Privacy policy

1. Who we are

PantrySpree runs the PantrySpree app, the Spree Delivery app and pantryspree.co.za, and is the responsible party for your personal information under POPIA. In this policy, "we", "us" and "our" mean PantrySpree.

2. What this policy covers

This policy covers the PantrySpree app, the Spree Delivery app and pantryspree.co.za. It applies to customers, shoppers and website visitors.

3. What we collect from customers

• Account details: your name, email address and South African mobile number.
• Addresses: your delivery addresses, with unit, building, complex and gate code if you add them, and your delivery notes.
• Orders: what you order, the replacements you approve, and your order history.
• Payments: whether a payment went through and its amount. PayFast handles your card details; we never see or store them.
• Chat: messages and photos you send your shopper in the order chat.
• Location: your phone's location, only while you use the app and only if you allow it, to find stores that deliver to you.
• Support: what you tell us when you report a problem.
• App data: your device type, app version and crash reports, so we can fix bugs.

4. What we collect from shoppers

Everything in section 3 that applies to you, plus:

• Identity: your ID number, date of birth, and a copy of your ID, green ID book, passport, asylum seeker permit or refugee permit.
• Driving: your driver's licence, and your vehicle's make, model, year, colour and registration number.
• Proof of residence.
• Criminal record check: the result of a background check you agree to.
• Bank details: your bank, account holder name, account type, branch code and account number.
• Emergency contact: their name, phone number and relationship to you, and any medical notes you choose to add.
• Location: while you use the app, to show you nearby orders and guide you; and while you are on your way to a customer, shared every few seconds so they can follow their order.
• Photos: receipts, items and documents you photograph in the app.
• Work records: the orders you do, your earnings, tips and payouts.

5. Special personal information

POPIA gives extra protection to some kinds of information. We collect two of them, from shoppers only:

• Criminal record checks, to keep customers safe when shoppers come to their homes.
• Medical notes for your emergency contact, only if you choose to add them, so help can be given if something happens to you on the road.

We process these only with your consent or where the law allows it, and only the team members who need them can see them.

6. Our website

Our website doesn't use tracking cookies. We use Cloudflare Web Analytics to count visits and see which pages people read. It works without cookies and doesn't identify you.

7. How we use it

• to create and run your account;
• to take, pick and deliver your orders, and show you their progress;
• to take payments, settle the final total and make refunds;
• to check, approve and pay shoppers;
• to help you when something goes wrong;
• to keep customers and shoppers safe and to prevent fraud;
• to fix bugs and improve our apps;
• to meet our legal duties, such as keeping tax records.

8. Why we're allowed to

We process personal information only when POPIA allows it:

• to carry out our agreement with you, for example delivering your order or paying you;
• to comply with the law;
• for our legitimate interests, such as preventing fraud, as long as they don't override your rights;
• with your consent, for example location and camera access and special personal information. You can withdraw consent at any time.

9. Who we share it with

Between customers and shoppers. Your shopper sees your first name, your delivery address with any unit, building, complex and gate code, your delivery notes, your order and your chat. You see your shopper's first name, your chat, and their location while they are on their way to you. Neither of you sees the other's phone number.

Service providers who work for us and may only use your information to do that work:

• PayFast, for payments and refunds;
• Google Maps Platform, to find addresses and plan routes;
• Resend, to send emails such as sign-in codes;
• Cloudflare, to store files such as chat photos and shopper documents, and to run our website;
• Sentry, to collect crash reports from our apps.

Our team. Support and operations staff see what they need to help you, including phone numbers.

Authorities, when the law requires us to.

We never sell your personal information.

10. Information sent outside South Africa

Some of our service providers process information outside South Africa: Sentry stores crash reports in the European Union, and Google, Cloudflare and Resend may process information in other countries. We only use providers that are bound by laws or agreements that protect your information at least as well as POPIA does.

11. Keeping it safe

• Information sent between our apps and our servers is encrypted.
• Chat messages and bank account numbers are stored encrypted.
• Shopper documents are stored privately, and links to view them expire after 15 minutes.
• Access to shopper documents and special personal information is limited to the team members who need it.

If a breach puts your information at risk, we'll tell you and the Information Regulator as POPIA requires.

12. How long we keep it

• Account details, addresses and chat: while your account is open.
• Orders and payment records: five years, as South African tax law requires.
• A basket you leave untouched: 14 days.
• Sign-in codes: 10 minutes.
• Documents from a shopper application we decline: deleted when we decline it.

13. Your rights

Under POPIA you can:

• ask what personal information we hold about you;
• ask us to correct it or delete it;
• object to how we use it;
• withdraw consent you've given;
• complain to the Information Regulator at inforegulator.org.za.

14. Deleting your account

You can delete your account at any time in the app: open Account and tap Delete account.

• Customers: we remove your name, email address, phone number, saved addresses and basket, and sign you out on every phone. We keep your past orders, without your contact details, only as long as the law requires.
• Shoppers: you can delete your account once you have no delivery under way and all your earnings have been paid out. We remove your contact details, vehicle, bank details and emergency contact. We keep your identity records and your work records as the law requires.

15. Children

PantrySpree is for people aged 18 and older. We don't knowingly collect personal information from children.

16. Marketing

We don't send marketing messages. If we start, we'll ask you first, and every message will tell you how to stop. Messages about your orders and your account aren't marketing.

17. Changes to this policy

We may update this policy. If a change matters, we'll tell you in the app or by email before it applies. The date at the top shows when it last changed.