Privacy Policy

Last Updated: 24 July 2026

PROTECTION OF PERSONAL INFORMATION POLICY OF BOOKMYTABLE (PTY) LTD IN COMPLIANCE WITH THE PROTECTION OF PERSONAL INFORMATION ACT 4 OF 2013 AND THE EUROPEAN GENERAL DATA PROTECTION REGULATIONS

1. Introduction

BookMyTable respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains:

What personal information we collect
Where we obtain it
Why and how we process it
Who we share it with
How long we retain it
How we protect it and
How you may exercise your privacy rights.

This Policy applies to diners, website visitors, application users, Restaurant representatives and other people who interact with BookMyTable. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African law.

2. Personal information we collect

Depending on how you use BookMyTable, we may collect the following categories of information.

2.1 Identity and contact information

Full name
Email address
Telephone number
Account username or identifier
Preferred method of communication and
Other information used to identify or contact you.

2.2 Account information

Login details in encrypted or protected form;
Account preference
Favourite Establishment
Account status
Communication preferences; and
Account activity.

2.3 Reservation information

Establishment selected
Reservation date and time
Number of guests
Booking status
Reservation reference
Reservation history
Cancellation or no-show history
Seating preferences
Special requests and
Communications relating to the reservation.

2.4 Dietary, health and accessibility information

If you voluntarily provide it, we may process information concerning:

Food allergies
Dietary requirements
Health-related dining requirements
Disability or accessibility needs and
Other information contained in a special request.

Some of this information may constitute special personal information under POPIA. You should provide only information that is necessary for the Establishment to consider your request. BookMyTable does not guarantee that a Establishment can accommodate a medical, dietary or accessibility requirement.

2.5 Payment and transaction information

Where a deposit, prepayment, refund or other charge applies, we may process:

Payment status
Transaction reference
Amount paid or refunded
Payment method type
Limited payment-card information, such as the last four digits
Billing or fraud-prevention information and
Chargeback or payment-dispute information.

Payments may be processed by an independent payment service provider. BookMyTable does not intend to store complete payment-card details unless expressly disclosed and appropriately secured.

2.6 Business representative information

For Establishment owners, managers or staff, we may collect:

Name and business contact details
Position or authority
Establishment information
Subscription and billing information
Platform login information
Support communications and
Verification or business-registration information.

2.7 Reviews and submitted content

We may collect:

Reviews and ratings
Comments
Photographs
Complaint information
Support requests and
Other content submitted through the Platform.

2.8 Technical and usage information

When you use the Platform, we may automatically collect:

IP address
Browser type and version;
Device type
Operating system
Application version
Device or session identifiers
Login and access times
Pages viewed and features used
Referring website
Error and diagnostic information
Security and fraud-prevention data.

2.9 Location information

If you allow location access, we may process your approximate or precise device location to:

Show nearby Food Establishment
Personalise search results
Calculate distance or
Improve location-based discovery.

Location access is optional unless a particular feature genuinely requires it. You may withdraw device location permission through your browser or device settings.

2.10 Cookies and similar technologies

We may use cookies, pixels, local storage, software development kits and similar technologies to:

Keep you signed in
Remember preferences
Maintain Platform security
Understand Platform usage
Measure performance and
Support permitted analytics or marketing.

Further information appears in section 13 of this Policy and our separate Cookie Policy, where applicable.

3. Where we obtain information

We may collect personal information:

Directly from you
When you create or update an Account
When you make or manage a reservation
When you contact support
When you submit a review or special request
Automatically through your device or browser
From a Food Establishment concerning your reservation
From payment, communication, analytics or security providers
From a person making a group reservation that includes you or
From lawful public or business sources where appropriate.

If another person makes a reservation on your behalf, that person must have authority to provide the information.

4. Whether information is mandatory

Certain information is necessary to create an Account, process a reservation, take a payment, provide support or meet legal obligations.

Create or maintain your Account
Submit or confirm a reservation
Process a deposit or refund
Send booking communications
Investigate a complaint or
Provide a requested service.

Optional information will be identified where reasonably practicable.

5. Why we process personal information

We may process personal information to:

Create and manage Accounts
Process and manage reservations
Send confirmations, reminders, changes and cancellations
Share relevant reservation details with the selected Food Establishment
Process deposits, payments and refunds
Provide support and handle complaints
Display nearby or relevant Establishment
Maintain favourites and preferences
Verify Establishment representatives
Operate Establishment subscriptions
Prevent fraud, misuse and security incidents
Improve Platform functionality and performance
Conduct analytics and business reporting
Moderate reviews and User Content
Enforce our Terms and agreements
Establish, exercise or defend legal rights
Meet tax, accounting and regulatory obligations and
Send marketing where lawfully permitted.

