- Status:
- Version 1.0
- Effective date:
- 17 September 2026
Information we process
Depending on use, we process account identifiers, name, email and phone; addresses, delivery notes and confirmed coordinates; favourites, basket contents, orders and selections; payment method and collection status; support enquiries, notification tokens and preferences; and operational/security records. Staff and Driver features also use profile, assignment, shift, delivery, reconciliation and commission records. Authorised Driver location supports active delivery work; customers access relevant assigned-Driver tracking for eligible active orders, not a public list of locations.
Public website and contact
Browsing the public catalogue needs no customer sign-in. Hosting receives ordinary request information such as IP address and browser details. The contact form collects name, email, subject and message. Do not provide unnecessary sensitive information. We do not store card credentials for physical card-machine payments.
Why we process information
We use information to authenticate users, provide ordering, check delivery eligibility, fulfil and track orders, send service notifications, answer support, reconcile collections and earnings, prevent abuse and meet legal obligations. Applicable processing grounds include performing or preparing a contract, legal obligations, legitimate operational/security interests, or consent where required. A support enquiry is not permission for unrelated marketing.
Sharing and providers
The selected Store, assigned Driver and authorised support/Operations staff receive information appropriate to their role. Shop customer directories are limited to customers with orders at that shop. Authorised iKota platform administrators can review the platform-wide customer directory and customer/shop order relationships. Account deletion is handled by the platform team. Google Firebase supports app authentication, database/storage and notifications; Google location services support address/maps. Where enabled in an app build, Firebase analytics and crash reporting support diagnostics and improvement. Website hosting and authenticated email providers process requests and messages needed for those services. Providers may process data outside South Africa, subject to applicable safeguards and requirements. Information may be disclosed where lawfully required or necessary for disputes/security. Contact us about providers or transfers relevant to your data.
Retention
We keep information for as long as reasonably needed for its purpose, applicable record-keeping obligations, security and unresolved complaints/disputes. Account deletion does not necessarily remove order, financial or audit records that must remain. Information no longer needed is deleted or de-identified where appropriate. For one year after account deletion, restricted keyed fingerprints of your account email and sign-in phone number support review of possible returning accounts. These remain protected personal data. Matches do not automatically restore, merge or block accounts. Expired fingerprints are removed. Ask about retention for other records; there is no single period for every category.
Choices and rights
Manage supported account/address details in the app and notification/location permissions in device settings. Restricting permissions can affect dependent features. You may request access, correction, deletion subject to lawful exceptions, object to applicable processing, or withdraw consent where it is the processing basis. Call our number and ask for privacy assistance, use in-app support, or the Privacy request subject on the contact form when available. We may verify identity proportionately. You can also approach South Africa’s Information Regulator through https://inforegulator.org.za/ and its published complaint channels.
Security and children
Role-based access and server-validated permissions limit access. No system guarantees absolute security. Report suspected unauthorised access and never share verification codes. Where a minor uses the service with appropriate adult involvement, provide only necessary information. Contact us if a child’s information has been supplied without appropriate authority.
Contact
Contact IKOTA SA (PTY) LTD on +27 61 928 6984, or use Contact Support in the iKota app. Registered and legal-notice address: 2a Simmonds St, Selby South, Johannesburg, 2001, South Africa. Tell us which policy or order your enquiry concerns. Never send a password, one-time code or full card number.
Questions about this document
IKOTA SA (PTY) LTD · 2a Simmonds St, Selby South, Johannesburg, 2001, South Africa
+27 61 928 6984. Ask for assistance with this document or use Contact Support in the app.