Privacy Policy

1. Introduction

This is the privacy policy (Privacy Policy) of Appetite Dining App Proprietary Limited (Registration No. 2026/406566/07) (APPETITE)

APPETITE respects your privacy and is committed to protecting your personal information. This Privacy Policy will inform you as to how we process your personal information when you visit our website and our app (regardless of where you visit it from), or otherwise contact us and/or use our services (collectively, our Services).

By making use of any of our Services, you agree to be bound by this Privacy Policy. If you do not accept or understand this Policy for any reason you should stop using our Services immediately.

You are responsible for regularly checking these terms available on the website for updates or amendments.

2. Purpose of this Privacy Policy

This Privacy Policy aims to give you information on how APPETITE collects and processes your personal information through your use of this website and mobile app, including any data you may provide through when you sign up to our newsletter OR take part in a competition OR create an account to use the mobile app OR set up a user profile to use app features OR purchase a product or service.

Neither this website nor the app is intended for children (persons under the age of 18), and no person under 18 should submit personal information to us or use the Services without the consent and supervision of their parent or legal guardian. We do not market to, or sell products or services to, anyone under 18, and we do not knowingly collect or process personal information relating to children.

It is important that you read this Privacy Policy together with any other privacy notices or policies we may provide on specific occasions when we are collecting or processing your personal information so that you are fully aware of how and why we are using your personal information. This Privacy Policy supplements other notices and privacy policies and is not intended to override them.

3. Responsible Party

APPETITE DINING APP (Pty) Limited of Unit 8 Abbeydale House, 4 Queen Street, Durbanville, Western Cape, 7550 is the responsible party for your personal information (referred to as “APPETITE,” "we", "us" or "our" in this Privacy Policy).

We have appointed an Information Officer who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your rights in relation to your personal information, please contact our Information Officer using the details set out below.

4. Contact details

If you have any questions about this Privacy Policy or our privacy practices, please contact our Information Officer at dataprotection@appetitesouthafrica.com.

You have the right to make a complaint at any time to the Information Regulator (South Africa), the regulator responsible for data protection under the Protection of Personal Information Act, 2013 (POPIA), which can be contacted at POPIAComplaints@inforegulator.org.za or via its website at https://inforegulator.org.za. We would, however, appreciate the chance to deal with your concerns before you approach the Information Regulator, so please contact us in the first instance.

Where we process the personal information of individuals located in the European Union or the United Kingdom, we do so in accordance with the GDPR and the UK GDPR, and those individuals also have the right to lodge a complaint with the data protection authority in their country of residence.

5. Third-party links including booking and ticketing facilities

The website and the app may include links to third-party booking or ticketing facilities and to other third-party websites, plug-ins, and applications. These links are not recommendations or endorsements. If you click on these links, you will be redirected to the relevant third-party website and that third party may collect and process your personal information in accordance with its own Privacy Policy.

We have no control over the contents of third-party websites and are not responsible for their privacy practices or privacy policies, and we accept no responsibility for them or for any loss or damage that may arise from your use of them. When you leave our website or app, we encourage you to read the Privacy Policy of the third-party website you visit.

6. The data we collect about you

Personal information means any information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person, as contemplated in POPIA. It does not include information where the identity has been removed and the information can no longer reasonably be linked to an identifiable person.

We process your personal information only where we have a lawful basis to do so. Accordingly, we will only process your personal information where:

• You provide consent for us to do so (which consent can be freely withdrawn at any time by you)
• It is necessary for us to perform any contractual obligations to you
• We have a legitimate interest in processing the information in order to provide our services, and/or for our legitimate business purposes, for example, to communicate with you, to use data for analytics purposes, to combat fraud
• We are under a legal obligation to do so
• In order to establish, exercise or defend our legal rights.
• To protect the rights, property or personal safety of another person and/or any member of the public.

We may collect, use, store and transfer distinct kinds of personal information about you which we have grouped together as follows:

We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data is not considered personal information where it has been anonymised so that you cannot be identified. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website or app feature. However, if we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we will treat the combined data as personal information and process it in accordance with this Privacy Policy.

We do not intentionally collect any other categories of special personal information unless you voluntarily provide it to us or we are otherwise permitted to process it under POPIA. This includes information relating to race, ethnicity, religious or philosophical beliefs, health (other than information voluntarily provided, such as dietary requirements or allergies), sexual orientation, political persuasion, trade union membership, biometric data, criminal behaviour, or personal information relating to children.

7. If you fail to provide personal information

Where we need to collect personal information to provide you with our services or to perform a contract with you, and you do not provide that information when requested, we may not be able to perform the contract, or provide the services. In those circumstances, we may have to cancel or suspend the relevant service you have with us, but we will notify you if this is the case.