We will not use personal information for a materially incompatible purpose without providing an appropriate notice or obtaining consent where required.

6. Lawful grounds for processing

Depending on the circumstances, we process information because:

It is necessary to perform a contract with you
It is necessary to take steps at your request before entering into a contract
We have a legal obligation
You have provided consent
It protects your legitimate interests
It protects the legitimate interests of BookMyTable, a Business, or another party, subject to your rights or
Another lawful justification under POPIA applies.

Consent is not the only ground on which we rely. Where processing is based on consent, you may withdraw that consent. Withdrawal does not invalidate processing lawfully performed before the withdrawal.

7. Special personal information

Dietary, allergy, medical or accessibility details may reveal health information and may qualify as special personal information.

We process this information only where legally permitted, including where:

You voluntarily provide it for the Food Establishment to consider
You consent to its use for the relevant reservation
Processing is necessary to establish, exercise or defend a right or
Another authorisation under POPIA applies.

Relevant information may be shared with the Establishment selected by you. Avoid including unrelated confidential medical information in a reservation request. For urgent or serious requirements, contact the Establishment directly.

8. Sharing personal information

We do not sell or rent personal information. We may share information with the following recipients when necessary and lawful.

8.1 Establishment

When you submit or manage a reservation, we may share relevant information with the selected Establishment, including:

Your name
Contact details
Reservation date and time
Number of guests
Booking status
Special requests
Dietary or accessibility information you provide and
Deposit or payment status.

The Establishment may process this information for reservation management, service delivery, legal compliance and complaint handling. Establishments are independent businesses and may act as responsible parties for their own processing. Their subsequent use of information may also be governed by their own privacy notices. Establishment may not use booking information for unrelated direct marketing unless they have a lawful basis to do so.

8.2 Service providers and operators

We may use service providers for:

Website or application hosting
Cloud storage
Database services
Payment processing
Email, SMS, push and WhatsApp communications
Customer support
Analytics
Cybersecurity
Fraud prevention
Software maintenance
Accounting and
Professional legal or compliance services.

Service providers receive only the information reasonably necessary for their function and must process it under appropriate contractual and security requirements.

8.3 Business transfers

Information may be disclosed as part of a proposed or completed merger, restructuring, financing, acquisition or sale of the BookMyTable business. Any recipient must continue to handle the information lawfully.

8.4 Legal and regulatory disclosure

We may disclose information where reasonably necessary to:

Comply with a legal obligation or lawful request
Respond to a court order
Detect or prevent fraud or crime
Protect the rights or safety of BookMyTable, Establishment or Users
Enforce an agreement; or
Establish, exercise or defend a legal claim.

9. Cross-border processing

Some service providers may process or store information outside South Africa. Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer complies with POPIA, including by using:

A recipient subject to an adequate privacy law
A binding agreement providing appropriate protection
Consent where appropriate
Contractual necessity where legally permitted or
Another lawful basis for cross-border transfer.

Information may be subject to the laws of the country in which it is processed.

10. Reservation communications

We may send service communications through:

Email
SMS
WhatsApp
Push notification
Telephone or
In-Platform notification.

Service communications may include:

Booking confirmations
Booking requests and responses
Reminders
Changes or cancellations
Deposit or refund updates
Security alerts and
Important service notices.

These messages are necessary to operate the requested service and are not necessarily direct marketing. You are responsible for providing accurate contact details.

11. Direct marketing

BookMyTable may send news, Establishment promotions, special offers, platform updates or event information where permitted by law. Where prior consent is required, marketing consent will be requested separately and will not be bundled unnecessarily with acceptance of the Terms.

You may unsubscribe at any time by:

Using the unsubscribe link in an email
Replying “STOP” where that option is provided
Changing your Account preferences or
Contacting privacy@bookmytable.co.za.

Unsubscribing from marketing does not stop essential Account, security or reservation communications. BookMyTable does not authorise Establishment to use reservation information for unrelated marketing without an independent lawful basis.

12. Cookies and tracking

We may use the following cookie categories:

Essential cookies

These support login, security, reservations and core Platform operation. Disabling them may prevent the Platform from working correctly.

