Privacy Policy

Last updated: 2026-10-19

This Privacy Policy explains how KASI DELIVERIES (PTY) LTD ("we", "us", "our") collects, uses, stores, and protects your personal information when you use the Kasi Deliveries platform. It is issued under the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Information Officer

Our Information Officer, responsible for POPIA compliance, is Nkosinathi Cibi. You can reach them at kasideliveries00@gmail.com for any question about your personal information, to exercise any of your rights below, or to lodge a complaint.

2. What we collect

We collect the minimum personal information we need to run a delivery service:

• Customers: name, email address, delivery address, phone number (optional), approximate and precise location (used to calculate delivery distance), order history, and loyalty/referral data.
• Shop owners: full name, email address, ID document, business name, address, Certificate of Acceptability (COA) number where applicable, bank account details for receiving payouts, and the images and menu items you upload.
• Drivers: full name, email address, phone number, ID document, driver's licence details, vehicle information, bank account details, and live geographic location while you are online and delivering.
• All users: hashed password (we use bcrypt; we never store your password in plain text), IP address, device and browser type, session cookies, and audit log entries of significant actions (login, signup, order status changes, admin actions).

3. Why we collect it

We use your personal information only for these purposes:

• To create and manage your account.
• To place, process, and deliver food orders.
• To verify identity and prevent fraud.
• To process payments and payouts.
• To send transactional emails (verification, password resets, order updates).
• To send marketing emails, only if you have not opted out (see the ✉️ toggle in the app).
• To comply with legal obligations (for example, retaining order records for tax).
• To improve the platform (aggregated analytics that do not identify you individually).

4. Who we share it with

We share only the minimum information needed to fulfil an order:

• Shop owners see your name, delivery address, phone number, and the order contents, so they can prepare and hand over your order.
• Drivers see your name, delivery address, and delivery PIN, so they can deliver your order.
• Service providers who process email on our behalf (currently Google Workspace / Gmail SMTP) receive only the recipient address and email content.
• Law enforcement may receive information if we are legally required to disclose it, and only to the extent required.

We do not sell your personal information to anyone.

5. How long we keep it

• Active accounts: for as long as you use Kasi Deliveries.
• Order records: for 5 years after the order, to comply with tax and consumer laws.
• Deactivated accounts: personal data is deleted within 30 days, except records we are legally required to keep.
• Audit logs: for 1 year.
• Verification emails and password resets: link tokens expire within 24 hours.

6. Your rights under POPIA

You have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate information.
• Delete your information, subject to legal retention requirements.
• Object to processing, including to marketing emails at any time.
• Complain to the Information Regulator of South Africa (inforeg.org.za).

To exercise any of these rights, email kasideliveries00@gmail.com from the address associated with your account. We will respond within 30 days.

7. Security

We use industry-standard measures to protect your information: passwords are hashed with bcrypt, all session data is signed and encrypted, and access to admin functions is restricted by a separate admin token. However, no system is perfectly secure, and you should use a strong, unique password and keep it confidential.

8. Cross-border transfers

Our email service is provided by Google (Google Workspace / Gmail), which may process data outside South Africa. Google is subject to equivalent data-protection obligations under its own policies. If we start using any other overseas processor, we will update this policy and, where POPIA requires, obtain your consent.

9. Data breach notification

If we become aware of a data breach that poses a risk to your personal information, we will notify the Information Regulator and any affected users as soon as reasonably possible, describing the nature of the breach and the steps we are taking.

10. Cookies

We use a small number of essential cookies. See our Cookie Policy for details.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be published on this page with a new "Last updated" date, and where the law requires, we will notify you by email.

12. Contact

For any privacy question or to exercise your rights, contact our Information Officer at kasideliveries00@gmail.com.