Privacy Policy

1. Introduction

This Privacy Policy explains how Fresoh (Pty) Ltd ("Fresoh", "we", "us" or "our") collects, uses, discloses, stores and protects personal information of Merchants and Customers (together, "Users", "you") who access or use the Fresoh website, mobile application and related services (the "Platform"), through which restaurants and food businesses list surplus food for sale and customers browse and purchase that food.

Fresoh is committed to protecting your privacy and processing personal information lawfully, in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where access to records is concerned, the Promotion of Access to Information Act 2 of 2000 ("PAIA"). This Policy should be read together with our Acceptable Use Policy (Terms of Use) and, for Merchants, the Fresoh Merchant Agreement, each of which incorporates this Policy by reference.

By registering for, accessing or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal information as described below, to the extent such consent is required by law.

2. Definitions

3. Information Officer

In accordance with section 55 of POPIA, Fresoh's Information Officer is responsible for ensuring compliance with POPIA and PAIA and for dealing with requests made in terms of those Acts. The Information Officer is registered with the Information Regulator. Contact details are set out in clause 17 (Contact Us) below.

4. Personal Information We Collect

4.1 Information collected from Merchants

When a Merchant registers and operates on the Platform, we collect:

• Business and trading name;
• Business registration number and registration documents (e.g. CIPC registration, company or close corporation details);
• Physical business address(es) and, where applicable, delivery/collection address for listed food;
• VAT registration number, where applicable;
• Contact person's full name, role, cellphone number and email address;
• Banking details necessary to receive payments, including account holder name, bank name, branch code and account number;
• Food listing content, including descriptions, quantities, prices and images of surplus food;
• Records of orders fulfilled, ratings, reviews and any communications with Customers or Fresoh support;
• Any food safety, hygiene or municipal health certification information the Merchant chooses to submit or that we are required to verify.

4.2 Information collected from Customers

When a Customer registers and uses the Platform to purchase surplus food, we collect:

• Full name;
• Cellphone number and/or email address (at least one of which is required to create an account);
• Delivery or collection address, where relevant to an order;
• Debit or credit card details, processed via our payment service provider, for payment of orders;
• Order history, preferences and, where voluntarily provided, ratings and reviews;
• Device information and push notification tokens used to deliver order and account notifications through the mobile application;
• Records of correspondence with Fresoh support.

4.3 Information collected automatically

When you use the Platform, we automatically collect limited technical information, including device type, operating system, IP address, app version, general location (where permitted), and usage data collected through cookies and similar technologies as described in clause 12.

5. Purpose of Collection and Processing

We collect and process personal information for the following purposes:

5.1 To create and administer Merchant and Customer accounts on the Platform;

5.2 To verify Merchant identity, business registration status and eligibility to list and sell food on the Platform;

5.3 To facilitate, process and settle payments, including transferring funds owed to Merchants and processing Customer card payments through our payment service providers;

5.4 To enable Customers to browse, order and pay for surplus food, and to enable Merchants to fulfil those orders;

5.5 To send transactional and operational push notifications, SMS and email communications (e.g. order confirmations, status updates, collection reminders, account and security notices);

5.6 To provide customer support and respond to queries, complaints or disputes;

5.7 To detect, prevent and investigate fraud, abuse, security incidents and violations of our Acceptable Use Policy or Merchant Agreement;

5.8 To comply with applicable legal, tax, accounting and regulatory obligations, including obligations under the Consumer Protection Act 68 of 2008, the Financial Intelligence Centre Act 38 of 2001 (where applicable to payment processing), and municipal food safety regulation;

5.9 To analyse usage of the Platform in order to improve our services, subject to anonymisation or aggregation where practicable;

5.10 With separate consent, to send Users direct marketing communications regarding Fresoh promotions, new Merchants, or special offers.

6. Legal Basis for Processing

In accordance with section 11 of POPIA, we only process personal information where at least one of the following applies:

• You have consented to the processing;
• Processing is necessary to carry out actions for the conclusion or performance of a contract to which you are a party (for example, fulfilling an order or paying a Merchant);
• Processing is required to comply with an obligation imposed by law;
• Processing protects a legitimate interest of yours;
• Processing is necessary for pursuing Fresoh's legitimate interests, or those of a third party to whom the information is supplied, provided that this does not override your interests or fundamental rights.

7. Special Personal Information

Fresoh does not intentionally collect Special Personal Information (as defined in section 26 of POPIA) from Users. Where a Merchant's food listings, imagery or descriptions incidentally reveal information such as religious dietary practices (e.g. halaal or kosher certification), such information is processed only to the extent necessary to accurately describe the food offering, and Merchants warrant that they are authorised to disclose it.

8. Direct Marketing and Push Notifications

8.1 Operational notifications. Fresoh will send push notifications, SMS messages and emails that are necessary for the operation of the Platform and your use of it, including order confirmations, ready-for-collection alerts, payment confirmations, and security notices. These are not direct marketing and cannot be opted out of while you retain an active account, save that push notifications may be disabled in your device settings.

8.2 Direct marketing. In accordance with section 69 of POPIA, Fresoh will only send direct marketing communications (such as promotional offers, new Merchant announcements or discount codes) by electronic communication, including push notification, SMS or email, where you have opted in, or where you are an existing customer and Fresoh is marketing similar products or services and you were given a reasonable opportunity to object at the time your details were collected and on each subsequent communication.

8.3 Opt-out. You may opt out of direct marketing communications and non-essential push notifications at any time, free of charge, through the Platform's notification settings, by using the "unsubscribe" link in emails, or by contacting us using the details in clause 17.

