Privacy notice

Who we are

Estate Pantry is run by [Operator name], [Operator address] ("we"). Our information officer is [Information officer name], reachable at [Contact email].

What we collect and why

• Your name, email and mobile number — to run your account, sign you in, and contact you about your orders. Support may WhatsApp you on this number, for example to send a temporary password.
• Your estate, house number, collection point and any directions — so the right bag reaches the right person at the right place.
• Your orders and subscriptions — what you ordered, for which days, what you paid and whether you collected. We need this to bake, pack, charge and hand over your order, and for our accounts.
• Your card — card details go straight to our payment provider, [Payment provider]. We keep only the reference they give us, the card type and the last four digits, so we can charge you each week.
• A sign-in cookie — keeps you signed in on your phone. We don't use advertising or tracking cookies. Our pages load fonts from Google Fonts, which sees your device's internet address.

Who sees what

• The bakery (for this pilot, Glenwood Bakery): your name, house number and what you ordered for each bake day.
• The collection point (for this pilot, Bushbuck Club): your name, house number and bag mark — your bag number, first name, the point's code and the day — so staff hand over the right bag.
• Other residents: when the collection point posts "bags are ready" in the estate's residents' WhatsApp group, the message names no one. Anyone at the counter may see a bag's mark.
• Our support team: your account and order details, to help when something goes wrong.
• Our payment provider: your card details and the charges we make.

We don't sell your information or share it for anyone else's marketing.

Where it's kept

On servers run by [Hosting provider and country]. [If outside South Africa: the safeguards that apply, per POPIA section 72.] Access is limited to the people listed above, and passwords are stored scrambled (hashed), never as text.

How long we keep it

• Account details: until you delete your account.
• Saved cards: removed when you delete your account.
• Order and payment records: [five years], as tax and accounting law requires. Once you delete your account they're kept without your name, mobile or house number.

Your rights

Under POPIA you can:

• See what we hold about you — ask us for a copy.
• Correct it — change your address in My account, or ask us to fix anything else.
• Delete it — use "Delete my account" in My account. We stop your subscriptions, remove your cards and erase your name, mobile and house number; past orders stay without your details.
• Object to how we use it — for example, to your first name being written on your bag.

Contact us at [Contact email]. If you're not happy with our answer, you can complain to the Information Regulator: inforegulator.org.za.

Changes

If we change this notice in a way that matters, we'll tell you in the app. See also our Terms.

Version 2026-10-draft