Privacy PolicyHow FoodSafetyNet protects your personal information

Effective date: 23 October 2026 · Last reviewed: 23 October 2026

FoodSafetyNet (“FoodSafetyNet”, “we”, “us” or “our”) operates the website at www.food-safety.net and the FoodSafetyNet food safety management software (together, the “Services”). We respect your privacy and are committed to protecting personal information lawfully and transparently, in line with South Africa’s Protection of Personal Information Act, 2013 (POPIA) and other applicable laws. This policy explains what personal information we collect, why and how we use it, who we share it with, how we protect it, and the rights you have.

Please read it together with any agreement you have with us. By using the Services you acknowledge this policy. If you do not agree with it, please do not use the Services.

1. Who is responsible for your information

Because FoodSafetyNet is both a website and a hosted (cloud) application, our role differs depending on the information:

Where we are the Responsible Party. For visitors to our website, and for the account and billing details of our customers, FoodSafetyNet is the Responsible Party under POPIA — we decide why and how that information is processed, and this policy governs it.
Where we are an Operator. For the operational records a customer captures inside the app — their staff, training, supplier, visitor and similar records that may contain personal information — the customer is the Responsible Party and FoodSafetyNet acts as an Operator (processor). We process that information only on the customer’s documented instructions, under an operator arrangement, with appropriate security, and never for our own purposes. If your personal information is held in a customer’s site because you work for or supply them, please direct requests about it to that organisation; we will support them in responding.

2. Our Information Officer

As required by POPIA, we have designated an Information Officer who is responsible for how we handle personal information and for dealing with your requests and complaints:

Information Officer: Bruce Cohen
Email: info@food-safety.net
Telephone: 083 454 1857

3. The personal information we collect

(a) Website visitors. When you browse www.food-safety.net or fill in a form, we may collect your name, email address, telephone number and the content of your message, together with technical information your browser sends automatically (IP address, device and browser type, pages viewed, and the date and time) and cookie data (see section 6).

(b) Account holders and billing. When you sign up for or administer a FoodSafetyNet account, we collect your name, email address, role, the business name and registration details you provide, sign-in credentials (passwords are stored only as secure one-way hashes, never in plain text), and billing information needed to process any subscription. Payment card details, where applicable, are handled by our payment provider and are not stored by us.

(c) Information processed on your customers’ behalf (as Operator). Inside the app, a customer may record information that includes personal information about their own people and contacts — for example staff names, roles and training records, illness-exclusion and return-to-work records, supplier and service-provider contacts, auditor and visitor details, and the author, time and reason stamped on each record and e-signature. We process this only to provide the Services to that customer.

(d) What we ask you not to enter. The Services are not intended for personal information that is not needed for food safety management. Please do not capture more special personal information (see section 11) than a food safety record genuinely requires.

4. Why we process personal information, and on what basis

We process personal information for these purposes, each with a lawful basis under POPIA:

To provide and operate the Services — creating and running your account and sites, keeping your records, and delivering the features you use (performance of our agreement with you).
To communicate with you — responding to enquiries, sending service messages, reminders and alerts you have set up (performance of our agreement, and your consent for optional messages).
To take payment for paid subscriptions (performance of our agreement, and legal obligations such as tax record-keeping).
To keep the Services secure and working — preventing abuse, diagnosing problems, maintaining audit trails and backups (our legitimate interests and legal obligations).
To improve the Services — understanding, in aggregate, how the website and app are used (our legitimate interests; we use de-identified or aggregated data where we can).
To meet legal obligations — complying with the law and with lawful requests from authorities.

We do not use the operational records held inside a customer’s site for our own marketing or profiling.

5. How we meet POPIA’s eight conditions

We aim to process personal information in line with the eight conditions for lawful processing set out in POPIA:

Accountability — we take responsibility for meeting these conditions and have an Information Officer in place.
Processing limitation — we process personal information lawfully, minimally (only what is needed), and with your consent or another lawful justification.
Purpose specification — we collect it for the specific, explicit purposes set out above and keep it only as long as needed (section 10).
Further processing limitation — we use it only for purposes compatible with those for which it was collected.
Information quality — we take reasonable steps to keep it accurate and up to date, and give you tools to correct your own records.
Openness — we are transparent through this policy and our PAIA manual (section 14).
Security safeguards — we protect it with appropriate technical and organisational measures (section 9).
Data subject participation — we give you the rights set out in section 13.

6. Cookies and similar technologies

Our website uses a small number of cookies and similar technologies that are necessary for it to work and to keep you signed in, and may use privacy-respecting analytics to understand site usage in aggregate. You can control or delete cookies through your browser settings; blocking strictly necessary cookies may stop parts of the site or app from working. Where the law requires consent for non-essential cookies, we will ask for it.

7. Who we share information with

We do not sell your personal information. We share it only as needed to run the Services, and only with parties bound by confidentiality and (where they act as our Operators) by written operator agreements:

Hosting and infrastructure providers that store and run the Services on our behalf.
Communication providers used to send email alerts and service messages.
Payment providers that process subscription payments.
Professional advisers (for example auditors or legal advisers) where necessary and under a duty of confidentiality.
Authorities where we are required by law, or to protect our rights, users or the public.
A successor in the event of a merger, acquisition or sale of assets, subject to this policy.

Within a customer’s own site, the people the customer authorises (for example a Site Manager, QA or an auditor given a time-limited guest link) can see the records according to the roles and permissions the customer sets.

8. Sending information outside South Africa

Our hosting and some service providers may store or process information outside South Africa. Where personal information is transferred across a border, we do so in line with section 72 of POPIA — for example because the recipient is subject to a law or binding agreement that provides an adequate, comparable level of protection, because the transfer is necessary to perform our agreement with you, or with your consent. You can ask us about the safeguards we use.

9. How we keep your information safe

We take the security of personal information seriously and apply reasonable technical and organisational safeguards as required by section 19 of POPIA, including: encryption of data in transit (HTTPS), passwords stored only as secure hashes, role-based access controls, an audit trail of approvals and e-signatures, session protection, regular backups, and measures to help detect and respond to incidents. No system can be guaranteed perfectly secure, but we work to protect your information and to meet our obligations — including, where the law requires, notifying you and the Information Regulator of a compromise of your personal information.

10. How long we keep it

We keep personal information only for as long as it is needed for the purposes set out in this policy, or for as long as the law requires (for example tax and accounting records). Operational records held on a customer’s behalf are kept according to that customer’s instructions and their own retention obligations; food safety records in particular often have to be retained for set periods. When information is no longer needed, we delete or de-identify it.

11. Special personal information and children

Some food safety records can contain special personal information — for example a staff member’s health or illness-exclusion details. Where we process such information as an Operator, we do so only on the customer’s instruction and on a lawful basis under POPIA (such as it being necessary for the customer’s obligations in employment law or food safety law), and we restrict access to it. The Services are intended for use by businesses and are not directed at children; we do not knowingly collect the personal information of a child except where it forms part of a record a customer is lawfully required to keep.

12. Direct marketing

We will only send you electronic marketing where the law allows — because you are an existing customer for similar services, or because you have consented. Every marketing message gives you an easy way to opt out, and you can also contact us at any time to unsubscribe. We do not use customers’ operational records for marketing.

13. Your rights

Subject to the limits POPIA allows, you have the right to:

Be informed about how we process your personal information (this policy).
Access the personal information we hold about you, and ask who it has been shared with.
Correct or update information that is inaccurate, out of date or incomplete.
Delete or destroy information we no longer have a lawful basis to keep.
Object to processing based on our legitimate interests or for direct marketing.
Withdraw consent you have given, without affecting processing already carried out.
Complain to us and to the Information Regulator (section 15).

To exercise any of these, email our Information Officer at info@food-safety.net. We may need to verify your identity, and we will respond within a reasonable time. If your information sits inside a customer’s site (section 1), we will refer you to, and assist, that customer as the Responsible Party. Some requests can be made on the Regulator’s prescribed forms under POPIA and the Promotion of Access to Information Act, 2000 (PAIA).

14. Other laws and standards

PAIA. Our manual under the Promotion of Access to Information Act, 2000 explains how to request access to records; ask us for a copy.
GDPR and other jurisdictions. If you are in a region with its own data protection law (such as the EU/UK General Data Protection Regulation), we will handle your personal information in line with that law where it applies to us, giving you equivalent rights of access, correction, erasure and objection.
Food safety standards. FoodSafetyNet helps businesses keep records for standards such as R638, SANS 10049, SANS 10330 and FSSC 22000. Those records can contain personal information, which the customer controls as Responsible Party; keeping such records does not change your rights under this policy.

15. Complaining to the Information Regulator

If you believe we have not handled your personal information lawfully, we ask you to contact us first so we can try to put it right. You also have the right to complain to the Information Regulator (South Africa):

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Email: enquiries@inforegulator.org.za
Telephone: 010 023 5200 · Toll-free: 0800 017 160
Website and complaint forms: inforegulator.org.za

16. Changes to this policy

We may update this policy from time to time to reflect changes in our Services or the law. We will post the updated version here and change the “Last reviewed” date above; significant changes may also be notified to account holders. Please check back from time to time.

17. Contact us

For any question about this policy or your personal information, contact our Information Officer:

This policy is provided for transparency and does not constitute legal advice. It should be kept current with the business’s actual processing activities (hosting, payment and analytics providers) and, where appropriate, reviewed by a legal adviser.

← Back to home