Privacy Policy

1 Who We Are

BiteOnsite is a digital workplace catering management platform operated by V&S Technology (Pty) Ltd, trading as BiteOnsite, registered in South Africa.

We provide software solutions for corporate and industrial catering operations, including pre-ordering, point-of-sale management, kiosk ordering, subsidy management, loyalty programmes, and multi-site canteen administration.

2 Information We Collect

We collect information in the following ways:

Information you provide directly

• Demo requests and enquiries: name, company name, job title, email address, phone number, company size, and number of sites.
• Platform account registration: name, email address, role within your organisation.
• Employee meal ordering: name, employee ID, dietary preferences, meal selections, payment or subsidy card details (processed via our secure payment partners).
• Feedback and support: any information you include when contacting us or submitting feedback through the platform.

Information collected automatically

• Usage data: pages visited, features used, clicks, session duration and navigation paths within the platform.
• Device and browser data: IP address, browser type and version, operating system, screen resolution, and referring URL.
• Cookies and tracking technologies: see Section 9 (Cookies) below for full details.

Information from your organisation

Where BiteOnsite is deployed by a corporate or catering company as a B2B customer, that organisation may provide us with employee data (such as employee IDs, cost-centre allocations, or subsidy entitlements) necessary for the platform to function. In this context, your employer is the data controller and BiteOnsite acts as a data processor.

3 How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the BiteOnsite platform and its features.
• To respond to your demo requests, enquiries, and support tickets.
• To process meal orders, payments, subsidies, and loyalty transactions.
• To personalise your experience and surface relevant features or content.
• To send transactional communications (order confirmations, receipts, account notifications).
• To send marketing communications about BiteOnsite features, updates, and industry news — where you have opted in or where we have a legitimate interest to do so.
• To analyse usage patterns and improve the platform's performance, reliability, and usability.
• To detect, investigate, and prevent fraudulent activity or security incidents.
• To comply with our legal obligations under South African law and applicable regulations.

4 Legal Basis for Processing

We process your personal information on the following grounds under the Protection of Personal Information Act, 4 of 2013 (POPIA) and, where applicable, the General Data Protection Regulation (GDPR):

• Contract: processing necessary to provide our services to you or your organisation under a contract.
• Legitimate interests: processing necessary for our legitimate business interests, such as improving our platform, preventing fraud, and marketing our services to business contacts — provided these interests are not overridden by your rights.
• Consent: where you have given us explicit consent, for example to receive marketing communications. You may withdraw consent at any time.
• Legal obligation: processing required to comply with South African law, regulatory requirements, or court orders.

5 Sharing Your Information

We do not sell your personal information. We may share it in the following limited circumstances:

Service providers and sub-processors

We engage trusted third-party vendors to help operate the BiteOnsite platform. These include cloud hosting providers, payment processors, email service providers, analytics tools, and customer support platforms. All sub-processors are bound by data processing agreements and may only use your data to provide services to us.

Your organisation

If you access BiteOnsite through your employer's deployment, relevant usage data and transaction records may be accessible to authorised administrators within your organisation (e.g., HR, finance, or facilities management teams).

Legal requirements

We may disclose your information where required by law, regulation, or a valid court order, or where necessary to protect the rights, property, or safety of BiteOnsite, our customers, or others.

Business transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity. We will notify you before your personal information becomes subject to a different privacy policy.

6 Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

• Account data: retained for the duration of your active account plus 3 years after termination.
• Transaction records: retained for 7 years in accordance with South African tax and financial record-keeping requirements.
• Demo and enquiry data: retained for up to 2 years from the date of your last interaction with us.
• Usage and analytics data: retained in aggregated, anonymised form indefinitely for platform improvement.

When personal data is no longer required, we securely delete or anonymise it.

7 Your Rights

Under POPIA and, where applicable, the GDPR, you have the following rights regarding your personal information:

• Right to access: you may request a copy of the personal information we hold about you.
• Right to correction: you may request that we correct inaccurate or incomplete information.
• Right to deletion: you may request that we delete your personal information, subject to our legal retention obligations.
• Right to restrict processing: you may request that we limit how we use your information in certain circumstances.
• Right to object: you may object to processing based on legitimate interests, including direct marketing.
• Right to data portability: where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at support@vands.co.za. We will respond within 30 days. You also have the right to lodge a complaint with the Information Regulator of South Africa at www.justice.gov.za/inforeg.

8 Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest.
• Role-based access controls limiting who can access personal data within our team.
• Regular security assessments and penetration testing of the BiteOnsite platform.
• Secure development practices and third-party security audits.

While we take reasonable steps to protect your information, no method of electronic transmission or storage is 100% secure. If you believe your account or data has been compromised, please contact us immediately at support@vands.co.za.

9 Cookies

We use cookies and similar tracking technologies to enhance your experience on the BiteOnsite website and platform.

Types of cookies we use

• Essential cookies: necessary for the website and platform to function. They cannot be disabled.
• Analytics cookies: help us understand how visitors interact with our website (e.g., Google Analytics 4). Data is aggregated and anonymised where possible.
• Preference cookies: remember your settings and choices to personalise your experience.
• Marketing cookies: used to deliver relevant advertising and track campaign performance. Only set with your consent.

You can manage or withdraw your consent to non-essential cookies at any time through your browser settings or our cookie preference centre. Disabling certain cookies may affect the functionality of the platform.

10 Third-Party Links

The BiteOnsite website and platform may contain links to third-party websites, applications, or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

11 Children's Privacy

BiteOnsite is a B2B platform intended for use by business professionals and employees in workplace environments. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through the platform.

We encourage you to review this policy periodically. Your continued use of the BiteOnsite platform after any changes take effect constitutes your acceptance of the updated policy.

13 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal information, please get in touch: