Privacy Policy

1. Who we are and the scope of this policy

Pub & Grub South Africa ("Pub & Grub", "we", "us" or "our") is a discovery platform for restaurants, pubs, cafés, venues, specials, events, entertainment and functions. This policy applies when you use our website, Android app, customer-account features, venue or business tools, administration services, communications and other services that link to this policy.

For purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"), Pub & Grub is the responsible party for personal information that we determine how and why to process. Questions can be sent to hello@pubandgrub.co.za.

2. The information we collect

Depending on how you use Pub & Grub, we may collect:

• Customer account information: the name and email address you provide, an internal account identifier, saved venue favourites and account status.
• Authentication information: one-time login codes stored in hashed form, code expiry and attempt records, and server-side session records. The Android app stores its session token in Expo SecureStore on your device.
• Contact and enquiry information: your telephone number, email address, message, booking or function enquiry, and any details you choose to include.
• Venue and business information: contact-person details, business contact details, addresses, opening hours, facilities, menus, specials, events, function information, booking details, photos and other listing content.
• User content: reviews, ratings, visit dates, photos, captions, comments, reports and other material you submit. We keep a reviewer's email private, but an approved reviewer name, rating, review and optional visit date may be shown publicly.
• Location information: an area you select or the precise device location obtained after you grant foreground permission for Near Me. The Android app uses that location on the device to calculate distance; it does not send the precise location to the Pub & Grub API or store it in the Pub & Grub database for Near Me.
• Technical and usage information: ordinary server and security logs may contain an IP address, device or browser details, request dates and times, requested routes, errors and security events.
• Communications: login-code emails, support requests, launch-list choices and records of marketing preferences or consent.

3. How we collect information

We collect information directly from you when you create or use a passwordless email-code account, join a list, submit a review or photo, contact us, apply for a venue listing, manage a business profile or use location-based features. Login codes are delivered through our configured email service provider.

Venue information may be supplied by venue owners or authorised representatives, obtained from public business sources, or created through our own research. Where a venue record contains a person's private contact details rather than published business details, we handle those details as personal information.

4. Why we use personal information

• To provide venue discovery, Happening Now, Pulse, menus, specials, events, functions, reviews, favourites and other platform features.
• To create and manage customer, venue-owner and business accounts.
• To review venue applications, verify listings and communicate with venues or users.
• To receive, moderate, publish and respond to reviews, ratings, photos and reports.
• To provide nearby or location-relevant results when you request them.
• To respond to support, booking, function and general enquiries.
• To send requested service, launch or marketing communications and manage unsubscribe choices.
• To personalise and improve discovery, measure service performance and develop new features.
• To detect misuse, protect accounts, keep the platform secure and enforce our terms.
• To comply with legal obligations, establish or defend legal claims, and respond to lawful requests.

5. Our grounds for processing

We process personal information only where POPIA permits it. Depending on the circumstances, this may be because you consented; the processing is needed to provide a service or take steps you requested before entering into an agreement; the law requires it; it protects a legitimate interest of yours; or it is reasonably necessary for our or a third party's legitimate interests, provided those interests do not unjustifiably interfere with your privacy. You may withdraw consent at any time, without affecting processing that was lawful before withdrawal.

6. Public profiles, reviews and uploaded content

Approved venue listings and approved user contributions may be public and can be viewed, copied or shared by other people. Before you upload a photo or other content, make sure you have permission to share it and avoid including private information about yourself or another person. Photos may contain embedded information such as capture time or location; where practical, remove information you do not want to share before uploading.

Reviews are moderated before publication, but moderation does not make Pub & Grub responsible for every statement submitted by a user. We may retain moderation and abuse-prevention records where reasonably necessary even if public content is removed.

7. Location information

You can search by suburb, city or province without giving us precise device location. Near Me is optional and requests foreground location permission only when you choose to use it. You can refuse or withdraw permission in Android settings and continue with manual discovery.

The Android app obtains a location when Near Me is used and calculates distances to mapped venues locally on the device. Pub & Grub does not continuously track you, request background location, send your precise Near Me coordinates to our API or store those coordinates in our database for this feature.

