PRIVACY POLICY
V & S Innovation (Pty) Ltd, Registration Number 2017/404736/07, VAT Number 4870282169, trading as V & S Innovation (“V & S”), operates digital ordering and cashless payment platforms for the corporate catering and foodservice sector. In carrying out these activities, V & S collects, stores, processes, and transfers personal information on an ongoing basis.
The Protection of Personal Information Act 4 of 2013 (“POPIA”) regulates the manner in which personal information is collected, stored, processed, and transferred. V & S is committed to processing personal information responsibly, lawfully, and in compliance with POPIA.
This Privacy Policy applies to all V & S electronic platforms and applications, including but not limited to the BiteOnSite ordering platform, kiosk interfaces, web application, and any associated mobile applications operated by V & S or deployed on behalf of a Catering Operator or Corporate Client. It applies to all employees, clients, corporate clients, catering operators, vendors, contractors, and any other persons whose personal information is processed by V & S.
This Privacy Policy must be read together with our Online Ordering Terms and Conditions.
Last updated: 2 June 2026
The following definitions apply to this Privacy Policy:
Catering Operator — the contract catering company operating at your employer’s premises and responsible for food preparation and service.
Client — any person whose personal information is processed by V & S, including employees, corporate clients, catering operators, vendors, contractors, and other third parties.
Corporate Client — the employer or organisation that has contracted with V & S to deploy the Platform for use by its employees.
POPIA — the Protection of Personal Information Act 4 of 2013.
Platform — the V & S digital ordering and catering management platform, including all web, mobile, and kiosk interfaces.
Processing — any operation concerning personal information, including collection, storage, use, disclosure, and destruction.
Responsible Party — a party that determines the purpose and means of processing personal information. V & S and the Corporate Client may each be a Responsible Party in respect of different categories of data.
Special Personal Information — information relating to religious beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric data, or criminal behaviour, as defined in POPIA.
2.1 V & S collects and processes the following categories of personal information in connection with the Platform:
(a) Identity information: name, employee number, identity number where required;
(b) Contact information: email address, mobile number;
(c) Account credentials: username, encrypted password;
(d) Order and transaction data: items ordered, order values, payment method, transaction history;
(e) Subsidy and wallet data: meal allowance entitlements, wallet balances, subsidy usage records;
(f) Device and usage data: IP address, device type, browser information, session data, and usage analytics collected via cookies and tracking technologies including Google Tag Manager and similar tools;
(g) Dietary preferences: where voluntarily provided by the user;
(h) Site and location data: the Site (premises) associated with your account.
2.2 V & S does not collect Special Personal Information unless it is strictly necessary and you have provided explicit consent, or processing is required or permitted by law.
2.3 If any deployment of the Platform incorporates biometric authentication (such as fingerprint or facial recognition for login), this constitutes Special Personal Information under POPIA. Such processing will only occur with your explicit consent and will be disclosed to you at the point of enrolment.
3.1 V & S processes personal information for the following purposes:
(a) To operate the Platform and facilitate the ordering, payment, and fulfilment of food and beverage orders;
(b) To manage meal subsidies, meal allowances, and pre-funded wallet accounts on behalf of the Corporate Client;
(c) To fulfil contractual obligations to the Corporate Client and Catering Operator;
(d) To process payments and manage financial records;
(e) To provide customer support and resolve complaints;
(f) To generate anonymised or aggregated operational and business intelligence reports for the Corporate Client and Catering Operator;
(g) To comply with applicable South African legal and regulatory obligations, including POPIA, FICA, the Companies Act, VAT legislation, and the Consumer Protection Act;
(h) For general administrative, audit, and record-keeping purposes;
(i) To improve and develop the Platform and user experience;
(j) For market research and analytical purposes, using anonymised or aggregated data where possible.
4.1 V & S acts as a technology service provider. In processing employee personal information on behalf of a Corporate Client or Catering Operator under contract, V & S acts as an Operator (processor) under POPIA in respect of that processing.
4.2 The Corporate Client, as the employer, determines the purpose of processing certain categories of employee data — including subsidy entitlements, access rights, and site-level reporting. In respect of this processing, the Corporate Client is a Responsible Party and is subject to its own POPIA obligations.
4.3 Where required by POPIA, V & S will conclude a written operator agreement with each Corporate Client and Catering Operator, setting out each party’s obligations in respect of personal information processed on the Platform.
4.4 Employees with questions about their employer’s use of their personal information on the Platform should direct those queries to their employer’s HR department or designated information officer in the first instance.
5.1 V & S may share personal information with the following parties, only to the extent necessary for the purposes described in clause 3:
(a) The Corporate Client — in respect of transaction data, subsidy usage, and operational reports related to their employees;
(b) The Catering Operator — in respect of order details and production data necessary to prepare and fulfil orders;
(c) V & S employees — on a need-to-know basis only;
(d) Payment gateway providers — for the secure processing of card transactions;
(e) Technology service providers and sub-processors — including cloud hosting, analytics, and communication platforms, engaged under operator agreements with appropriate data protection obligations;
(f) Regulatory authorities — where required by law.
