account notifications).
• (vi)
  Firebase (Google): for delivering push notifications to the Bay Eats app.
• (vii)
  Professional advisors, auditors, and regulators (including SARS and the Information Regulator), where necessary to comply with our legal obligations or to obtain advice.
• (viii)
  A prospective buyer or successor, in the event of a sale, merger, or restructuring of Bay Eats’s business, subject to equivalent confidentiality protections.
• (ix)
  Security personnel of access-controlled estates, complexes, or similar premises in the delivery area: with the relevant Driver’s consent, limited Driver identity details (such as name, ID or passport number, vehicle registration, and driver’s licence details), solely to enable the Driver to access the premises to make a delivery.
• (x)
  During an active delivery, we share limited details of the assigned Driver with the Customer to enable contact and identification of the delivery — namely the Driver’s first name, vehicle make, model, colour and registration, and a contact number for calling or messaging the Driver via WhatsApp. The Customer’s access to these Driver details is limited to the duration of the active delivery and is removed once the delivery is marked complete.
• (xi)
  Vercel: hosts the Bay Eats website and the servers that run the Platform, through which personal information passes when you use it.
• (xii)
  Google Maps Platform (Google): for suggesting, looking up, and checking delivery addresses, and for working out delivery areas and driving distances.

Subject to POPIA, you have the right to:

• (i)
  be notified that we hold personal information about you;
• (ii)
  request access to the personal information we hold about you;
• (iii)
  request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully;
• (iv)
  object, on reasonable grounds, to the processing of your personal information;
• (v)
  withdraw any consent you have given (such as consent to marketing), without affecting the lawfulness of processing before withdrawal; and
• (vi)
  not be subject solely to a decision based on automated processing which significantly affects you, without an opportunity to make representations.

If you believe we have not complied with POPIA in handling your personal information, you may lodge a complaint with our Information Officer (section 2), or directly with the Information Regulator:

• (i)
  Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• (ii)
  Telephone: 010 023 5200 / toll-free 0800 017 160
• (iii)
  Email (general enquiries): enquiries@inforegulator.org.za
• (iv)
  POPIA complaints: online through the Regulator’s eServices Portal (eservices.inforegulator.org.za), or by email to POPIAComplaints@inforegulator.org.za
• (v)
  Website: www.inforegulator.org.za