Privacy Policy

1. Introduction

My Sweet Potato (“My Sweet Potato”, “MSP”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information processed through the My Sweet Potato App (“the App”) and the Meal Packs online ordering feature available on our website (“Meal Packs”).

The App is an operational management platform used to support My Sweet Potato’s catering and related business activities, including customer and event management, menu planning, kitchen operations, purchasing, inventory, document management, meal-pack order management, notifications and operational reporting.

Meal Packs is the customer-facing online ordering experience that allows visitors to build weekly meal packs, choose a collection day, provide their contact details and pay online.

The App and Meal Packs are developed and maintained by SM Astute Technologies (SMAT) on behalf of My Sweet Potato.

This Privacy Policy explains what personal information may be collected, why it is collected, how it is used and protected, when it may be shared, and the rights available to individuals whose personal information we process.

We process personal information in accordance with applicable South African data protection legislation, including the Protection of Personal Information Act 4 of 2013 (“POPIA”).

2. Scope: App & Meal Packs

This Policy covers two related experiences operated by My Sweet Potato:

• My Sweet Potato App — used by authorised employees, contractors and operational users to run day-to-day business activities such as event, kitchen, inventory and order management.
• Meal Packs online ordering — a public-facing feature on mysweetpotato.co.za/meal-packs that allows customers to select meals, provide contact and collection details, and complete payment through our approved payment provider.

Where a section applies only to one of these experiences, this is called out. Otherwise the section applies to both.

3. Information We Collect

The information collected depends on how the App or Meal Packs is used and the features available to a particular user.

User Account Information (App)

For authorised employees, contractors and operational users of the App, we may process:

• Name and surname.
• Email address.
• User account identifier.
• Organisation or tenant information.
• Assigned role and permissions.
• Authentication information provided through our identity provider.
• Login and account activity.
• Actions performed within the App.

Passwords and authentication credentials may be managed by Microsoft or another authorised identity provider rather than being stored directly by the App.

Customer and Contact Information

When managing customers, leads, events or orders, we may process:

• Customer name.
• Email address.
• Telephone or mobile number.
• Company or organisation name.
• Contact person details.
• Delivery or collection-related information.
• Customer notes.
• Communication preferences.

Event Information (App)

The App may store information required to manage catering events, including:

• Event name, date, setup and serving times.
• Event location and guest count.
• Customer requirements, menu information and notes.
• Special instructions.
• Dietary or allergen-related requirements supplied to My Sweet Potato.

Some dietary or allergy information may constitute sensitive or special personal information. This information is processed only where reasonably necessary to fulfil the relevant catering service or request.

Meal Packs Order Information

When you place a Meal Packs order on our website, we collect and process:

• Full name.
• Email address.
• Contact number.
• Selected meals and quantities.
• Collection date.
• Order notes and any special instructions you provide.
• Order reference and order amount.
• VAT and payment-related information (see Payments).
• Payment status and confirmation information.

We do not store complete payment card numbers, CVV numbers or online banking credentials. Card and payment details are captured and processed directly by our authorised third-party payment provider (see Payments (Yoco)).

Operational Information (App)

The App may record operational activities including:

• Kitchen preparation actions and menu preparation status.
• Packing and equipment information.
• Stock requirements, purchasing records and supplier information.
• Equipment check-out and check-in, and missing or damaged equipment reports.
• Cleaning and operational checklist completion, staff sign-offs.
• Task completion dates and times, notes and exceptions.
• Supervisor approvals and audit or activity records.

Documents and Files (App)

Users may upload or access documents associated with business operations, such as quotes, invoices, receipts, event documents, setup diagrams, supporting documents and photos used as operational evidence.

Uploaded files may contain personal information. Users should only upload information that is reasonably necessary for legitimate business purposes.

Device and Technical Information

For application operation, diagnostics and security, we may process limited technical information such as:

• Device type, operating system and App or browser version.
• Authentication session information.
• Error and diagnostic information.
• Network or connection information.
• Notification identifiers or tokens (App).
• Date and time of system activity.

The App does not intentionally collect persistent device identifiers such as IMEI or SIM serial numbers for advertising or user profiling purposes.