Where providing personal information is voluntary, you may choose not to provide it, but this may limit the website, app, products, promotions, offers or services that we can make available to you.

Where the provision of personal information is required by law or is necessary to enter into or perform a contract with you, we will tell you where practicable and explain the consequences of not providing the requested information.

8. How is your personal information collected?

We collect personal information directly from you when you submit information through the website or app, contact us, create an account, purchase products or services, participate in promotions or competitions, or otherwise interact with us. The personal information we collect may include your personal or business details, contact information, billing information, and any documents or forms you submit to us.

We process your personal information only for lawful purposes, including to communicate with you, provide our services, administer your account, process transactions, comply with our legal obligations, improve our services and otherwise fulfil our contractual obligations to you.

Where our processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before the withdrawal. Where we are required or entitled by law to continue processing your personal information, or where processing is necessary to perform a contract with you, we may continue to process your personal information despite the withdrawal of your consent.

If you provide us with the personal information of another person, you warrant that you are authorised to do so and, where required, that you have obtained the necessary consent or other lawful justification for the disclosure. You must notify us immediately if that authority or consent is withdrawn. You indemnify us, to the fullest extent permitted by law, against any loss arising from your disclosure of personal information without the necessary authority.

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity and Contact by filling in forms or by corresponding with us. This includes personal information you provide when you:
  • create an account on our platform;
  • download the app;
  • use app features;
  • subscribe to our services or publications;
  • request marketing to be sent to you;
  • purchase products or services or engage with an offer or promotion;
  • enter a competition, promotion, or survey; or
  • give us feedback or contact us.
• Automated technologies or interactions. As you interact with our website or app, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal information by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.
• Third parties or publicly available sources. We will receive personal information about you from various third parties and public sources as set out below:
  • Technical Data from the following parties:
    • (i) Analytics providers such as Google based inside and outside South Africa;
    • (ii) Advertising networks such as Awin based inside and outside South Africa;
    • (iii) Search information providers such as Google and Bing based inside and outside South Africa;
    • (iv) Identity and Contact Data from publicly available sources

9. How we use your personal information

We may use your contact details to market and promote our products and services that we believe may interest you and to provide you with information about our services. You may opt out of receiving direct marketing communications from us at any time by using the unsubscribe facility in the communication or by contacting us.

We will not sell your personal information. We may share your personal information with third parties where necessary to provide our services, where required by law, or with your consent. We may also share anonymised or de-identified information that cannot reasonably be linked to you.

We may share your personal information with trusted third-party service providers who assist us in operating our business and providing our services. Those service providers are required to keep your personal information confidential, implement appropriate security measures, and process it only on our instructions.

We will only use your personal information where permitted by law, including where:

• you have consented to the processing;
• necessary to conclude or perform a contract with you;
• the processing is required to comply with an obligation imposed by law;
• the processing protects a legitimate interest of yours;
• it is necessary for our legitimate interests (or those of a third party).

We will obtain your consent where required by POPIA, including for direct marketing by electronic communications, for collecting or using geolocation where you have chosen to enable location services, and for processing special personal information, where applicable. You may withdraw your consent at any time by contacting us or by using the unsubscribe or opt-out mechanism provided in our communications, although this will not affect processing that was lawful before your consent was withdrawn.

10. Purposes for which we will use your personal information

The table below describes the purposes for which we process your personal information, and the categories of personal information that may be processed for those purposes.

11. Marketing

We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising.

Promotional offers from us

We may use your Identity, Contact, Technical, Usage, Geolocation and Profile Data (which may include special personal information (in particular, details about your allergies, dietary requirements etc. from which information about your race or ethnicity, religious beliefs and health may be inferred)) to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive electronic marketing communications from us only where POPIA permits this, including where you have consented to receive them, or where you are an existing customer and we obtained your contact details in the course of providing you with our products or services, provided that you have not opted out of receiving direct marketing communications.

Third-party marketing

We will obtain your consent before sharing your personal information with any third party for that third party's direct marketing purposes.

Opting out

You may opt out of receiving direct marketing communications at any time by using the unsubscribe or opt-out facility included in the communication, or by contacting us at any time using the details in this Privacy Policy. Each direct marketing communication will identify the sender and provide a simple method for opting out.

12. Tagging is optional

Optional tagging can be used on this website or the app to enable you to review places that you eat at (including to tag cuisines, vibes and allergies/dietary requirements that are accommodated).

Using diet tags may reveal special personal information about you, including information relating to your race or ethnicity, religious beliefs and/or health. Before you are able to use diet tags, we will ask you to confirm that you understand this and consent to our processing of that special personal information for the purposes described in this policy. If you do not consent, you should not use diet tags.