Preference cookies

These remember settings such as location, language or favourite options.

Analytics cookies

These help us understand how the Platform is used and identify performance issues.

Advertising or marketing cookies

Where used, these may measure campaigns or support relevant advertising. Non-essential cookies will be managed according to applicable consent requirements.

You may manage cookies through:

The Platform’s cookie controls
Your browser settings or
Your device settings.

Disabling cookies may affect some features.

13. Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or as required by law.

Retention may depend on:

Whether your Account remains active
Reservation and complaint requirements
Tax, accounting or legal obligations
Fraud-prevention requirements
Applicable limitation periods
Consent withdrawal and
Whether information is needed for legal proceedings.

Our anticipated retention periods are:

Active Account information: For the duration of the Account.
Closed Account information: 5 years after closure, unless a different period is required.
Reservation records: 5 years after the reservation.
Payment and accounting records: The period required by tax and financial law.
Support and complaint records: 3 years after resolution.
Marketing records: Until opt-out, plus a suppression record to respect the opt-out.
Security logs: 3 months, unless needed for an investigation.
Unsuccessful or abandoned booking data: 3 months.

When information is no longer required, we will securely delete, destroy, de-identify or anonymise it, subject to lawful retention requirements.

14. Information security

We use reasonable and appropriate technical and organisational safeguards designed to protect personal information against:

Loss
Damage
Unauthorised destruction
Unlawful access
Unauthorised use
Alteration and
Disclosure.

Safeguards may include access controls, encryption where appropriate, monitoring, backups, supplier controls, secure development measures and staff confidentiality requirements. No internet service is completely secure. You must use a strong password, protect your devices and notify us if you suspect unauthorised Account access.

15. Security compromises

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate and take appropriate action.

Where required by POPIA, we will notify:

The Information Regulator; and
Affected data subjects.

Notification will be made as soon as reasonably possible, subject to any lawful delay or instruction from law-enforcement authorities. Notifications may describe the possible consequences, steps taken, recommended protective measures and a contact point for assistance.

16. Your rights

Subject to POPIA and applicable limitations, you may have the right to:

Ask whether we hold personal information about you
Request access to your personal information;
Request correction of inaccurate or incomplete information
Request deletion or destruction where legally applicable
Object to certain processing
Withdraw consent where processing is based on consent
Object to direct marketing
Request information about recipients of your information
Lodge a complaint with the Information Regulator and
Exercise any other right provided by law.

Some requests may be refused or limited where retention or processing is required by law or necessary to protect legal rights.

17. Exercising your rights

To submit a privacy request, contact:

Email: Info@bookmytable.co.za

Your request should describe the information or action required. We may request reasonable proof of identity before acting on a request. This protects personal information from unauthorised disclosure. Applicable POPIA Forms, including forms for objections and correction or deletion requests, should also be made available through BookMyTable’s PAIA Manual or privacy request page. We will respond within the period required by applicable law.

18. Complaints to the Information Regulator

We encourage you to contact our Information Officer first so that we can attempt to resolve your concern. You also have the right to lodge a complaint with the Information Regulator of South Africa.

Information Regulator South Africa
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200
Toll-free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: www.inforegulator.org.za

The Regulator may require its prescribed complaint form.

19. Children’s information

BookMyTable is not intended for independent use by children under 18. A person under 18 may use the Platform only under the active supervision of a parent or legal guardian. We do not knowingly collect children’s personal information without appropriate authorisation or another lawful basis. If you believe a child has provided information unlawfully, contact info@bookmytable.co.za. We will investigate and take appropriate action, which may include deleting the information.

20. Automated decision-making

BookMyTable may use automated tools to support search ranking, Establisments recommendations, security and fraud detection. We will not make a decision based solely on automated processing where that decision produces legal or similarly significant effects, unless permitted by law and subject to appropriate safeguards. Where applicable, you may request information about or human review of such a decision.

21. Third-party websites and services

The Platform may contain links to the Establishment websites, maps, payment providers, social networks or other third-party services. Those parties operate independently and may have their own privacy policies. BookMyTable is not responsible for their independent privacy practices. Review the relevant third party’s privacy notice before providing information directly to it.

22. Changes to this Privacy Policy

We may update this Policy to reflect changes in our services, practices or legal obligations. The updated Policy will be published with a revised effective date. Where a change is material, we will take reasonable steps to notify affected Users. Where a new purpose requires consent, we will request that consent rather than treating continued use as automatic consent.