4. How We Use Personal Information

We use personal information where reasonably necessary to:

• Provide and operate the App and Meal Packs.
• Authenticate authorised users and manage roles and permissions (App).
• Manage customers, leads and enquiries.
• Prepare and manage menus and coordinate kitchen preparation and food dispatch.
• Manage table setups, packing and equipment returns.
• Manage stock requirements and purchasing.
• Process and manage Meal Packs orders and provide order and operational notifications.
• Create and maintain business documents.
• Maintain operational and audit records.
• Improve reliability and troubleshoot technical problems.
• Protect the App, Meal Packs and our website against unauthorised access, misuse or fraud.
• Comply with accounting, tax, regulatory or legal obligations.
• Respond to enquiries, complaints or requests.
• Maintain appropriate business records.

We do not sell personal information.

We do not use personal information collected through the App or Meal Packs for unrelated behavioural advertising.

5. Legal Basis for Processing

Where POPIA applies, personal information may be processed where:

• The individual has consented to the processing.
• Processing is necessary to perform a contract or provide a requested service (for example, fulfilling a Meal Packs order).
• Processing is necessary to comply with a legal obligation.
• Processing protects a legitimate interest of the individual.
• Processing is necessary for My Sweet Potato to pursue a legitimate business interest, provided that the individual’s rights and interests are appropriately protected.
• Another lawful basis recognised by POPIA applies.

Where consent is relied upon, consent may be withdrawn, subject to applicable legal and contractual requirements.

6. How We Share Information

Personal information may be disclosed to authorised persons and service providers where necessary to operate the App or Meal Packs, or to provide My Sweet Potato’s services.

My Sweet Potato Personnel

Information may be accessible to authorised employees or contractors based on their assigned responsibilities and system roles. Access is restricted according to role wherever practical.

SM Astute Technologies

SM Astute Technologies may access information where reasonably necessary to develop, maintain, secure or support the App, Meal Packs and our website on behalf of My Sweet Potato.

Microsoft Services

The App uses Microsoft technologies and cloud services that may include:

• Microsoft Azure.
• Microsoft Entra ID.
• Microsoft 365.
• SharePoint.
• Azure SignalR Service.
• Azure notification services.

These services may process information required for authentication, hosting, document storage, notifications, application operation and security.

Payment Providers

Where online payments are supported (including Meal Packs), payment information is submitted to our payment service provider, Yoco. See Payments (Yoco) below.

Messaging and Communication Providers

Where the App or Meal Packs sends confirmations or other permitted communications, contact information and message content may be processed through:

• Email service providers.
• WhatsApp or Meta services.
• Other approved communications providers.

Accounting Services

If accounting integration is enabled, relevant customer, quote, invoice or transaction information may be transmitted to the accounting service used by My Sweet Potato.

Legal and Regulatory Disclosures

Information may also be disclosed where reasonably necessary to:

• Comply with applicable law.
• Respond to lawful requests from regulators or authorities.
• Enforce agreements.
• Protect the rights, property or safety of My Sweet Potato, users, customers or others.
• Investigate suspected fraud, misuse or security incidents.

Third-party service providers are only provided with information reasonably necessary for the relevant service.

7. Payments (Yoco)

Payments for Meal Packs orders are processed by Yoco, an authorised third-party payment service provider. When you pay for a Meal Packs order:

• You are redirected to, or interact with, a secure Yoco payment interface.
• Your card number, CVV and other sensitive payment credentials are submitted directly to Yoco and are not stored on our servers.
• We receive a payment status (for example, successful or failed), a transaction reference and limited metadata required to reconcile your order.
• Yoco processes payment information according to its own privacy policy and applicable regulations.

For details on how Yoco handles your data, please refer to Yoco’s own privacy policy.

8. International Processing and Transfers

Some technology and cloud service providers used by the App, Meal Packs or our website may operate infrastructure or process information outside South Africa.

Where personal information is transferred internationally, My Sweet Potato will take reasonable measures to ensure that the transfer complies with applicable data protection requirements and that appropriate safeguards are in place.

9. Security

We take reasonable technical and organisational precautions to protect personal information against loss, unauthorised access, unlawful processing, destruction, modification and disclosure.

