Privacy Policy

This Privacy Policy explains how Cater2U processes your personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Responsible party and Information Officer

The responsible party is [Legal entity name to be confirmed] (registration number [CIPC registration number to be confirmed]), [Physical address to be confirmed], South Africa, a member of the 7diverse group.

Information Officer: [Information Officer to be confirmed], privacy@example.invalid. (Launch checklist: the Information Officer must be registered with the Information Regulator.)

2. What we collect

• Account details: name, email address, password (stored only as a secure hash), optional phone number, account type.
• Planner details: first and last name, province and town, notification and marketing choices.
• Event requests: event type, date and times, town and suburb, venue details and address (if you give it), guest count, budget band, colours, theme, catering and dietary details, notes and inspiration photos.
• Business details: trading name, services, service areas and base location, description, portfolio and logo, contact details, CIPC and VAT numbers, calendar entries, reply templates.
• Messages and attachments exchanged in chats, including the original text of messages where contact details were masked (kept for moderation only).
• Payments (businesses): credit purchases, invoices, credit balances and transactions, Pro subscriptions. Card details are handled by Paystack and never stored by us.
• Technical information: IP address, browser, device and session data, security logs.
• Consent records: which version of these documents you accepted and your marketing choices, with time, IP address and browser.

3. Why we use it (purposes and lawful bases)

Purpose	Lawful basis (POPIA s11)
Creating and running your account	Performance of our agreement with you
Matching requests with businesses and enabling chat	Performance of our agreement
Masking contact details, moderation, fraud and abuse prevention	Legitimate interests; legal obligations
Payments, invoices and tax records	Legal obligation; performance of our agreement
Service messages (chat alerts, booking updates)	Performance of our agreement
Marketing by WhatsApp, email or SMS	Your consent (s69), which you can withdraw at any time
Improving and securing the Platform	Legitimate interests

4. What businesses see

• Before a booking is confirmed: businesses that unlock your request see your first name and town, your request details (without the street address), and your messages. Phone numbers, emails and links you type in chats are masked.
• After you confirm a booking: only the business you chose sees your full name, phone number, email address and venue address.
• Every business that unlocked your request keeps read-only access to it and to its own chat with you.
• Planners see a business's public profile; a business's contact details are shown to the planner only after a booking with that business is confirmed.

5. Operators and other recipients

We use trusted operators who process information on our behalf under written agreements:

• Amazon Web Services (hosting, file storage and email delivery via SES);
• Paystack (card payments and subscriptions);
• an SMS provider for one-time passwords, if enabled;
• a WhatsApp messaging provider, only for messages you have agreed to receive.

We share information with authorities where the law requires it. We do not sell personal information.

7diverse group: if you give marketing consent, 7diverse and 7diverse group companies may process your contact details to send you marketing on the channels you chose (POPIA s69).

6. Cross-border transfers

We host in the AWS region us-east-1 where possible. Some operators (for example, email delivery or payment processing) may process information outside South Africa. Where that happens we rely on POPIA section 72: the recipient is subject to laws, binding corporate rules or agreements that give substantially similar protection, or the transfer is necessary to perform our agreement with you.

7. How long we keep it

• Account and profile information: while your account is open.
• Requests and chats: while your account is open, so you and businesses can refer back to them.
• Invoices, credit transactions and payment records: five years after the transaction (tax and financial record-keeping laws), even if you close your account.
• Consent records: as long as needed to prove consent.
• Security logs: up to 12 months.

When you delete your account, we anonymise your personal information (see section 9), except records we must keep by law.

8. Security

We use encryption in transit (HTTPS), hashed passwords, optional two-step verification, access controls, private storage with time-limited links for files, masking of contact details in chats, and monitoring. No system is perfectly secure; we will notify you and the Information Regulator of a security compromise as POPIA requires.

9. Your rights

You may:

• access your personal information: download a copy any time from Account → Privacy → Export my data (a JSON file);
• correct it in your profile, or ask us to;
• delete your account from Account → Privacy → Delete my account. We cancel your open requests, anonymise your name, contact details, profile, messages and request notes, delete uploaded files, and keep only records the law requires (such as invoices and credit transactions);
• object to processing based on legitimate interests, and withdraw marketing consent at any time;
• complain to the Information Regulator (inforeg.org.za, complaints.IR@inforegulator.org.za).

For anything else, contact the Information Officer at privacy@example.invalid.

10. Direct marketing

We only send marketing by WhatsApp, email or SMS if you opted in with the separate, unticked checkbox:

I agree that Cater2U and its parent group, 7diverse, and 7diverse group companies may send me marketing messages via WhatsApp. I can opt out at any time.

We record the wording, version, time, IP address and browser of every consent and withdrawal. You can opt out in Account → Privacy or by replying STOP to any marketing WhatsApp message. Service messages about your requests, chats and bookings are not marketing.

11. Cookies

We use essential cookies to keep you signed in and secure. Analytics cookies are used only if you allow them. See our Cookie Notice.

12. Children

The Platform is for people aged 18 and over. We do not knowingly collect children's personal information. Event requests should not include children's personal information beyond what is needed for the event (for example, a birthday child's age).

13. Changes

We will post updates here with a new version number and date, and tell you about material changes.