Privacy Policy

Your personal information is collected and processed by:

Muncho (Pty) Ltd, the operating company through which orders, payments and deliveries are processed; and

Muncho Foundation NPO The non-profit company through which certain student welfare programmes, events and giveaways are run,

together referred to as "Muncho", "we", "us" or "our", each acting as a responsible party under POPIA.

Registered address: 177 Baker Street, Rosebank, Johannesburg
Information Officer: Ahmed Masoud
Email: privacy@muncho.co.za

Personal Information: When you register for our services or participate in our events or giveaways, we collect information such as your name, student identification, contact details, residence or building, and delivery details.

Payment Information: Payments are processed securely through our third-party payment gateway partners. Muncho does not store your full card details.

Ordering and Usage Data: We collect information about your orders and how you use our website and app, including items ordered, basket values, order times and frequency, delivery slots, voucher redemptions, IP address, device and browser type, and pages visited.

We process your personal information to:

Deliver our services: process your orders, arrange delivery to your residence, manage vouchers, and administer events and giveaways.

Communicate with you: send service updates, respond to inquiries, and (with your consent, or where otherwise permitted by section 69 of POPIA) send promotional communications, from which you may opt out at any time.

Improve Muncho: analyse ordering and usage patterns to improve our product range, pricing, delivery scheduling and user experience.

Generate partner insights: produce aggregated, de-identified analytics as described in section 4 below.

Protect Muncho and our users: prevent fraud, unauthorised transactions and misuse of our services.

Comply with the law: meet our legal, regulatory and tax obligations.

We only process personal information where we have a lawful basis to do so under POPIA, including performance of our agreement with you, your consent, compliance with law, or our legitimate interests.

Service providers: We share information with trusted service providers who help us operate, including delivery personnel, building or residence security and reception (for order handover), payment processors, and IT and analytics providers. These parties act as operators under POPIA and may only use your information on our instructions.

Aggregated partner insights: Muncho works with commercial partners, such as brands, retailers, financial services providers and suppliers, to bring students better prices, products and offers. As part of these partnerships, we share aggregated, de-identified insights (for example, ordering volumes, popular products, basket trends, and peak ordering times by residence or region). This information does not identify you personally and is not personal information under POPIA.

Identifiable information, only with your consent: We will only share information that identifies you personally with a commercial partner if you have given us your express, opt-in consent. You can withdraw this consent at any time by emailing privacy@muncho.co.za, without affecting your ability to use Muncho's core services.

We never sell your identifiable personal information to anyone.

Legal requirements: We may disclose your information where required by law, regulation, court order, or to protect our rights or the safety of our users.

Business transfers: If Muncho is involved in a merger, acquisition or sale of assets, your information may be transferred to the new entity, which will remain bound by this Privacy Policy or one offering equivalent protection, and you will be notified.

We implement appropriate, reasonable technical and organisational safeguards as required by section 19 of POPIA to protect your personal information against loss, damage, unauthorised access and unlawful processing. While no method of transmission or storage is completely secure, we regularly review and update our security measures.

Breach notification: If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and, where required, you, as soon as reasonably possible in accordance with section 22 of POPIA.

We keep your personal information only for as long as necessary to provide our services to you, to comply with legal, tax and accounting obligations, or to resolve disputes. Aggregated, de-identified data may be retained indefinitely. When personal information is no longer needed, we delete or de-identify it securely.

Under POPIA, you have the right to:

Access the personal information we hold about you.

Correct or update inaccurate or incomplete information.

Request deletion of your personal information, subject to our legal retention obligations.

Object to processing based on our legitimate interests.

Withdraw consent at any time where processing is based on consent (including partner-sharing and marketing consent) by emailing privacy@muncho.co.za.

Opt out of direct marketing at any time.

Lodge a complaint with the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za or www.inforegulator.org.za

To exercise any of these rights, contact our Information Officer at privacy@muncho.co.za. We aim to respond within a reasonable time, typically within 3 to 5 business days.

Our website uses cookies to enhance your experience. Cookies are small data files stored on your device that help us understand how you interact with our site, remember your preferences, and measure performance. You can manage or disable cookies through your browser settings, though some features of our site may not function fully without them.

Muncho's services are intended for users who are 18 years of age or older. By registering for or using our services, you confirm that you are at least 18 years old.

Persons under the age of 18 may not use the platform unless their use has been authorised by a parent or legal guardian, who consents to the processing of the minor's personal information in accordance with this Privacy Policy and section 35 of POPIA.

If we become aware that we have collected personal information from a person under 18 without the required parental or guardian consent, we will take steps to delete that information and may suspend or terminate the relevant account.

We may update this Privacy Policy from time to time. We will notify you of material changes, including any change to how we share information with partners, by email, in-app notice, or prominent notice on our website before the change takes effect. Continued use of our services after notified changes constitutes acceptance, except where POPIA requires us to obtain your fresh consent.

This Privacy Policy is governed by the laws of the Republic of South Africa. Any disputes arising from it will be subject to the exclusive jurisdiction of the South African courts.