9. How We Collect Personal Information

In accordance with section 12 of POPIA, we collect personal information directly from you wherever reasonably possible, for example when you register an account, submit a food listing, place an order, or contact support. We may collect information from a third party (for example, our payment service provider or an identity/business verification service) where you have consented, where the information is publicly available, or where collection from another source will not prejudice your legitimate interests.

10. Sharing and Disclosure of Personal Information

We do not sell personal information. We may share personal information with the following categories of recipients, only to the extent necessary for the purposes described in clause 5:

• Between Merchants and Customers: to fulfil an order, a Customer's name, order details and, where relevant to collection, contact number may be shared with the Merchant, and the Merchant's business name, address and collection/delivery instructions may be shared with the Customer;
• Payment service providers and acquiring banks, to process debit and credit card payments and to remit funds to Merchant bank accounts;
• Cloud hosting, data storage and IT service providers who process personal information on our behalf as Operators, under written contracts requiring them to maintain confidentiality and security;
• Professional advisors, auditors and regulators, where necessary for legal, tax, or compliance purposes, including the Information Regulator, the South African Revenue Service, or municipal health authorities where legally required;
• Law enforcement or regulatory authorities, where disclosure is required or permitted by law, or necessary to protect the rights, property or safety of Fresoh, Users or the public;
• A prospective purchaser or successor entity, in the event of a merger, acquisition, financing or sale of all or part of Fresoh's business, subject to appropriate confidentiality safeguards.

Any third party that processes personal information on our behalf does so as an Operator under a written agreement that requires it to process the information only for the specified purpose, to maintain confidentiality, and to implement appropriate security safeguards, in accordance with sections 20 and 21 of POPIA.

11. Cross-Border Transfers

Some of our service providers (for example, payment processors or cloud hosting providers) may process personal information outside South Africa. Where this occurs, we will ensure, in accordance with section 72 of POPIA, that the recipient is subject to a law, binding corporate rules or a binding agreement which provides an adequate level of protection that effectively upholds principles for the reasonable processing of personal information substantially similar to POPIA, or that you have consented to the transfer, or that the transfer is necessary for the performance of a contract between you and Fresoh.

12. Cookies and Similar Technologies

The Platform uses cookies, mobile device identifiers and similar technologies to keep you logged in, remember your preferences, understand how the Platform is used, and support push notification delivery. You can control cookies through your browser settings and manage push notification permissions through your device settings; disabling certain technologies may limit functionality of the Platform.

13. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law (including tax, accounting and consumer protection record-keeping requirements). Order and payment records are generally retained for the periods required by South African tax and financial record-keeping legislation. Where personal information is no longer required, we will delete, destroy or de-identify it in accordance with section 14 of POPIA, save where retention is required by law or for the establishment, exercise or defence of legal claims.

14. Security Safeguards

In accordance with section 19 of POPIA, Fresoh implements appropriate technical and organisational measures to secure the integrity and confidentiality of personal information, including:

• Encryption of payment card data and banking details in transit and at rest, with card data processed by PCI-DSS compliant payment service providers (Fresoh does not store full card numbers on its own systems);
• Access controls limiting personal information access to employees and contractors who need it to perform their functions;
• Regular security testing, monitoring and patching of Platform systems;
• Contractual security obligations imposed on all Operators and third-party service providers.

If a security compromise occurs where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Fresoh will notify the Information Regulator and affected Users as soon as reasonably possible, in accordance with section 22 of POPIA.

15. Your Rights as a Data Subject

Subject to applicable law, you have the right to:

• Be notified that personal information about you is being collected (section 18);
• Establish whether Fresoh holds personal information about you and to request access to it (section 23), including via a formal PAIA request as described in clause 16;
• Request correction, updating, or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information (section 24);
• Object, on reasonable grounds, to the processing of your personal information (section 11(3));
• Object to the processing of your personal information for purposes of direct marketing (section 11(3)(b));
• Withdraw consent to processing, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Not be subject to a decision based solely on automated processing that affects you significantly, without an opportunity to make representations (section 71);
• Lodge a complaint with the Information Regulator regarding the alleged interference with the protection of your personal information (section 74).

To exercise any of these rights, contact us using the details in clause 17. We will respond within the timeframes required by POPIA. We may need to verify your identity before giving effect to a request.

16. Access to Information under PAIA

Fresoh maintains a PAIA manual, as contemplated in section 51 of PAIA, describing the categories of records held by Fresoh and the process for requesting access to them. Users, and members of the public, may request access to records held by Fresoh (including personal information held about themselves) by submitting the prescribed request form to the Information Officer, together with any fee prescribed by the regulations to PAIA. Requests will be processed in accordance with the timeframes and grounds for refusal set out in PAIA. A copy of the Fresoh PAIA manual is available on request or via the Platform.

17. Contact Us

Questions, requests or complaints regarding this Policy or the processing of your personal information can be directed to our Information Officer:

Fresoh (Pty) Ltd, Information Officer

Email: hello@fresoh.co.za

Postal address: 44 Mahlathi Road, Chesterville, Durban, 4091, South Africa

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator:

Information Regulator (South Africa)

Email: complaints.IR@inforegulator.org.za | Website: www.justice.gov.za/inforeg

18. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal or regulatory requirements. We will notify Users of material changes through the Platform or by email/push notification, and will indicate the date the Policy was last updated. Continued use of the Platform after such notice constitutes acceptance of the updated Policy.

19. Relationship to Other Fresoh Agreements

This Policy forms part of, and should be read together with, the Fresoh Acceptable Use Policy (Terms of Use) applicable to all Users, and for Merchants, the Fresoh Merchant Agreement. In the event of any conflict between this Policy and those documents concerning the processing of personal information, this Policy shall prevail.