Privacy Policy
Plated Preps (Pty) Ltd t/a Nutrition Ninja Registration number: 2024/134601/07 Sandton View Shopping Centre, 82 Homestead Avenue, Bryanston, Johannesburg, 2191 admin@nutritionninjasa.com · WhatsApp 076 612 7594
Last updated: 22 June 2026
1. Introduction
Plated Preps (Pty) Ltd, trading as Nutrition Ninja ("we", "us", "our"), is the responsible party for the personal information described in this Policy, as defined in the Protection of Personal Information Act, 4 of 2013 ("POPIA").
We take your privacy seriously, and we are direct about what we collect and why. This Policy explains what we collect, why we collect it, who we share it with, how long we keep it, and what rights you have.
Information Officer: Shaunik Somaru Contact: admin@nutritionninjasa.com
2. Information we collect
2.1 Information you give us
- Identity and contact: name, surname, email address, mobile number, WhatsApp number.
- Delivery: physical delivery address, estate or complex access details, gate codes, delivery instructions.
- Order and billing: plan tier, meal frequency, subscription history, invoice and payment status, delivery zone.
- Dietary and health information: allergies, intolerances, food restrictions, religious or ethical dietary requirements, fasting days, and any goal, condition, or preference you choose to disclose to us.
- Correspondence: emails, WhatsApp messages, and feedback you send us.
2.2 Information collected automatically
When you use our website, we may collect device and browser information, IP address, pages viewed, and referral source, via cookies and analytics tools. Analytics and marketing cookies are only set after you consent via our cookie banner. Necessary cookies required for the site to function are always active.
2.3 Payment information
We do not collect or store your card details. Payments are processed by PayFast (Payfast (Pty) Ltd), a licensed South African payment service provider. Your card data is handled entirely by PayFast under its own privacy policy and PCI-DSS obligations.
3. Special personal information — allergen, dietary, and health data
This section requires your explicit consent.
Information about your allergies, intolerances, medical conditions, and health-related dietary requirements is special personal information in terms of section 26 of POPIA. The processing of such information is prohibited unless a specific exemption applies.
We process it in reliance on section 27(1)(a) of POPIA — your explicit consent.
3.1 Why we need it
We cannot safely prepare food for you without it. This information is used solely to:
- exclude declared allergens from your meals;
- flag your profile to our kitchen team so meals are prepared correctly;
- block an order where an allergen profile is incomplete, ambiguous, or unconfirmed;
- print allergen and ingredient information on your meal labels.
3.2 Your explicit consent
By submitting your allergen and dietary information to us — through our signup form, by email, or by WhatsApp — and by ticking the consent box where presented, you expressly consent to us collecting, storing, and processing that information, and to sharing it internally with our kitchen and dispatch personnel and with the technology providers listed in clause 5, for the purposes above.
3.3 Withdrawing consent
You may withdraw this consent in writing at any time. However, we cannot continue to supply you with food without it. Withdrawal of consent will result in the cancellation of your subscription, subject to our Refund and Cancellation Policy. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
3.4 What this information does not do
Processing your health information does not make us your healthcare provider, and does not constitute medical or dietetic advice. Our limits regarding allergens — including the fact that we operate a shared kitchen and cannot guarantee any meal is allergen-free — are set out in clause 8 of our Terms and Conditions and apply in full.
