1. Who is responsible
BulkBite is operated by TDMF GROUP (PTY) LTD, registration number 2026/262429/07, of The Braak, Stellenbosch, 7600, Western Cape, South Africa. The company is the responsible party for the personal information described in this notice.
Privacy enquiries can be sent to hello@bulkbite.co.za or to +27 65 752 4234.
2. Information we collect
What we collect depends on how you use BulkBite:
- Enquiries and meal plans: name, contact details, residence or location, plan and portion choices, communications, collection arrangements and referral details.
- Orders and payments: order, subscription, amount, payment status, Paystack reference and billing history. Card details are entered on Paystack's secure page; BulkBite does not receive or store the card number or security code.
- Identity checks: where BulkBite asks a customer to confirm their identity under clause 11C of the Terms - before containers are lent, when more are asked for, or when containers have not been returned - their South African identity number (or passport number) and a record that a matching document was seen. We do not ask everybody for this, and where seeing the document is enough we do not keep a copy of it.
- Unreturned containers: which containers a customer holds, notices and demands sent, and, where clause 11C applies, an entry on BulkBite's internal list of people it will not supply until containers are returned or the charge is paid.
- Food safety: allergies, dietary restrictions and related notes you give us. Allergy and health information can be special personal information and is used only to assess and manage whether we can safely provide meals.
- Competitions, events, partner programmes and applications: the information requested on the relevant form, answers or submissions, consent records, eligibility, participation and outcome records. For the kitchen assessment this includes answers, time per question, answer changes, leaving the page or switching tabs, and the resulting score. Extra terms shown with that activity also apply.
- Website and campaign information: IP address, browser and device details, approximate location derived by a provider, pages viewed, referring page, campaign tags, clicks and conversions when you allow analytics or advertising tools.
- Messages: emails, WhatsApp messages, calls and other correspondence with us.
We collect most information directly from you. We may also receive payment status from Paystack, campaign information from advertising providers, or referral and programme information from the person or organisation involved.
Information marked as required is needed to submit that form, assess food safety, process a payment or provide the requested service. If it is not supplied, we may be unable to answer the request, complete the order or safely provide meals. Optional fields may be left blank.
3. Why and how we use it
We process personal information only where there is a lawful reason under the Protection of Personal Information Act, 4 of 2013 (POPIA). Depending on the activity, we use it to:
- answer an enquiry or take steps requested before a customer joins;
- provide, bill, administer and support a meal plan or other agreement;
- manage food safety, collections, containers, payments, refunds and customer service;
- confirm a customer's identity where we ask for it, recover BulkBite's containers or an amount lawfully due, and refuse further orders from a customer on our internal do-not-supply list. This list is used only by BulkBite, is not shared with other businesses and is not reported to a credit bureau;
- keep legally required accounting, transaction and consent records;
- protect the website, customers and business against misuse, fraud and security incidents;
- measure and improve the website where you allow analytics;
- measure campaigns and support relevant advertising where you allow advertising tools; and
- send marketing only where it is permitted and honour opt-outs.
Our lawful grounds may be your consent, steps needed to enter or perform a contract, a legal obligation, protection of your legitimate interests, or BulkBite's legitimate interests where those interests do not unjustifiably override your privacy. You may withdraw consent at any time, although that does not make earlier lawful processing unlawful.
Kitchen assessment decisions. The internship assessment is automatically scored against pre-set, job-related rules and shows whether the application progresses. The role page explains what is observed before an applicant starts. An applicant may contact us to ask for an explanation, correct inaccurate details, make representations or request human review of the result.
4. Who receives it
We do not sell personal information. We disclose only what is reasonably needed to staff and service providers that help us operate, including:
- Supabase for hosted databases, authentication and server functions;
- Paystack for checkout, payment and recurring billing;
- email, messaging, website-hosting and security providers;
- Google Analytics, Meta and Microsoft Advertising only according to the browser choices described below;
- professional advisers, regulators, authorities or courts when legally required;
- a lawful debt collector or our legal advisers, and only where needed to recover unreturned containers or an amount lawfully due - including an identity number where it is needed to identify the right person; and
- a successor if the business is reorganised or sold, subject to appropriate safeguards.
