Inn-dulGe Restaurant · GCC Catering (Pty) Ltd (registration 2018/506316/07) is the responsible party for the personal information handled by this app. We trade at Holiday Inn Express, Sandton–Woodmead, Woodmead North Office Park, 54 Maxwell Drive, Sandton, 2191. Phone: +27 11 266 3300. Our Information Officer is Peter Ssali — admin@inndulge.co.za.
2 · What we collect, and why
We keep it to a minimum — you never need an account to order.
Ordering: your table's QR session and a first name to show at the table (dine-in); your room number and surname (hotel room charges); or your delivery details — company, name, mobile, building and access notes (office park). Purely to prepare your order and get it to the right place.
Payments: handled by our payment operator. We never see or store your card number — only a payment reference and the amount.
Optional profile: if you choose to join for a wallet, vouchers or rewards — your name and contact details, only with your agreement.
Staff accounts: our team's work email, role and sign-in security records.
Driver location while delivering: if our driver chooses to share it, their device's position is used only while your delivery is on the road — to show you a live map and an honest arrival time. Tracking stops the moment the order is delivered, and the raw location trail is automatically purged within 24 hours.
Technical & security logs: an append-only audit trail of sensitive actions and standard technical logs, kept to protect you and us.
Anonymous usage statistics: only if you tap OK on our one-line analytics prompt — which screens are visited and how often, so we can improve the app. No names, emails, phone numbers, table or room numbers are ever attached, and "No thanks" is one tap with everything still working.
What's voluntary vs mandatory: ordering details are needed to fulfil your order (we can't cook for a table we can't find); a profile, an email for your receipt, and marketing are always optional — and marketing is never pre-ticked.
3 · Legal basis
Contract — preparing and delivering the order you place.
Legal obligation — tax records we must keep by law.
Consent — optional profiles, marketing and anonymous usage analytics; you can withdraw at any time, one tap.
Legitimate interest — fraud prevention and securing the service (audit and security logs).
4 · Who we share it with
Paystack — our payment operator, only to process a payment you initiate. We receive back a payment reference, never your card number.
Resend — our email operator, only when you give us an email address for a receipt, voucher or (for staff) an invitation. If you ask us to email you a tax invoice, Resend processes your address transiently for that one send — we don't keep it, and it is never added to any profile or marketing list.
The hotel front office (Holiday Inn Express Sandton–Woodmead) — only when you charge a meal to your room, so they can bill your room account (signed docket).
Emergent (application hosting) · Tigris (object storage) — the infrastructure this app and its encrypted files run on.
Google Analytics — anonymous usage statistics, and only after you accept the analytics prompt. Google receives technical usage data (screens viewed, approximate region from a masked IP address) and never your name, contact details, table or room number. All advertising features are switched off.
Our current operators, by name: Paystack (payments) · Resend (transactional email) · Emergent (application hosting) · Tigris (object storage).
Each operator processes your information only on our written instructions under an operator agreement, and may not use it for anything else. We never sell your information.
5 · Cross-border transfers
Our hosting, email and analytics operators (named in section 4) may process data outside South Africa — Google Analytics processes its anonymous usage statistics on Google infrastructure abroad. Transfers happen only where the recipient is bound by laws or contract terms that protect your information to a standard comparable with POPIA.
6 · How long we keep it
Tax records (invoices, dockets, transactions): 5 years, as South African tax law requires.
Signatures, proof-of-delivery photos and chat messages: automatically purged after 12 months by our scheduled retention job.
Inactive profiles: anonymised automatically after 24 months without activity.
Driver location trail: automatically purged within 24 hours — only the delivery record itself remains.
Hotel-stay profiles: end at check-out — wallets and vouchers expire with the stay, and the next guest in that room can never see any prior guest's data.
7 · How we protect it
Encrypted connections (TLS) for everything in transit.
Signatures, proof-of-delivery photos and avatars are encrypted at rest.
Strict role-based access — each staff member sees only their own module, enforced server-side.
Multi-factor sign-in capability for staff accounts, plus an append-only audit log of sensitive actions.
A formal security-compromise (breach) register.
Driver location during a delivery is ephemeral — it is purged automatically about 15 minutes after the delivery ends and is never stored long-term.
8 · Your rights
Under POPIA you may ask us at any time to access, correct or delete your personal information, object to processing, and withdraw any consent. If you have a profile, the wallet screen gives you one-tap buttons to download everything we hold about you (a complete export), unsubscribe from marketing, and delete your profile — no forms, no waiting. Deleting your profile anonymises your identifiers immediately; invoices and other records tax law obliges us to keep are preserved without your identity attached.
Your analytics choice right now: not asked yet.
9 · Children
This service isn't directed at children and we don't knowingly collect a child's personal information. A kids' snack box ordered by a parent is the parent's order. If you believe a child's information has reached us, contact the Information Officer and we'll remove it.
10 · Automated decisions
We make no automated decisions about you that have legal or similarly significant effects. Menu suggestions are simple, fixed rules — not profiling.
11 · If something goes wrong
We keep a formal security-compromise register. If a breach is ever likely to affect you, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires — using the Regulator's eServices portal for formal notifications.
12 · Changes to this notice
When we change this notice we bump the version number and effective date at the top, and profile holders are asked to re-accept the new version at their next sign-in. Significant changes never apply to you silently.
13 · Information Officer & PAIA
Peter Ssali — admin@inndulge.co.za. Contact us first; we respond promptly. Our PAIA manual is available from the Information Officer on request.