Cookie policy
How The Kitchen Mafia ordering portal uses cookies and similar storage (South Africa — POPIA, and GDPR-style choice).
Your choice
On your first visit we ask how to use optional cookies. Necessary cookies are always on — the site cannot sign you in or stay secure without them. Optional categories stay off until you accept them. We store that choice in a first-party cookie named tkm_consent for 12 months (SameSite=Lax; Secure on HTTPS). If we change this policy, the cookie version changes and we ask again.
Re-open the panel any time with Cookie settings in the footer, or from the banner on a first visit.
Categories
Strictly necessary (always on)
Required to sign in, keep the site secure, remember your theme, and save what you are doing on a page. These are always on.
Analytics (optional)
Optional measurement scripts (for example Google Analytics). None are loaded today. If any are added later, they stay off until you accept this category.
Embedded media (optional)
Training videos hosted on Loom or YouTube. Those sites may set their own cookies. Embeds load only after you accept this category.
What this site sets
Strictly necessary
- tkm_session — PHP session cookie. Keeps you signed in and holds the CSRF token used to protect forms. HttpOnly; Secure on HTTPS; SameSite=Lax. Session length, or 30 days if you tick “Stay signed in”.
- tkm_consent — remembers Accept all / Reject optional / your toggles, with a policy version.
- localStorage
tkm-theme— light or dark theme you chose. - localStorage / sessionStorage for the page you are on — meal tab, region, weekend-menu toggle, and in-progress order or payment drafts so a refresh does not lose your work.
- PWA service worker — caches app files so the portal can load again. Not an advertising tracker.
The CSRF token is stored in the session, not as its own browser cookie. Card payments open Yoco’s hosted checkout only when you choose to pay — that is a payment page you start, not a script we load in the background.
Optional / gated
- Analytics scripts — none are included in the portal today (no Google Analytics, chat widgets, or advertising pixels). If any are added later they must use
type="text/plain" data-consent="analytics"and will not run until you accept Analytics. - Embedded media — training videos can load Loom or YouTube iframes. Those third parties may set their own cookies. The iframe is not created until you accept Embedded media.
This site does not load Google Fonts, maps, or chat widgets.
Privacy
For POPIA roles, what we collect, and how to request access or correction, see the Privacy / POPIA page.
This page describes cookies on the ordering portal. It does not replace The Kitchen Mafia’s terms or the privacy summary.
← Back to sign in Privacy / POPIA Cookie policy Tian Vortsman