Privacy Policy

Last updated: 4 November 2026

This Privacy Policy explains how Seren Tech (Pty) Ltd (“Seren Tech”, “we”, “our” or “us”), a company registered in the Republic of South Africa, collects, uses, discloses, and protects personal information when you use the Seren Nudge mobile application and related services (the “App”). This Policy is intended to comply with the Protection of Personal Information Act, 2013 (“POPIA”).

By using the App, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the App.

1. Introduction

1.1 Seren Tech (Pty) Ltd acts as the “responsible party” under POPIA for personal information processed through the App.

1.2 The Information Officer for POPIA purposes is Lwando Kelembe.

1.3 The purpose of this Policy is to describe how we collect, use, share, store, secure, and retain personal information, as well as the rights available to you under South African law.

2. Information We Collect

2.1 Information from Users (customers):

Name and surname
Email address
Mobile phone number
Payment information (processed via a licensed third-party payment processor — we do not store full card details on our servers)
Order history and preferences
Optional profile information and feedback

2.2 Information from Vendors (restaurants, food vendors and event vendors):

Business name, contact person, and contact details
Menu items, pricing, and availability
Branding and Client Identity (CI) information (including business logo URL or other branding assets you provide as text or URL fields)
Billing details and transaction records
Business or venue address or place descriptions you enter (these are business profile fields, not device GPS)

2.3 Information collected automatically:

Device information (device model, operating system, unique identifiers)
App usage analytics and performance metrics
Log data (IP address, timestamps, error logs)

2.4 Camera:

If you grant camera access, the App uses the device camera only to scan QR codes (for example, business, venue, session or collection QR codes) so we can open the correct ordering or collection flow and support order notifications. We do not capture, upload, or store camera images or video from QR scanning. Camera access can be revoked in device settings; QR features that need the camera will then be unavailable.

2.5 Device location:

The App does not request Android location permissions and does not collect or store device GPS or location history. Separately, business and venue address text that vendors or venues enter as part of their profile or events is stored as ordinary business data (see section 2.2).

3. How We Use Information

We use personal information to:

Process and deliver orders placed through the App
Notify customers when orders are ready and support order tracking
Provide services to Vendors, including menu management, Client Identity (CI) templates, and billing support
Facilitate payments and resolve payment-related queries through a licensed third-party payment processor
Communicate with Users and Vendors regarding service updates, support, and changes to policies
Improve the App’s functionality, reliability, and customer experience through analytics and diagnostics
Comply with legal obligations and enforce our Terms and Conditions

4. Sharing of Data

4.1 Vendors: We share only the minimum customer information necessary for Vendors to fulfil orders (for example, order contents, collection details, and relevant contact fields if needed for collection or support).

4.2 Payment processor: We share data with a licensed third-party payment processor strictly to facilitate and reconcile payments. We do not store full card details on our servers.

4.3 Event Partners and Service Providers: We may share data with event organisers and service providers (for example, cloud hosting, analytics, push notifications) under appropriate contractual safeguards.

4.4 Legal Compliance and Protection: We may disclose information where required by law or a valid legal process, or to protect our rights, Users, Vendors or the public.

4.5 No Sale of Personal Data: We do not sell personal information to third parties.

5. Storage & Security

5.1 Infrastructure: Data is stored on secure cloud infrastructure (for example, Firebase and Google Cloud) with industry-standard security controls.

5.2 Access Controls: Access is restricted to authorised personnel on a need-to-know basis. We employ authentication, role-based access controls, and monitoring.

5.3 Encryption: Data is encrypted in transit (TLS). Where appropriate, we apply encryption at rest.

5.4 Security Measures: We implement reasonable technical and organisational measures to prevent unauthorised access, loss, misuse, or alteration of personal information.

6. Data Retention

6.1 Account data: We retain account profile information while your account remains active. After account closure, we delete or anonymise account personal information within 90 days, except where a longer period is required by law or this Policy (for example, order and payment records below).

6.2 Orders, transactions, and payment records: Order, transaction, and payment-related records are retained for 5 years to meet South African tax and accounting requirements. Deletion or anonymisation requests for these records may be limited to the extent required by law during that period.

6.3 Device location: The App does not collect device location data.

6.4 Camera and QR: QR scanning does not create stored camera images. Decoded QR content is used only to open the relevant App flow.

6.5 When personal information is no longer required for the purposes above, we will securely delete or anonymise it in accordance with our procedures and applicable laws.

7. Your Rights (POPIA)

Under POPIA, you have the right to:

Request access to your personal information
Request correction, update, or deletion of personal information (subject to lawful retention obligations)
Object to the processing of personal information for direct marketing purposes
Withdraw consent where processing is based on consent (without affecting the lawfulness of processing before withdrawal)
Lodge a complaint with the Information Regulator (South Africa)

Information Regulator (South Africa):

Website: https://inforegulator.org.za/
Email: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za

To exercise your rights, contact the Information Officer using the details in section 10.

8. Children’s Data

8.1 The App is not directed at children. Persons under 18 may use the App only with the consent of a parent or legal guardian.

8.2 If we become aware that we have collected personal information from a child without appropriate parent or guardian consent, we will take steps to delete such information as required by law.

9. Changes to This Policy

9.1 We may update this Privacy Policy from time to time. Material changes will be communicated via the App and/or by email.

9.2 Continued use of the App after changes take effect constitutes acceptance of the updated Policy.

10. Contact Us

For privacy enquiries, requests, or complaints, please contact:

Seren Tech (Pty) Ltd
Information Officer: Lwando Kelembe
Email: info@serentech.co.za
Address: 64 Stallion Road, Beaulieu Estates, Midrand, 1684

You also have the right to lodge a complaint with the Information Regulator (South Africa) using the contact details in section 7.