Privacy Policy
What we collect, why, who we share it with, and your rights under POPIA.
This Privacy Policy describes how SA FITFOODZ (Pty) Ltd ("FitFoodz", "we", "us", "our"), registration number 2018/559835/07, operating fitfoodz.co.za (the "Site") and the FitFoodz mobile app, collects, uses and discloses your Personal Information. It is governed by the Protection of Personal Information Act 4 of 2013 ("POPIA").
Last updated: 4 October 2026
Contact
If you have questions about this policy, want to know more about our privacy practices, or want to exercise any of your rights under POPIA, including access, correction, deletion or objection, contact our Information Officer:
Information Officer: Willem Christiaan Reynders Information Regulator registration: 2026-064957 Email: [email protected] Phone and WhatsApp: 072 522 7099 Address: SA FITFOODZ (Pty) Ltd, 77 Walter Sisulu Lane, Miederpark, Potchefstroom, 2531, South Africa
Our manual in terms of the Promotion of Access to Information Act 2 of 2000 is published at /pages/paia-manual. Our full company details are at Contact information.
Information We Collect
When you visit the Site, use our app, or make a purchase, we collect:
Device and browsing information. Collected automatically using cookies, pixels, tags and similar technologies. Includes your IP address, browser type and version, operating system, device identifiers, time zone, referring URLs, pages viewed, search terms and how you interact with the Site.
Order and account information. Collected directly from you. Includes your name, email address, telephone number, billing address, delivery address, dietary preferences and goals (where you give these through our calorie quiz or meal plan selection), order history and payment information. Card details are entered on our payment provider's own secure page and are not stored on our systems.
Customer support information. What you tell us when you contact us by email, WhatsApp or any other channel.
Health and fitness information (the app, and only if you choose to give it). See the separate section below. This is special personal information under POPIA and we treat it differently from everything else here.
Marketing and advertising information. Hashed identifiers, such as email addresses transformed with SHA-256, used for advertising matching and audience building, as described under "Advertising and Marketing".
How We Use Your Personal Information
- To process and fulfil your orders, including payment, courier dispatch and order communication
- To provide customer support and answer your questions
- To send you transactional messages, such as order confirmations and delivery windows, by email and WhatsApp
- To send you marketing about our products, promotions and loyalty programme, where you have consented or where the law permits it. You can opt out at any time
- To personalise the Site and the app, recommend meal plans and improve your experience
- To measure and improve our advertising on Meta (Facebook and Instagram), TikTok and Google
- To detect and prevent fraud, abuse, security problems and unlawful activity
- To meet our legal and regulatory obligations
- To understand and improve our business through analytics
Health and Fitness Information
This section applies only if you use the FitFoodz mobile app and choose to record this information. You do not have to. Nothing about ordering meals requires it.
If you choose to, the app can record your weight, body measurements, body fat estimate, daily food log, activity, progress photographs and the macro targets calculated from them.
- This is special personal information under section 26 of POPIA, and we process it only with your express consent, given when you first record it.
- We use it for one purpose: to show you your own progress and to work out your targets inside your own FitFoodz account.
- We do not use it for advertising. It is never sent to Meta, TikTok, Google or any other advertising platform, and it is never sold or shared with a data broker.
- Progress photographs are held in private storage that requires authentication to read.
- You can withdraw consent and ask us to delete it at any time, using the contact details above, and we will do so.
Apple Health (iOS). If you connect Apple Health, the app reads your daily step count and uses it only to set and track a personalised step goal alongside your meals. It is stored on our own servers for that purpose only, is never used for advertising or marketing and is never shared with any third party or data broker. You can revoke access at any time in iOS Settings, Privacy and Security, Health, FitFoodz, and you can ask us to delete it.
The app has its own, fuller privacy policy at /pages/mobile-app-privacy-policy.
How We Share Your Personal Information
We share Personal Information with these categories of service provider, each processing it on our behalf:
E-commerce platform
- Shopify Inc., which operates our online store, processes orders and stores customer records. https://www.shopify.com/legal/privacy
Payment processing. Card details are entered on the provider's own secure page. We do not store full card numbers.