8. Cookies, analytics and similar technologies

We use strictly necessary technologies to deliver the service, remember privacy choices, support authentication, prevent abuse and maintain security. Where we introduce optional analytics or similar measurement tools, we will use them to understand general usage and improve Pub & Grub, subject to the choices and consent required by law.

You can manage available choices through our Cookie settings control and your browser or device settings. More detail is available in our Cookie Policy.

9. Communications and direct marketing

We may send service messages needed for your account, enquiry, submission or venue relationship. We send promotional or launch communications only where we have an appropriate basis to do so. You can unsubscribe through the link in a marketing message or email hello@pubandgrub.co.za. Opting out of marketing does not stop necessary service or security messages.

10. When we share information

We do not sell personal information. We may share only what is reasonably necessary with:

• Hosting, cloud database, media storage, email delivery (including delivery of one-time login codes), analytics, mapping, security, support and other service providers that help operate Pub & Grub.
• A venue or business when you ask us to send it an enquiry or booking request.
• Professional advisers, insurers, auditors or prospective transaction advisers where confidentiality safeguards apply.
• Courts, regulators, law-enforcement bodies or other parties when disclosure is required or permitted by law, or reasonably necessary to protect rights, safety or the service.
• A successor or purchaser in a genuine merger, reorganisation or sale, subject to appropriate confidentiality and privacy protections.

Our service providers may process information only for agreed purposes and must apply appropriate safeguards. If information is transferred outside South Africa, we take reasonable steps to use a recipient, agreement or other safeguard that meets POPIA's requirements for cross-border transfers.

11. Data retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, manage our relationship with you, meet legal or accounting obligations, resolve disputes, prevent fraud and enforce agreements. Retention periods depend on the type of record, sensitivity, legal requirements and operational need; we do not promise one fixed period for every record.

You can permanently delete a customer account in the Android app or through our account-deletion page. That process deletes the customer account, favourites, all sessions and outstanding login-code records associated with the account email. Separate security, legal, dispute or correspondence records may be retained only where there is a lawful and necessary reason. Limited copies may also remain temporarily in protected backups.

12. Security

We use reasonable technical and organisational safeguards designed to protect the confidentiality and integrity of personal information and reduce the risk of loss, misuse, unauthorised access, alteration or disclosure. These may include access controls, authentication, encryption in transit, monitoring, backups and limiting staff or provider access. No online system is completely secure. If a security compromise affects your personal information, we will investigate and notify the Information Regulator and affected people where POPIA requires it.

13. Your POPIA rights

Subject to POPIA and any lawful limitations, you may:

• Ask whether we hold personal information about you and request access to it.
• Ask us to correct or update inaccurate, incomplete, misleading or outdated information.
• Request deletion or destruction of information that we are no longer authorised to retain.
• Object, on reasonable grounds, to certain processing.
• Withdraw consent where processing relies on consent.
• Object to direct marketing and unsubscribe from promotional electronic communications.
• Ask about decisions based solely on automated processing where those decisions have legal or similarly significant effects.
• Complain to us or lodge a complaint with the South African Information Regulator.

Delete a customer account through the Android Profile screen or at pubandgrub.co.za/account-deletion. For other requests, email hello@pubandgrub.co.za. We may need to verify your identity before giving access or changing information. We will respond within a reasonable period and explain if POPIA permits or requires us to refuse part of a request.

14. Children

Pub & Grub may list family-friendly venues, but our account and contribution features are not intended to knowingly collect personal information directly from children without the consent or other authorisation required by POPIA. If you believe a child has provided personal information without appropriate permission, please contact us so that we can investigate.

15. Complaints and contact

For privacy questions or requests, email hello@pubandgrub.co.za.

If you believe your personal information has been handled contrary to POPIA, you may also complain to the South African Information Regulator through its complaints service or contact POPIAComplaints@inforegulator.org.za.

16. Changes to this policy

We may update this policy as Pub & Grub develops, including when app features, account capabilities or service providers change. We will post the updated version here, change the last-updated date and provide additional notice where a change materially affects how personal information is used.