Privacy & data protection
How personal information is handled on The Kitchen Mafia ordering portal (South Africa — POPIA), and who is responsible for what.
Who is responsible?
The Kitchen Mafia — Responsible Party
The Kitchen Mafia decides why personal information is collected and how the catering and ordering service is used. They are responsible for privacy requests from individuals, their contracts with client companies, meal fulfilment, and allergy / food-safety processes.
Privacy contact: info@thekitchenmafia.co.za
Tian Vortsman — Developer & hosting (Operator)
Tian Vortsman builds and hosts the portal on The Kitchen Mafia’s instructions. Personal information is processed only as needed to develop, host, maintain, back up, and support the system — not as ownership of The Kitchen Mafia’s business or customer relationships.
Portfolio: tian.vortsman.com
Your employer / client company
Your company (or its administrators) decide who is invited onto the portal. Workplace and catering arrangements remain between your organisation and The Kitchen Mafia.
Access by role
Employees
- See and manage their own profile, orders, and allergy / dietary details
- Cannot see other companies’ employee lists
Company administrators
- Manage employees, guests, and orders for their own company only
- Cannot access another organisation’s data through normal portal use
The Kitchen Mafia administrators
- Access client and order data as needed to operate, support, and fulfil the catering service
Developer / host (Tian Vortsman)
- May access systems and data only as reasonably required for hosting, maintenance, deployments, backups, and incident support
- Does not sell personal information or use it for unrelated marketing
What we collect
Only what is needed to run meal ordering and fulfilment:
- Name, email and/or username, phone number if provided
- Company and workplace details, building, floor, delivery notes
- Account role and a one-way hashed password (the password itself is never stored in readable form)
- Order and cancellation history
- Allergy or dietary information you or your company administrator provide
We do not collect ID numbers, bank cards, payroll, medical certificates, or HR files through this portal.
Allergy and dietary information (sensitive / special personal information)
Under POPIA, health-related information is special personal information. Allergy and dietary details are collected only so meals can be prepared and labelled with appropriate care. They may appear on kitchen documents, stickers, and operational emails used by people who cook or pack food. They are not sold, not used for marketing, and not shared with other client companies.
You confirm your selections on first login after accepting the portal terms. Keep them accurate. For a severe allergy, also email your manager and copy info@kitchenmafia.co.za. If an allergen is not in the list, email your company’s lunch administrator and copy that same address. The Kitchen Mafia does not claim an allergen-free kitchen; cross-contamination risk is disclosed in the terms.
Why it is used
- To create accounts, send invites, and reset passwords
- To take, prepare, label, and deliver meal orders safely
- To send service notices (for example when ordering is open)
- To support invoicing, reporting, and dispute resolution for your organisation
How data is kept safe
- Login is required; passwords are stored with one-way hashing (they cannot be read back as plain text)
- Access is role-based and companies are separated as described above
- The live portal is used over HTTPS (encrypted in transit)
- Session cookies are marked HttpOnly and, on HTTPS, Secure
- Forms and APIs that change data use CSRF protection; login and reset attempts are rate-limited
- Invite and password-reset links expire and are stored as hashes, not reusable secrets in the database
- Application secrets and the database are not exposed as public website files; the database is not opened to the public internet in normal operation
- Personal information is not sold or shared for unrelated marketing
Corporate customers who need a longer vendor-assessment document should ask The Kitchen Mafia for the Security & Privacy Trust Pack. We do not give production server or database access to customer IT teams — that would put every other client’s staff data at risk.
Emails
Email may be used for invitations, password resets, and service-related messages. You can unsubscribe from non-essential notices (such as ordering reminders). Essential account or security emails may still be sent when required to provide the service.
How long we keep information
We keep personal information while your organisation uses the service and you are an authorised user. When access ends, login is disabled or removed. Order records may be kept for a limited period for accounting, invoicing, and disputes. Backups are restricted and rotate; they are not used as a second staff directory.
Your POPIA rights
Where the Protection of Personal Information Act 4 of 2013 applies, you may request access to, or correction of, personal information held about you, and enquire about objection, deletion, or restriction, subject to legal and operational requirements (for example retaining order records for accounting).
The fastest correction path for allergies and orders is to log in and update them. Formal requests: email info@kitchenmafia.co.za. We may need to verify it is you before we release or change records.
Please send privacy requests to The Kitchen Mafia, not to the developer, unless The Kitchen Mafia asks him to assist technically.
Contact
Privacy / catering service (Responsible Party):
The Kitchen Mafia · info@kitchenmafia.co.za
Terms: kitchenmafia.co.za/terms-conditions
Technical development & hosting (Operator):
Tian Vortsman · tian.vortsman.com
This page is a plain-language summary for portal users. It does not replace The Kitchen Mafia’s terms, create a direct contract with the developer, or change who the Responsible Party is under POPIA.