- Stitch Money (Pty) Ltd, for card, instant EFT and wallet payments, and for Pay Later where you choose to pay in instalments
- Peach Payments (Pty) Ltd, for card and wallet payments
- Payflex (Pty) Ltd, for instalment payments made through our Shopify checkout
- PayFast (DPO Payments), which bills the FitFoodz+ membership in the app
Delivery
- Aramex South Africa, and our other courier partners, for national delivery. We share your name, delivery address and contact number so that they can deliver to you
- Our own drivers, for local delivery in Potchefstroom, Gauteng and the Western Cape
- Omnisend, which sends transactional and marketing email on our behalf
- Amazon Web Services (Amazon SES), which sends email from our own platform
WhatsApp messaging
- Meta Platforms (WhatsApp Business Platform), for transactional and marketing messages to customers who have engaged with us on WhatsApp
Advertising and analytics
- Meta Platforms, through the Meta Pixel and the Conversions API
- TikTok, through the TikTok Pixel and the Events API
- Google, through Google Ads tags, Google Analytics and Google Merchant Center
- Judge.me, which collects and publishes product reviews
We may also disclose Personal Information to comply with the law, a court order or a lawful request by a public authority; to enforce our terms or protect our rights, property or safety or those of our customers; and in a merger, acquisition, financing or sale of assets, where the recipient must honour this policy.
Advertising and Marketing
We use the Meta Pixel, the TikTok Pixel and Google Ads tags to measure how our advertising performs and to show you advertisements that may be relevant, on Facebook, Instagram, TikTok, YouTube and across the Google Display Network.
To make that measurement accurate we also use server-side event sharing, called the Conversions API by Meta and the Events API by TikTok. This sends hashed identifiers, such as your email address transformed with SHA-256, from our servers to those platforms. It lets them match your activity on our Site to your account with them without ever exposing your raw email address to them. We do this in reliance on our legitimate interest in marketing our products effectively, and you may object to it at any time using the contact details above.
We never send health or fitness information to any advertising platform.
You can opt out of interest-based advertising with the platforms directly:
- Meta: https://www.facebook.com/help/568137493302217
- TikTok: https://www.tiktok.com/legal/page/global/privacy-policy/en, see "Your Rights"
- Google Ads: https://adssettings.google.com
- Google Analytics: https://tools.google.com/dlpage/gaoptout
You can unsubscribe from marketing email using the link in any marketing email, and stop WhatsApp marketing by replying STOP. Opting out of one channel does not opt you out of the others, because your consent is given per channel. Tell us if you want out of all of them and we will do that.
Cookies and Similar Technologies
We use cookies and similar technologies (pixels, tags, web beacons, local storage) to run the Site, remember your preferences, understand how the Site is used and deliver advertising:
- Strictly necessary cookies, required for the Site to work at all: cart, checkout, sign-in, security
- Analytics cookies: Shopify Analytics, Google Analytics
- Advertising cookies: Meta Pixel, TikTok Pixel, Google Ads tags
You can control cookies in your browser settings. Blocking strictly necessary cookies will stop parts of the Site working. See https://www.allaboutcookies.org for how, and https://www.shopify.com/legal/cookies for the cookies set by the platform that powers our Site.
Your Rights Under POPIA
- Access. Ask for a copy of the Personal Information we hold about you
- Correction. Ask us to correct anything inaccurate or incomplete
- Deletion. Ask us to delete your Personal Information, subject to records we are legally required to keep, such as tax records
- Objection. Object to processing for direct marketing, or to processing based on legitimate interests
- Withdraw consent. Where we rely on your consent, withdraw it at any time
- Complain. To the Information Regulator, if you believe we have handled your Personal Information unlawfully
To exercise any of these, contact us using the details above. We will respond within a reasonable period and in any event within 30 days.
Data Retention
We keep your Personal Information for as long as we need it to provide our services, meet our legal obligations (South African tax law requires transactional records to be kept for at least five years), resolve disputes and enforce our agreements. Marketing preferences are kept until you opt out. Health and fitness information is kept until you delete it or ask us to.
Data Security
We use appropriate technical and organisational measures to protect your Personal Information against unauthorised access, alteration, disclosure or destruction, including encrypted connections (HTTPS), access controls, vendor due diligence and secure server hosting. No method of internet transmission or electronic storage is completely secure, so we cannot guarantee absolute security.
International Data Transfers
Some of our service providers, including Shopify, Meta, TikTok, Google and Amazon Web Services, are outside South Africa, mainly in the United States, Ireland and the European Union. Where Personal Information goes outside South Africa we rely on those providers' compliance with comparable data protection laws, or on contractual safeguards, as POPIA requires.
Children's Privacy
The Site is not directed at children under 18 and we do not knowingly collect Personal Information from children under 18. If you believe we have, please contact us so that we can delete it.
Do Not Track
There is no consistent industry standard for responding to "Do Not Track" browser signals, so we do not currently change our data collection in response to them.
Changes to This Policy
We may update this policy to reflect changes in our practices, our services or the law. The updated version is shown by a new "Last updated" date and takes effect as soon as it is published.
Complaints
Please contact us first, using the details above. If you are not satisfied with our answer, you may complain to:
The Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Telephone: 010 023 5200 Email: [email protected] Website: https://inforegulator.org.za
Last updated: 4 October 2026