Privacy Policy

Your personal information is collected and processed by:

Muncho (Pty) Ltd (Registration No. K2024178461), the operating company through which orders, payments and deliveries are processed and student welfare programmes, events and giveaways are fulfilled; and

Muncho Foundation NPC (Registration No. K2025045018), a non-profit company registered as a Nonprofit Organisation with the Department of Social Development (NPO Registration No. 318-776 NPO), under whose direction student welfare programmes, events and giveaways are conducted,

together referred to as "Muncho", "we", "us" or "our", each acting as a responsible party under POPIA.

Registered address: 5th Floor, The Link, 173 Oxford Road, Rosebank, Johannesburg, 2196
Information Officer: Ahmed Masoud
Email: privacy@muncho.co.za

Personal Information: When you register for our services or participate in our events or giveaways, we collect information such as your name, student identification, contact details, residence or building, and delivery details.

Study and funding details: At checkout we ask for your year of study, your course, how your studies are funded (for example NSFAS, a bursary, a student loan or family support) and when you usually receive your funds each month. These details are required to place an order. We share them with partners only in aggregated, de-identified form, as described in section 4.

Payment Information: Payments are processed securely through our third-party payment gateway partners. Muncho does not store your full card details.

Ordering and Usage Data: We collect information about your orders and how you use our website and app, including items ordered, basket values, order times and frequency, delivery slots, voucher redemptions, IP address, device and browser type, and pages visited.

We process your personal information to:

Deliver our services: process your orders, arrange delivery to your residence, manage vouchers, and administer events and giveaways.

Communicate with you: send service updates, respond to inquiries, and (with your consent, or where otherwise permitted by section 69 of POPIA) send promotional communications, from which you may opt out at any time.

Understand where you are in your studies: use your study and funding details to understand where you are in your student journey, so that we can plan stock, delivery capacity and offers around when students receive their funds and what students need at each stage of study.

Improve Muncho: analyse ordering and usage patterns to improve our product range, pricing, delivery scheduling and user experience.

Generate partner insights: produce aggregated, de-identified analytics as described in section 4 below.

Protect Muncho and our users: prevent fraud, unauthorised transactions and misuse of our services.

Comply with the law: meet our legal, regulatory and tax obligations.

We only process personal information where we have a lawful basis to do so under POPIA, including performance of our agreement with you, your consent, compliance with law, or our legitimate interests.

Service providers: We share information with trusted service providers who help us operate, including delivery personnel, payment processors, and IT and analytics providers. These parties act as operators under POPIA and may only use your information on our instructions.

Residence security and reception: When your order is handed over at your residence, we give the residence's security or reception staff your name and order details so that they can hold your order and release it to you. They are third parties, not operators acting on our instructions, and we share only what they need for the handover.

Aggregated partner insights: Muncho works with commercial partners, such as brands, retailers, financial services providers and suppliers, to bring students better prices, products and offers. As part of these partnerships, we share aggregated, de-identified insights (for example, ordering volumes, popular products, basket trends, peak ordering times by residence or region, and how needs and spending differ by year of study, funding type and time of the month). This information does not identify you personally and is not personal information under POPIA.

Identifiable information, only with your consent: We will only share information that identifies you personally with a commercial partner if you have given us your express, opt-in consent. You can withdraw this consent at any time by emailing privacy@muncho.co.za, without affecting your ability to use Muncho's core services.

We never sell your identifiable personal information to anyone.

Legal requirements: We may disclose your information where required by law, regulation, court order, or to protect our rights or the safety of our users.

Business transfers: If Muncho is involved in a merger, acquisition or sale of assets, your information may be transferred to the new entity, which will remain bound by this Privacy Policy or one offering equivalent protection, and you will be notified.

Transfers outside South Africa: Some of our service providers, including our e-commerce platform, hosting and cloud storage providers, store or process personal information on servers outside South Africa, including in Singapore. We only transfer personal information outside South Africa as permitted by section 72 of POPIA, for example where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, or where the transfer is necessary to perform our agreement with you.

We implement appropriate, reasonable technical and organisational safeguards as required by section 19 of POPIA to protect your personal information against loss, damage, unauthorised access and unlawful processing. While no method of transmission or storage is completely secure, we regularly review and update our security measures.

Breach notification: If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and, where required, you, as soon as reasonably possible in accordance with section 22 of POPIA.

We keep your personal information only for as long as necessary to provide our services to you, to comply with legal, tax and accounting obligations, or to resolve disputes. Aggregated, de-identified data may be retained indefinitely. When personal information is no longer needed, we delete or de-identify it securely.

Under POPIA, you have the right to:

Access the personal information we hold about you.

Correct or update inaccurate or incomplete information.

Request deletion of your personal information, subject to our legal retention obligations.

Object to processing based on our legitimate interests.

Withdraw consent at any time where processing is based on consent (including partner-sharing and marketing consent) by emailing privacy@muncho.co.za.

Opt out of direct marketing at any time.

Lodge a complaint with the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za or www.inforegulator.org.za

To exercise any of these rights, contact our Information Officer at privacy@muncho.co.za. We aim to respond within a reasonable time, typically within 3 to 5 business days.

Our website uses cookies to enhance your experience. Cookies are small data files stored on your device that help us understand how you interact with our site, remember your preferences, and measure performance. You can manage or disable cookies through your browser settings, though some features of our site may not function fully without them.

Muncho's services are intended for users who are 18 years of age or older. By registering for or using our services, you confirm that you are 18 or older, or that you have the authorisation described below.

Persons under the age of 18 may not use the platform unless their use has been authorised by a parent or legal guardian, who consents to the processing of the minor's personal information in accordance with this Privacy Policy and section 35 of POPIA.

If we become aware that we have collected personal information from a person under 18 without the required parental or guardian consent, we will take steps to delete that information and may suspend or terminate the relevant account.

We may update this Privacy Policy from time to time. We will notify you of material changes, including any change to how we share information with partners, by email, in-app notice, or prominent notice on our website before the change takes effect. Continued use of our services after notified changes constitutes acceptance, except where POPIA requires us to obtain your fresh consent.

This Privacy Policy is governed by the laws of the Republic of South Africa. Any disputes arising from it will be subject to the exclusive jurisdiction of the South African courts.