Privacy Policy

1. Introduction

Lavish Bites ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services in compliance with the Protection of Personal Information Act, 2013 (POPIA).

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Services.

2. Information We Collect

We collect information in the following ways:

2.1 Information You Provide Directly:

• Contact Information: Full name, email address, phone number, delivery address
• Payment Information: Processed securely through Stripe (we do not store credit card details)
• Order Information: Items ordered, quantities, preferences (spice levels, special requests)
• Event Information: For chef-for-hire services, we collect event date, location, guest count, dietary requirements
• Communications: Messages sent via forms or WhatsApp

2.2 Automatically Collected Information:

• Device Information: IP address, browser type, operating system
• Usage Data: Pages visited, time spent on pages, links clicked
• LocalStorage Data: Shopping cart contents stored locally on your device

3. Purpose of Processing

We collect and process your personal information for the following legitimate purposes:

• Order Fulfillment: To prepare, package, and deliver your food orders
• Payment Processing: To securely process payments through Stripe
• Service Delivery: To provide chef-for-hire catering services as requested
• Customer Communication: To respond to inquiries and provide order updates via email or WhatsApp
• Service Improvement: To understand customer preferences and improve our offerings
• Legal Compliance: To comply with South African tax and regulatory requirements

4. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected:

• Order Data: Retained for 3 years for tax and accounting purposes
• Payment Information: Not retained on our servers (processed by Stripe)
• Marketing Communications: Retained until you unsubscribe
• Customer Inquiries: Retained for 2 years after last communication

5. Sharing Your Information

We do not sell, trade, or share your personal information with third parties except:

• Stripe Payment Processor: Your payment information (card details are not stored on our servers)
• Delivery Partners: Your delivery address and contact number (if applicable)
• Legal Requirements: When required by law or to protect our rights

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• SSL/HTTPS encryption for all data transmission
• Secure payment processing through PCI-DSS compliant Stripe
• Regular security assessments and updates
• Limited access to personal information (staff need-to-know basis)
• Shopping cart data stored locally on your device (not on our servers)

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Your POPIA Rights

Under the Protection of Personal Information Act (POPIA), you have the following rights:

• Right of Access: You can request access to the personal information we hold about you
• Right to Rectification: You can request correction of inaccurate information
• Right to Erasure: You can request deletion of your personal information (subject to legal obligations)
• Right to Object: You can object to processing of your data for marketing purposes
• Right to Data Portability: You can request a copy of your data in a portable format

To exercise these rights, please contact us using the information below.

8. Cookies & Local Storage

Shopping Cart: We use browser localStorage to maintain your shopping cart contents. This data is stored on your device only and is not transmitted to our servers until you proceed to checkout.

Analytics (Future): If we implement analytics tools, we will update this policy and obtain your consent as required by POPIA.

9. Children's Privacy

Our Services are not directed to individuals under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete such information and terminate the child's account.

10. Third-Party Links

Our website may contain links to third-party websites. This Privacy Policy applies only to our website. We are not responsible for the privacy practices of other websites. We encourage you to read their privacy policies before providing your personal information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Your continued use of our Services after such modifications constitutes your acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your POPIA rights, please contact us:

• Business Name: Lavish Bites
• Email: info@lavishbites.co.za
• Phone: +27 12 345 6789 (WhatsApp available)
• Address: Pretoria, South Africa
• Data Protection Officer: info@lavishbites.co.za

We will respond to privacy inquiries within 20 business days as required by POPIA.