Measures used may include:

• Encrypted network communications and secure HTTPS connections.
• Authentication through recognised identity providers.
• Role-based access controls and restricted document access.
• Cloud security controls.
• Logging and audit records.
• Access control to production systems.
• Security monitoring.
• Appropriate backup and recovery processes.

No electronic system can guarantee absolute security. We continually review and improve security controls based on the nature of the information being processed and reasonably foreseeable risks.

10. Data Retention

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected or as required by applicable law.

Retention periods may depend on:

• The duration of a customer relationship.
• Operational requirements.
• Accounting and tax requirements.
• Contractual obligations.
• Legal or regulatory requirements.
• Dispute-resolution requirements.
• Legitimate requirements to maintain business and audit records.

When personal information is no longer required, it will be deleted, destroyed, anonymised or otherwise handled in accordance with applicable law and our retention procedures.

Certain records may need to be retained even after a deletion request where My Sweet Potato has a legal obligation or other lawful reason to retain them.

11. Account and Data Deletion

Operational user accounts on the App are generally provisioned for authorised My Sweet Potato personnel or approved users and are not intended to function as public consumer accounts.

Meal Packs orders do not require you to create a public consumer account; only the information you provide at checkout is stored with your order.

Users or customers who wish to have information deleted may submit a request using the contact details below. Where a valid deletion request is received, personal information will be deleted where My Sweet Potato is legally permitted and reasonably able to do so.

Information that must be retained for legal, financial, security, contractual or legitimate record-keeping purposes may be retained for the required period.

12. Your Privacy Rights

Subject to POPIA and other applicable legislation, individuals may have the right to:

• Ask whether we hold personal information about them.
• Request access to personal information we hold.
• Request correction of inaccurate or incomplete information.
• Request deletion or destruction of information where legally permitted.
• Object to certain processing of personal information.
• Withdraw consent where processing is based on consent.
• Request restriction of certain processing where applicable.
• Submit a complaint regarding the processing of personal information.

We may need to verify the identity of a person submitting a request before acting on it.

13. Children

The My Sweet Potato App is designed for business and operational use and Meal Packs online ordering is intended for adults purchasing on their own behalf. Both are not directed at children.

We do not knowingly create App accounts for children or intentionally collect personal information directly from children.

Where information relating to a child is supplied as part of a legitimate customer or catering requirement, it will only be processed where reasonably necessary and in accordance with applicable law.

14. Notifications

Authorised App users may receive notifications relating to App operations, including event updates, task reminders, order updates, operational exceptions, equipment or stock activity, kitchen workflow notifications and other business-related alerts.

Meal Packs customers may receive transactional communications (such as order confirmations or collection reminders) relating to their orders.

Device notification tokens may be processed for the purpose of delivering App notifications. You may be able to control notification permissions through your device settings, although disabling notifications may affect certain functionality.

15. Cookies and Advertising

The mobile App does not use personal information for third-party behavioural advertising.

Our website and Meal Packs online ordering may use limited cookies or similar technologies for authentication, security, session management, essential website functionality and to keep your in-progress order available while you complete checkout. We do not use these for third-party behavioural advertising.

16. Automated Decision-Making

The App and Meal Packs are primarily intended to support human operational processes.

If automated or artificial-intelligence functionality is introduced that materially affects how personal information is processed or how decisions about individuals are made, this Privacy Policy and any required notices will be updated accordingly.

17. Third-Party Services

Third-party platforms used by the App, Meal Packs or our website may have their own privacy policies and terms.

My Sweet Potato and SM Astute Technologies do not control the independent privacy practices of third-party services. Users should review the privacy policies of relevant providers where appropriate.

18. Changes to This Privacy Policy

We may update this Privacy Policy when:

• App or Meal Packs functionality changes.
• New services or integrations are introduced.
• Our data-processing practices change.
• Legal or regulatory requirements change.

The updated Privacy Policy will display a revised “Last updated” date. Material changes may also be communicated through the App, our website or another appropriate communication channel.

19. Contact Us

Questions, concerns, privacy requests or requests relating to access, correction or deletion of personal information may be sent to: