Privacy Policy

1. Introduction

Roman's Pizza (Pty) Ltd ("Roman's Pizza", "we", "us", or "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) and all applicable South African data protection legislation.

This Privacy Policy explains what personal information we collect through our Feedback Platform, how we use it, who we share it with, and what your rights are.

2. Responsible Party

Roman's Pizza (Pty) Ltd is the responsible party as defined under POPIA. For questions about your personal information, contact us at:

• Information Officer: Roman's Pizza Head Office
• Email: privacy@romanspizza.co.za
• Website: www.romanspizza.co.za

3. What Personal Information We Collect

When you submit feedback through this platform, we may collect:

• Contact information: Full name, phone number, and email address (optional).
• Feedback data: Your rating, comments, selected tags (e.g. taste, speed, service), and order number (if provided).
• Store information: Which store you visited.
• Technical data: Browser type, IP address, and device information collected automatically for security and analytics purposes.

4. Purpose of Processing

We process your personal information for the following lawful purposes:

• To respond to your feedback and resolve any complaints.
• To improve our products, services, and customer experience.
• To monitor and improve individual store performance.
• To generate aggregated, anonymised reports for business analysis.
• To comply with legal obligations.

5. Legal Basis for Processing

We process your personal information based on:

• Consent: By voluntarily submitting feedback, you consent to the processing of your personal information as described in this policy.
• Legitimate interest: To improve our services and respond to customer concerns.
• Legal obligation: Where required by applicable law.

6. Who We Share Your Information With

We may share your personal information with:

• Franchisees: The specific store you visited, to address your feedback directly.
• Service providers: Technology partners who help us operate this platform (e.g. hosting, database, email delivery). These providers are bound by data processing agreements.
• Regulatory bodies: Where required by law or regulation.

We do not sell your personal information to third parties.

7. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, typically for a period of 24 months from the date of submission. Anonymised, aggregated data may be retained indefinitely for analytics.

8. Your Rights Under POPIA

You have the right to:

• Access: Request confirmation of whether we hold your personal information and request a copy.
• Correction: Request that inaccurate or incomplete information be corrected.
• Deletion: Request the deletion of your personal information where it is no longer necessary.
• Object: Object to the processing of your personal information on reasonable grounds.
• Withdraw consent: Withdraw your consent to processing at any time, without affecting the lawfulness of prior processing.
• Complaint: Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, please contact us at privacy@romanspizza.co.za.

9. Security Measures

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration. These include encryption in transit (HTTPS/TLS), secure database storage, access controls, and regular security reviews.

10. Cross-Border Data Transfers

Your data may be processed by service providers located outside South Africa. Where this occurs, we ensure that adequate safeguards are in place as required by POPIA, Section 72, including contractual obligations that provide equivalent data protection.

11. Cookies and Tracking

This platform uses essential cookies only to ensure functionality. We do not use third-party advertising or tracking cookies. No personal information is collected through cookies beyond what is necessary for platform operation.

12. Children's Information

This platform is not directed at children under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child's personal information has been collected, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.

14. Contact the Information Regulator

If you are unsatisfied with how we handle your personal information, you may lodge a complaint with:

• The Information Regulator (South Africa)
• Email: complaints.IR@justice.gov.za
• Website: inforegulator.org.za