4. Why we process your information and on what basis
| Purpose | Lawful basis (POPIA s11 / s27) |
|---|---|
| Preparing and delivering your meals | Performance of our contract with you |
| Allergen and dietary handling | Your explicit consent (s27(1)(a)) |
| Invoicing, payment, and accounting records | Contract, and legal obligation (Companies Act, Tax Administration Act) |
| Delivery routing and driver instructions | Performance of our contract |
| Service communications (deliveries, renewals, menu, invoices) | Performance of our contract |
| Marketing communications | Your consent, or an existing customer relationship (s69) |
| Website analytics | Your consent |
| Food safety records and complaint investigation | Our legitimate interests and legal obligation |
| Fraud prevention and debt recovery | Our legitimate interests |
5. Who we share your information with
We do not sell your personal information. We share it only with operators who process it on our behalf, under contract, and only to the extent necessary:
| Provider | Purpose | Location |
|---|---|---|
| PayFast | Payment processing | South Africa |
| Xero | Invoicing and accounting | New Zealand / Australia / United States |
| Supabase | Client, subscription, and allergen records | Cloud infrastructure, may be outside South Africa |
| Tally | Signup and onboarding forms | European Union |
| Make.com | Workflow automation between the systems above | European Union |
| Google Workspace | Email, documents, and storage | United States and other locations |
| Vercel | Website hosting | United States |
| Our delivery driver | Name, address, contact number, access details | South Africa |
| Our kitchen team | First name, plan tier, allergen profile, meal labelling | South Africa |
We may also disclose information where required by law, court order, or a regulator, or to establish, exercise, or defend a legal claim.
6. Cross-border transfers
Some of our operators process information outside South Africa. Where this happens, we rely on section 72 of POPIA and ensure that the recipient is bound by an agreement, binding corporate rules, or a legal regime that provides an adequate level of protection substantially similar to POPIA. By providing your information, you acknowledge these transfers.
7. Security
We apply reasonable technical and organisational measures to protect your information, including access-controlled systems, role-restricted access for kitchen and delivery personnel, encrypted connections, and vetted service providers.
No system is perfectly secure, and we cannot guarantee absolute security. If a security compromise affecting your personal information occurs, we will notify you and the Information Regulator as required by section 22 of POPIA.
8. How long we keep your information
- Active subscribers: for the duration of your subscription.
- Former subscribers: contact, order, and allergen records for 3 years after your last order, so that we can handle complaints, disputes, and food-safety queries, and so that rejoining clients are not put at risk by an outdated allergen profile.
- Financial and tax records: 5 years from the end of the relevant tax period, as required by the Tax Administration Act and the Companies Act.
- Marketing consents: until you opt out.
We delete or de-identify information when it is no longer needed for these purposes.
9. Your rights
Under POPIA you have the right to:
- be told what personal information we hold about you (s23);
- request correction, deletion, or destruction of inaccurate, irrelevant, excessive, or out-of-date information (s24);
- object to processing on reasonable grounds (s11(3));
- withdraw consent, subject to clause 3.3;
- opt out of direct marketing at any time;
- lodge a complaint with the Information Regulator.
To exercise any of these rights, email admin@nutritionninjasa.com. We may ask you to verify your identity. We will respond within a reasonable period. Formal access requests under the Promotion of Access to Information Act, 2 of 2000, must be made on Form 2 and are handled by our Information Officer.
10. Direct marketing
We may send you service messages about your subscription — deliveries, invoices, renewals, menu changes — as part of our contract with you. These are not marketing and cannot be opted out of while you remain a subscriber.
Marketing messages are sent only with your consent, or to existing customers about similar products, in terms of section 69 of POPIA. Every marketing message includes an opt-out. You may also opt out at any time by replying STOP on WhatsApp or emailing us.
11. Children
Our service is not directed at children under 18. We do not knowingly collect information from a child without the consent of a competent person. Where you order meals for a minor in your household, you warrant that you are that child's parent or guardian and consent to us processing their dietary information for that purpose.
12. Cookies
We use:
- Necessary cookies — required for the website to function. Always active.
- Analytics cookies — to understand how the site is used. Set only with your consent.
- Marketing cookies — to measure and retarget advertising. Set only with your consent.
You may change or withdraw your cookie preferences at any time via the cookie banner or your browser settings.
13. Changes to this Policy
We may update this Policy. The current version is always published on our website, with the date of last update at the top. Material changes affecting how we process your information will be notified to active subscribers by email.
14. Contact and complaints
Information Officer Plated Preps (Pty) Ltd t/a Nutrition Ninja Sandton View Shopping Centre, 82 Homestead Avenue, Bryanston, Johannesburg, 2191 admin@nutritionninjasa.com · 076 612 7594
If you are not satisfied with our response, you may complain to:
Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 complaints.IR@justice.gov.za inforeg.org.za