If you start to use tags and change your mind and want to stop using them, simply don't use them as part of future reviews and remove any tags that you used in the past. Please contact us at dataprotection@appetitesouthafrica.com if you would like our support in removing past tags that you used.

13. Cookies

“Cookies” are small files stored on your computer during your use of the website and which contain data about your use of the website. They help us recognise your device and collect information about how you use the website. We may use session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until they expire or are deleted) to understand how you use the website and to improve its functionality and your user experience.

We may also use cookies and similar technologies to collect information about your visit to the website, including the date and time of your visit, how you found the website, the pages you visit, and how you interact with the website.

You can set your browser or device settings to refuse all or some Cookies, or to alert you when Cookies are being used. If you disable or refuse Cookies, please note that some parts of the website or the app may become inaccessible or may not function properly. For more information about the Cookies we use, please refer to our Cookie Policy.

14. Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we are permitted by law to use it for another reason that is compatible with the original purpose of collection.

If we need to use your personal information for a purpose that is materially different from the original purpose, we will notify you where required by law.

Please note that we may process your personal information without your knowledge or consent, where this is required or permitted by law.

15. Disclosures of your personal information

We may share your personal information with:

• our service providers and operators who assist us in providing our website, app and services, including IT hosting, payment processing, analytics and customer support; our professional advisers, including legal, accounting, auditing, banking and insurance advisers;
• regulators, law enforcement agencies, courts or other public authorities where we are required or permitted to do so by law;business partners where this is necessary to provide products, promotions or services you have requested; and
• a purchaser or successor in the event of a sale, merger, restructuring or transfer of all or part of our business.

Where a third party processes personal information on our behalf as an operator, we require that operator to process the personal information only with our knowledge or authorisation, to treat it as confidential, to apply appropriate security safeguards, and to notify us immediately if there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

16. International transfers

We may transfer your personal information outside South Africa where this is necessary for the purposes described in this Privacy Policy and where POPIA permits the transfer. We will ensure that appropriate safeguards are in place to protect your personal information. We currently transfer personal information:

• to DigitalOcean who provide our servers and other cloud services and act as operators on our behalf, with whom we have contractual arrangements in place to protect your personal information. DigitalOcean may transfer your personal information on to its sub-operators who may be based anywhere in the world; those transfers take place under contractual arrangements that require your personal information to be protected to a standard substantially similar to that required by POPIA. You can see full details of those arrangements in DigitalOcean’s Data Processing Agreement here: https://www.digitalocean.com/legal/data-processing-agreement.
• to our software developers in Nepal under the terms of a written agreement that requires your personal information to be protected to a standard substantially similar to that required by POPIA.

17. Data security

We have put in place appropriate technical and security measures to protect your personal information against accidental or unlawful loss, destruction, damage, unauthorised access, alteration, or processing. We have identified the reasonably foreseeable internal and external risks to the personal information in our possession or under our control, we maintain appropriate safeguards against those risks, and we regularly verify that these safeguards are effectively implemented and updated in response to new risks or deficiencies.

In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a legitimate business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal information security compromise. Where there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible after discovery of the compromise, unless the identity of the affected data subjects cannot be established or notification may lawfully be delayed. Our notification will include information reasonably required to help affected data subjects take protective measures.

18. Data retention

How long will you use my personal information for?

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

You may ask us to delete or destroy your personal information where there is no lawful basis for us to retain it. However, we may retain personal information where we are required or permitted to do so by law.

In some circumstances we will anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

19. User rights

You have the following rights:

• Request access to a copy of the personal information we hold about you.
• Request correction of your personal information. You will need to ensure your personal information is accurate and up-to-date.
• Request erasure of your personal information, in certain circumstances.
• Object to certain processing of your personal information, such as direct marketing, automated processing or profiling.
• Request restriction of processing of your personal information, in certain circumstances.
• Request transfer of your personal information to another organisation.
• Right to withdraw consent by contacting our Information Officer.
• Lodge a complaint with the Information Regulator.

To better safeguard your information, we will take reasonable steps to verify your identity before granting access or making corrections to your information.

You will not generally have to pay a fee to access your personal information or to exercise any of your other rights in terms of this Privacy Policy. However, we may charge a reasonable fee if your request is clearly unfounded, excessive, repetitive or otherwise legally restricted. Alternatively, we may refuse to comply with your request in these circumstances.

20. Questions or Concerns About This Policy

If you would like to exercise any of your rights in respect of your personal information or have any queries or complaints on how we have handled your personal information, please contact us via our Information Officer so we can investigate the matter. You also have the right to lodge a complaint with the relevant regulatory body which, for the purposes of POPIA, is the Information Regulator. The Information Regulator can be contacted by email: POPIAComplaints@inforegulator.org.za.