5.2 V & S will not sell, rent, or otherwise commercially disclose your personal information to any unrelated third party.
5.3 If you disclose personal information to a third party through a link or integration on the Platform, V & S is not responsible for how that third party uses your information.
6.1 The Platform uses cookies and similar tracking technologies to ensure functionality, improve user experience, and gather usage analytics.
6.2 The following categories of cookies may be used:
(a) Strictly necessary cookies: required for the Platform to function, including session management and security. These cannot be disabled.
(b) Analytical cookies: used to understand how users interact with the Platform, including tools such as Google Analytics and Google Tag Manager. These cookies collect anonymised or aggregated data.
(c) Functional cookies: used to remember your preferences, such as your preferred site or language.
6.3 You may manage analytical and functional cookies through your device or browser settings. Disabling certain cookies may affect Platform functionality.
7.1 V & S retains personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
7.2 The following indicative retention periods apply:
(a) Transaction and financial records: 5 years from the date of the transaction, to comply with VAT and financial record-keeping requirements;
(b) Employee account data: for the duration of the employee’s active account, plus a reasonable period following deactivation, not exceeding 12 months unless otherwise required by law or contract;
(c) Order history and production data: as agreed with the Corporate Client, typically 2 years;
(d) Support and complaint records: 3 years from date of resolution.
7.3 When personal information is no longer required, it will be securely destroyed or de-identified in a manner that prevents reconstruction.
8.1 V & S implements appropriate technical and organisational security measures to protect personal information against unauthorised access, accidental loss, destruction, or unlawful processing.
8.2 Card payment data is processed through a PCI DSS-compliant payment gateway. V & S does not store full card numbers.
8.3 Despite our safeguards, no method of electronic transmission or storage is completely secure. V & S cannot guarantee the absolute security of data transmitted over the internet.
9.1 As a data subject under POPIA, you have the right to:
(a) Request confirmation of whether V & S holds personal information about you;
(b) Request access to the personal information V & S holds about you;
(c) Request correction of inaccurate or incomplete personal information;
(d) Request deletion of your personal information, subject to legal and contractual retention requirements;
(e) Withdraw consent to processing, where processing is based on consent;
(f) Object to the processing of your personal information on reasonable grounds.
9.2 Requests should be submitted to the Information Officer using the contact details in clause 11. V & S will respond within a reasonable time and, where applicable, at a prescribed fee.
9.3 Where your personal information is processed by V & S as an Operator on behalf of your Corporate Client, certain requests (particularly for access or correction) may need to be directed to your Corporate Client as the Responsible Party.
10.1 V & S may transfer personal information to service providers located outside South Africa, including cloud hosting and analytics providers. Such transfers are made only to recipients who provide an adequate level of protection substantially equivalent to POPIA, through applicable law, binding corporate rules, or contractual data protection clauses.
V & S has appointed the following persons in terms of POPIA:
Information Officer
Name: Timothy Strang
Email: tim@vands.co.za
Deputy Information Officer
Name: Nakoshia Naidoo
Email: nakoshia@vands.co.za
The Information Officer is responsible for ensuring V & S’s compliance with POPIA, including processing requests from data subjects and cooperating with the Information Regulator.
12.1 If V & S becomes aware of, or has reasonable grounds to believe that, personal information has been accessed or acquired by an unauthorised person, V & S will:
(a) Notify affected Clients within a reasonable time;
(b) Notify the Information Regulator as required by POPIA;
(c) Take prompt action to investigate, contain, and mitigate the breach.
13.1 The Platform is intended for use by adults in a corporate workplace environment. V & S does not knowingly collect personal information from persons under the age of 18. If V & S is required to process information relating to a minor, it will do so only with the consent of the minor’s parent or legal guardian, unless processing is required or permitted by law.
14.1 You may withdraw your consent to the processing of your personal information at any time by submitting a written request to the Information Officer. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.
15.1 V & S may update this Privacy Policy from time to time. Material changes will be communicated through the Platform. Continued use of the Platform following any update constitutes acceptance of the revised policy. Clients are encouraged to review this policy periodically.
16.1 If you believe V & S has processed your personal information contrary to this Privacy Policy or POPIA, you may:
(a) Lodge a complaint with the V & S Information Officer in the first instance; or
(b) Lodge a complaint with the Information Regulator of South Africa at www.justice.gov.za/inforeg/
V & S encourages Clients to pursue internal resolution before escalating to the Information Regulator.
V & S Innovation (Pty) Ltd — Registration No. 2017/404736/07 — VAT No. 4870282169
Unit 4, Glen Eagles Business Park, 10 Flanders Drive, Mount Edgecombe, 4300
Last updated: 2 June 2026