WhatsApp and the social platforms you choose to contact have their own privacy practices. Do not send card numbers or security codes by email or WhatsApp.
5. Processing outside South Africa
Some service providers operate internationally or use infrastructure outside South Africa. Information may therefore be processed in another country. We select established providers, limit what is shared, use available contractual and security safeguards, and require an appropriate basis for any cross-border transfer under POPIA.
6. How long we keep it
We keep personal information only for as long as it is reasonably needed for the purpose described, an active relationship, dispute handling, safety, accounting or another legal requirement. Retention differs by record:
- unsuccessful or incomplete enquiries are reviewed and deleted or anonymised when no longer useful for the enquiry and legitimate follow-up;
- customer, payment and accounting records may be kept for the period required by law and for legitimate claims and audit purposes;
- allergy and food-safety information is restricted and kept only while operationally or legally necessary;
- an identity number is restricted to the people who need it and deleted once the customer has returned all containers and owes nothing, unless it is needed for a dispute or claim that is still open;
- an entry on the do-not-supply list is removed once the containers are returned or the charge is paid;
- kitchen assessment records are deleted six months after the application round closes;
- competition and programme records follow the periods stated in their specific terms; and
- your cookie choice is stored for up to 180 days, after which we ask again.
We delete or de-identify information when retention is no longer authorised, subject to backups and records that cannot yet be safely separated.
7. Your rights
Subject to POPIA and identity verification, you may ask whether we hold your information, request access, ask us to correct or delete inaccurate or unlawfully held information, object to certain processing, withdraw consent, and stop direct marketing. You may also complain to the Information Regulator. Some information must still be kept where the law, an active contract, food safety or a legitimate dispute requires it.
8. Cookies and similar browser storage
Cookies are small files stored by a browser. The site also uses local storage and session storage, which perform similar jobs. Optional analytics and advertising tools remain off until you allow their category.
| Category and provider | What it does | Typical storage |
|---|---|---|
| Necessary: BulkBite | Remembers privacy choices, preserves a checkout reference for the return page, prevents duplicate conversion reporting, keeps form or attribution continuity and supports secure administration. | Session-only where possible; privacy choice up to 180 days; operational items until completed or cleared. |
| Analytics: Google Analytics | Measures visits, page use and
selected actions so we can understand and improve the service. Common identifiers include
_ga and _ga_*. | Commonly up to 2 years, subject to our Google settings and Google's changes. |
| Advertising: Meta Pixel | Measures Meta campaign visits and
actions and may support audience measurement or remarketing. Common identifiers include
_fbp and _fbc. | Commonly up to 90 days, subject to Meta's changes. |
| Advertising: Microsoft UET | Measures Microsoft Advertising
visits and conversions and may support remarketing. Common identifiers include
_uetvid, _uetsid and MUID. | From about one day to 13 months, subject to Microsoft's changes. |
Provider names, cookies and durations can change. More information is available from Google, Meta and Microsoft.
9. Your privacy choices
You can use the button below at any time. Rejecting optional storage does not prevent you from reading the site, submitting an enquiry or buying a meal plan. When you turn off a category that was already active, the site removes the optional first-party identifiers it can identify and reloads so the relevant tools no longer run. Browser controls can also block or delete storage, although that may remove saved checkout or preference information.
10. Contact and complaints
Contact BulkBite at hello@bulkbite.co.za or +27 65 752 4234. Please describe what you want us to access, correct, delete or stop using. We may need enough information to confirm your identity.
You may also complain to the Information Regulator South Africa at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; telephone 010 023 5200; general email enquiries@inforegulator.org.za; or POPIA complaints email POPIAComplaints@inforegulator.org.za.
11. Changes to this notice
We may update this notice when our practices, providers or the law change. The version and effective date at the top show the notice currently in force. Material changes will be made reasonably prominent.