Privacy Policy

Mlangeni Grand Hospitality (“we”, “us”) is a private-event catering and hospitality business based in Cape Town, South Africa. For the purposes of POPIA we are the responsible party for the personal information described here.

Questions about this policy, and requests about your information, go to our Information Officer at mlangenicatering@gmail.com.

We only collect what we need to plan and deliver your event:

• Enquiries: your name, email address, phone number, preferred event date and session, number of guests and any message you include.
• Your account: your name, email address, phone number and address, and your password (which we never see in plain text). If you sign in with Google, Google shares your name and email address with us.
• Bookings and quotes: the event type, date, time, venue or address, guest numbers, your menu and beverage choices, and any culinary, dietary or logistical notes you give us.
• Payments: the invoice, amount, payment status and the reference PayFast gives us. Your card or bank details are entered on PayFast’s own secure pages and never reach our systems.
• Reviews and messages: the rating and review you write, and messages exchanged with us through your dashboard.
• Technical information: the basic information any web server receives, such as your IP address and browser type. We use it to keep the site running and to stop abuse, for example to limit repeated form submissions.

Special personal information. Dietary notes can reveal information about health or religious belief, which POPIA treats as special personal information. Please share only what we need to cater safely. We use it for that purpose alone, with your consent, and you can withdraw that consent at any time.

• To reply to your enquiry and check availability for your date.
• To prepare quotes, arrange consultations, plan and deliver your event, and keep you informed about it.
• To issue invoices, take payment and keep financial records.
• To run your account and keep it secure, including verifying who you are when you sign in.
• To publish reviews you have asked us to publish.
• To meet our legal obligations, such as tax record-keeping.
• To send you news or offers, but only if you have agreed to receive them. Every marketing message lets you opt out.

We rely on your consent, on the need to carry out a contract with you (or take steps you asked for before one), on our legal obligations, and on our legitimate interest in running a safe and reliable service. We do not sell your personal information.

We share personal information only with service providers who process it on our behalf and under our instructions (“operators” in POPIA terms):

• Supabase: our database, account sign-in and file storage.
• Resend: delivers our emails, such as enquiry confirmations and quotes.
• PayFast: processes online payments.
• Google: only if you choose to sign in with Google.
• WhatsApp: only if you choose to continue a conversation with us there.
• Our website hosting provider, which serves the site to you.

We may also disclose information where the law requires it, or to protect our rights or someone’s safety.

Some of our service providers store or process information on servers outside South Africa. When that happens we use providers that are bound by data-protection laws or agreements giving protection comparable to POPIA, as section 72 of POPIA requires.

We do not use advertising or analytics cookies. When you sign in, your browser stores a session token so that you stay signed in; signing out removes it.

The phone number field shows country flags that are loaded from a third-party content network, which receives your IP address when the images load, as any web server does.

Reviews are checked by our team before they appear. A published review shows your rating, your words, your first name with the initial of your surname (for example, “Thandi M.”) and the type of event. You can edit a review while it is waiting for approval, and ask us to remove a published one at any time.

We keep personal information only for as long as we need it for the purposes above, or for as long as the law requires. Financial records, such as invoices and payments, are kept for at least five years as South African tax law requires. When information is no longer needed we delete it or anonymise it.

• Everything you send us travels over an encrypted (HTTPS) connection.
• Passwords are stored by our sign-in provider in hashed form.
• Database rules ensure each customer can see only their own bookings, invoices and messages, and only our staff can see others.
• Card details are handled by PayFast and never stored by us.

If we believe your personal information has been accessed without authorisation, we will notify you and the Information Regulator as section 22 of POPIA requires.

Under POPIA you may:

• ask whether we hold information about you, and for a copy of it;
• ask us to correct or delete information that is wrong, out of date or no longer needed;
• object to how we process your information, including for direct marketing;
• withdraw consent you have given us; and
• lodge a complaint with the Information Regulator.

Email mlangenicatering@gmail.com to use any of these rights. Our POPIA page explains how we handle requests, and our PAIA Manual explains how to request access to records.

Our services are for adults. We do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian.

We may update this policy as our services change. The date at the top shows when it was last revised. Questions are welcome at mlangenicatering@gmail.com.