Privacy Policy

KasiGo SA ("KasiGo", "we", "us") operates a South African food delivery and local logistics marketplace connecting customers with independent restaurants and independent delivery drivers. For the purposes of POPIA we are the responsible party for the personal information described in this notice. Our Information Officer can be reached at support@kasigo.app.

• Account information: your name, email address, mobile number, password (stored only in hashed form) and account role (customer, driver, restaurant owner or administrator).
• Order information: items ordered, delivery and pickup addresses, delivery instructions, order status, timestamps and in-app chat messages relating to an order.
• Location information: approximate or precise device location while you are placing an order or, for drivers, while you are online and completing deliveries.
• Payment information: payment status, amounts, and references returned by our payment provider. Full card numbers are processed by the payment provider and are never stored by KasiGo.
• Partner information: for drivers and restaurants, onboarding and verification documents (identity document, driver's licence, vehicle details, business registration) and bank account details required for payouts.
• Technical information: device type, app version, IP address, push notification tokens, error logs and anonymous session identifiers used to understand how the app is used.

Under section 11 of POPIA we process personal information because:

• It is necessary to conclude or perform a contract with you — creating your account, accepting and dispatching orders, routing drivers, processing payments and paying out partners.
• It is necessary to comply with a legal obligation — tax, accounting, anti-fraud and record-keeping duties.
• It is necessary for our legitimate interests — preventing fraudulent or abusive orders, resolving disputes, keeping the platform secure, and improving the service.
• You have consented — for example to precise location access, marketing communications and push notifications. You may withdraw consent at any time.

We share only the minimum information needed to complete your order or run the platform:

• Restaurants receive your order details, first name and, where relevant, contact number.
• Drivers receive your delivery address, contact number and delivery instructions for the duration of the delivery.
• Payment providers receive the transaction details necessary to process payments and payouts.
• Operators such as our cloud hosting, database, mapping, messaging and push notification providers process data on our written instruction and are bound to keep it confidential and secure.
• Law enforcement, regulators or our professional advisers where we are legally required or entitled to disclose information.

We do not sell your personal information, and we do not share it for third-party advertising.

Some of our operators host infrastructure outside South Africa. Where personal information is transferred abroad we do so only in accordance with section 72 of POPIA — that is, where the recipient is subject to a law, binding agreement or corporate rules providing an adequate level of protection substantially similar to POPIA, or where the transfer is necessary to perform our contract with you.

• Account and profile data: for as long as your account is active, and up to 12 months after closure to handle disputes and re-activation.
• Order, payment and payout records: at least 5 years, as required by South African tax and financial record-keeping law.
• Partner verification documents: for the duration of the partnership and 5 years thereafter.
• Location traces and in-app chat: ordinarily 90 days after the related order is completed, unless retained longer for an active dispute or investigation.

We apply reasonable technical and organisational measures as required by section 19 of POPIA. Data is encrypted in transit, passwords are hashed by our authentication provider, database tables are protected by row-level security so users can only access their own records, and administrative access is restricted to authorised staff. If a security compromise affects your personal information we will notify you and the Information Regulator as required by section 22.

• Access — request confirmation of, and a record of, the personal information we hold about you.
• Correction or deletion — ask us to correct inaccurate information or delete information we are no longer entitled to keep.
• Objection — object, on reasonable grounds, to processing based on legitimate interests.
• Withdraw consent — for location, marketing or push notifications, at any time, without affecting lawful processing before withdrawal.
• Direct marketing — opt out of electronic marketing at any time, in line with section 69.
• Complain — lodge a complaint with the Information Regulator if you believe we have not complied with POPIA.

To exercise any of these rights, email support@kasigo.app. We respond within a reasonable period, ordinarily 30 days, and may ask you to verify your identity first.

KasiGo is not intended for children under 18. We do not knowingly process the personal information of a child without the consent of a competent person, and will delete such information if we become aware of it.

We use essential storage on your device to keep you signed in, remember your cart and delivery address, and to hold anonymous session identifiers used for product analytics. You can clear this data through your browser or device settings, though signing in and checkout may then behave differently.

Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Complaints: complaints.IR@justice.gov.za.

We may update this notice as the product or the law changes; the "last updated" date above reflects the current version. Privacy queries: support@kasigo.app.