Privacy Policy

Last updated: 2026-11-05

This Privacy Policy explains how KASI DELIVERIES (PTY) LTD ("we", "us", "our") collects, uses, stores, and protects your personal information when you use the Kasi Deliveries platform. It is issued under the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Information Officer

Our Information Officer, responsible for POPIA compliance, is Nkosinathi Cibi. You can reach them at kasideliveries00@gmail.com or by post at 11 Stephenson St, Arcadia, East London, Eastern Cape, 5201. You can contact them for any question about your personal information, to exercise any of your rights below, or to lodge a complaint.

2. What we collect

We collect the minimum personal information we need to run a delivery service:

• Customers: name, email address, delivery address, phone number (optional), approximate and precise location (used to calculate delivery distance), order history, and loyalty/referral data.
• Shop owners: full name, email address, ID document, business name, address, Certificate of Acceptability (COA) number where applicable, bank account details for receiving payouts, and the images and menu items you upload.
• Drivers: full name, email address, phone number, ID document, driver's licence details, vehicle information, bank account details, and live geographic location while you are online and delivering.
• All users: hashed password (we use bcrypt; we never store your password in plain text), IP address, device and browser type, session cookies, and audit log entries of significant actions (login, signup, order status changes, admin actions).

Optional Google and Apple sign-in

If you choose Google or Apple sign-in, we receive a provider account identifier, your verified email address (which may be an Apple private relay address), and a display name where provided. We use this information to create or connect your account and authenticate future sign-ins. We do not receive your Google or Apple password or request access to your email messages, contacts, files or social posts. Temporary sign-in proofs expire after ten minutes; used proofs are cleared and expired rows are removed during later sign-in starts. Provider identifiers remain linked until your local account is deleted. You can review connections under More → Connected accounts and revoke provider authorization in your Google or Apple account settings. Those providers process your sign-in under their own privacy policies. Email-and-password sign-in remains available.

3. Why we collect it

We use your personal information only for these purposes:

• To create and manage your account.
• To place, process, and deliver food orders.
• To verify identity and prevent fraud.
• To process payments and payouts.
• To send transactional emails (verification, password resets, order updates).
• To send marketing emails, only if you have not opted out (see the ✉️ toggle in the app).
• To comply with legal obligations (for example, retaining order records for tax).
• To improve the platform (aggregated analytics that do not identify you individually).

4. Who we share it with

We share only the minimum information needed to fulfil an order:

• Shop owners see your name, delivery address, phone number, and the order contents, so they can prepare and hand over your order.
• Drivers see your name, delivery address, and delivery PIN, so they can deliver your order.
• Service providers who process email on our behalf (currently Google Workspace / Gmail SMTP) receive only the recipient address and email content.
• Law enforcement may receive information if we are legally required to disclose it, and only to the extent required.

We do not sell your personal information to anyone.

Safety reports and optional evidence

If you send a safety report, we store your account identity, any related order, your written note, and GPS coordinates only if you choose to share them. Camera and microphone recording require your permission and a visible start action. Optional evidence is encrypted in storage and accessible only to your reporting account and authorised admin. Admin notification emails contain a sign-in link rather than public evidence attachments. We use these records to review safety concerns, not for marketing. Reports are not automatic police calls or dispatch confirmations. We retain safety records as needed for incident review and applicable legal obligations; contact our Information Officer to request access, correction or deletion under POPIA.

5. How long we keep it

• Active accounts: for as long as you use Kasi Deliveries.
• Order records: for 5 years after the order, to comply with tax and consumer laws.
• Deactivated accounts: personal data is deleted within 30 days, except records we are legally required to keep.
• Audit logs: for 1 year.
• Verification emails and password resets: link tokens expire within 24 hours.

6. Your rights under POPIA

You have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate information.
• Delete your information, subject to legal retention requirements.
• Object to processing, including to marketing emails at any time.
• Complain to the Information Regulator of South Africa (inforeg.org.za).

To exercise any of these rights, email kasideliveries00@gmail.com from the address associated with your account. We will respond within 30 days.

7. Security

We use industry-standard measures to protect your information: passwords are hashed with bcrypt, all session data is signed and encrypted, and access to admin functions is restricted by a separate admin token. However, no system is perfectly secure, and you should use a strong, unique password and keep it confidential.

8. Cross-border transfers

Our email service is provided by Google (Google Workspace / Gmail), which may process data outside South Africa. Google is subject to equivalent data-protection obligations under its own policies. If we start using any other overseas processor, we will update this policy and, where POPIA requires, obtain your consent.

9. Data breach notification

If we become aware of a data breach that poses a risk to your personal information, we will notify the Information Regulator and any affected users as soon as reasonably possible, describing the nature of the breach and the steps we are taking.

10. Cookies

We use a small number of essential cookies. See our Cookie Policy for details.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be published on this page with a new "Last updated" date, and where the law requires, we will notify you by email.

12. Contact

For any privacy question or to exercise your rights, contact our Information Officer at kasideliveries00@gmail.com.

Third-Party Payment Processors

We use Paystack to process card payments. When you choose to pay by card, you are redirected to Paystack's secure checkout page. We do not store your full card details on our servers. Paystack shares transaction references and status with us so we can confirm your payment.

Driver Identity Documents

Drivers are required to upload an Identity Document (ID) and Vehicle License to be verified on our platform. These documents are stored securely on Cloudflare R2 and are only accessible to authorised Kasi Deliveries administrators for the purpose of verification. They are not shared with customers.

Pickup Orders and Location Data

When you select a "Pickup" order, we do not share your delivery address with a driver (no driver is assigned). The shop sees the order details required to prepare your food, but does not receive your saved delivery address for pickup orders.

Third-Party Payment Processors

We use Paystack to process card payments. When you choose to pay by card, you are redirected to Paystack's secure checkout page. We do not store your full card details on our servers. Paystack shares transaction references and status with us so we can confirm your payment.

Driver Identity Documents

Drivers are required to upload an Identity Document (ID) and Vehicle License to be verified on our platform. These documents are stored securely on Cloudflare R2 and are only accessible to authorised Kasi Deliveries administrators for the purpose of verification. They are not shared with customers.

Pickup Orders and Location Data

When you select a "Pickup" order, we do not share your delivery address with a driver (no driver is assigned). The shop sees the order details required to prepare your food, but does not receive your saved delivery address for pickup orders.