Privacy & data protection
How personal information is handled on The Kitchen Mafia ordering portal (South Africa — POPIA), and who is responsible for what.
Who is responsible?
The Kitchen Mafia — Responsible Party
The Kitchen Mafia decides why personal information is collected and how the catering and ordering service is used. They are responsible for privacy requests from individuals, their contracts with client companies, meal fulfilment, and allergy / food-safety processes.
Privacy contact: info@thekitchenmafia.co.za
Tian Vortsman — Developer & hosting (Operator)
Tian Vortsman builds and hosts the portal on The Kitchen Mafia’s instructions. Personal information is processed only as needed to develop, host, maintain, back up, and support the system — not as ownership of The Kitchen Mafia’s business or customer relationships.
Portfolio: tian.vortsman.com
Your employer / client company
Your company (or its administrators) decide who is invited onto the portal. Workplace and catering arrangements remain between your organisation and The Kitchen Mafia.
Access by role
Employees
- See and manage their own profile, orders, and allergy / dietary details
- Cannot see other companies’ employee lists
Company administrators
- Manage employees, guests, and orders for their own company only
- Cannot access another organisation’s data through normal portal use
The Kitchen Mafia administrators
- Access client and order data as needed to operate, support, and fulfil the catering service
Developer / host (Tian Vortsman)
- May access systems and data only as reasonably required for hosting, maintenance, deployments, backups, and incident support
- Does not sell personal information or use it for unrelated marketing
What we collect
Only what is needed to run meal ordering and fulfilment:
- Name, email and/or username, phone number if provided
- Company and workplace details, building, floor, delivery notes
- Account role and a one-way hashed password (the password itself is never stored in readable form)
- Order and cancellation history
- Allergy or dietary information you or your company administrator provide
- When you pay your share of a meal by card: the amount, the VAT, a payment reference, and a receipt. The card number stays with the card processor and is not stored here
We do not collect ID numbers, payroll, medical certificates, or HR files through this portal. We do not store bank card numbers. Card payments are taken by Yoco. The Kitchen Mafia keeps the amount paid, the VAT, the Yoco reference, and a receipt. A tax invoice is created in Xero and is fetched from Xero when you download it. It is not stored as a second copy in this portal.
Card payments, VAT, and tax invoices
Meal prices in the portal are excluding VAT. Your company is invoiced for the share it pays. When you pay your own share, 15% VAT is added to the card amount. Meal credit, when you have it, is applied to the amount excluding VAT before that VAT is calculated.
- Card details are handled by Yoco. The Kitchen Mafia does not store the card number.
- Your name, email, company, and the invoice are sent to Xero so a tax invoice can be issued. If your account has no email address, that invoice is sent to a company administrator, and a password reset is sent there as well, until you add your own email.
- You can download the tax invoice and the receipt from payment history. You can turn off emailed invoices in your profile. The receipt is kept by The Kitchen Mafia. The invoice PDF is retrieved from Xero when you ask for it.
- A refund of a card payment goes back to the card, up to the amount that was paid by card. Anything above that goes to meal credit. A refund of a card payment is credited against the tax invoice.
This page describes what the portal does. It is not legal advice, and it does not replace the terms at thekitchenmafia.co.za/terms-conditions.
Allergy and dietary information (sensitive / special personal information)
Under POPIA, health-related information is special personal information. Allergy and dietary details are collected only so meals can be prepared and labelled with appropriate care. They may appear on kitchen documents, stickers, and operational emails used by people who cook or pack food. They are not sold, not used for marketing, and not shared with other client companies.
You confirm your selections on first login after accepting the portal terms. Keep them accurate. For a severe allergy, also email your manager and copy info@kitchenmafia.co.za. If an allergen is not in the list, email your company’s lunch administrator and copy that same address. The Kitchen Mafia does not claim an allergen-free kitchen; cross-contamination risk is disclosed in the terms.
Why it is used
- To create accounts, send invites, and reset passwords
- To take, prepare, label, and deliver meal orders safely
- To send service notices (for example when ordering is open)
- To support invoicing, reporting, and dispute resolution for your organisation
- To charge an employee’s share by card, add VAT, issue a tax invoice, and keep a receipt
How data is kept safe
- Login is required; passwords are stored with one-way hashing (they cannot be read back as plain text)
- Access is role-based and companies are separated as described above
- The live portal is used over HTTPS (encrypted in transit)
- Session cookies are marked HttpOnly and, on HTTPS, Secure
- Forms and APIs that change data use CSRF protection; login and reset attempts are rate-limited
- Invite and password-reset links expire and are stored as hashes, not reusable secrets in the database
- Application secrets and the database are not exposed as public website files; the database is not opened to the public internet in normal operation
- Personal information is not sold or shared for unrelated marketing
Corporate customers who need a longer vendor-assessment document should ask The Kitchen Mafia for the Security & Privacy Trust Pack. We do not give production server or database access to customer IT teams — that would put every other client’s staff data at risk.
Cookies
The portal uses a first-party session cookie to keep you signed in, and a first-party consent cookie (tkm_consent) to remember your cookie choice for 12 months. Optional analytics scripts and embedded Loom / YouTube videos stay off until you accept them. Change your choice any time with Cookie settings in the footer. Full list: Cookie policy.
Emails
Email may be used for invitations, password resets, and service-related messages. You can unsubscribe from non-essential notices (such as ordering reminders). Essential account or security emails may still be sent when required to provide the service.
How long we keep information
We keep personal information while your organisation uses the service and you are an authorised user. When access ends, login is disabled or removed. Order records may be kept for a limited period for accounting, invoicing, and disputes. Backups are restricted and rotate; they are not used as a second staff directory.
Your POPIA rights
Where the Protection of Personal Information Act 4 of 2013 applies, you may request access to, or correction of, personal information held about you, and enquire about objection, deletion, or restriction, subject to legal and operational requirements (for example retaining order records for accounting).
The fastest correction path for allergies and orders is to log in and update them. Formal requests: email info@kitchenmafia.co.za. We may need to verify it is you before we release or change records.
Please send privacy requests to The Kitchen Mafia, not to the developer, unless The Kitchen Mafia asks him to assist technically.
Contact
Privacy / catering service (Responsible Party):
The Kitchen Mafia · info@kitchenmafia.co.za
Terms: kitchenmafia.co.za/terms-conditions
Technical development & hosting (Operator):
Tian Vortsman · tian.vortsman.com
This page is a plain-language summary for portal users. It does not replace The Kitchen Mafia’s terms, create a direct contract with the developer, or change who the Responsible Party is under POPIA.
← Back to sign in Privacy / POPIA Cookie policy Tian Vortsman