Back to home

Legal

Privacy Policy

Last updated: 12 June 2026

FlavourFactory (Pty) Ltd ("FlavourFactory", "we", "us" or "our"), registration number 2018/296090/07, is committed to protecting your personal information and respecting your privacy. This Privacy Policy explains how we collect, use, share and safeguard your personal information, and the rights you have, in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA") and other applicable South African law.

By using our website, client portal, or submitting an enquiry to us, you acknowledge that you have read and understood this Policy.

1. Who is responsible for your information

FlavourFactory is the "responsible party" (data controller) for the personal information described in this Policy. If you have any questions, or wish to exercise any of your rights, you may contact our Information Officer:

  • FlavourFactory (Pty) Ltd — Information Officer
  • Unit 3, 18 Foreman Street, Spartan, Kempton Park, 1619, South Africa
  • Email: info@flavourfactory.africa
  • Telephone: 010 442 8781 / 083 387 0500

2. The personal information we collect

Depending on how you interact with us, we may collect:

  • Contact and identity details — name, job title, company name, email address, telephone number and city/location.
  • Enquiry and project details — information you provide when submitting an enquiry, such as the type of product you are developing, production volumes, flavour profiles, budget ranges and any message or requirements you share with us.
  • Account information — if you are a registered portal user, your login identifier and the company you are associated with (authentication is handled by our identity provider, Auth0).
  • Transactional information — orders, briefs, quotes and related correspondence.
  • Technical information — limited information such as your IP address (for example, recorded when you submit a form), and a secure authentication token stored in your browser's local storage to keep you signed in. We do not use analytics, advertising or tracking technologies. See our Cookie Settings page for full detail.

We do not knowingly collect special personal information (as defined in POPIA) or the personal information of children through our public enquiry form. Please do not submit such information to us unless specifically requested and lawful.

3. How we collect your information

We collect personal information:

  • directly from you, when you complete a form, submit an enquiry, place an order, or correspond with us;
  • automatically, in a limited way, through strictly-necessary browser storage used to keep you signed in to the portal (we do not use tracking or analytics technologies);
  • from third parties acting on your behalf or with your consent (for example, a colleague submitting an enquiry that includes your details, or a referral partner).

4. Why we process your information and our lawful basis

We process your personal information to:

  • respond to your enquiry and provide the products, quotes and services you request;
  • create and administer your portal account and process orders and briefs;
  • communicate with you about your enquiries, orders and our relationship;
  • send you marketing communications, where you have consented to receive them;
  • improve and secure our website, portal and services;
  • comply with our legal and regulatory obligations.

We rely on one or more of the following lawful bases recognised under POPIA: your consent; the performance of a contract with you or the company you represent; our legitimate interests (such as running and growing our business) where these are not overridden by your rights; and compliance with a legal obligation.

5. Marketing communications

We will only send you direct marketing where you have consented, or as otherwise permitted by law. You may withdraw your consent or opt out of marketing at any time by using the unsubscribe link in our communications or by contacting our Information Officer. Withdrawing marketing consent does not affect our ability to contact you about an enquiry or order you have submitted.

6. When we share your information

We may share your personal information with:

  • Service providers (operators) who process information on our behalf and under our instruction — for example, hosting providers, our identity provider (Auth0), email and communication tools, and IT support. These parties are required to protect your information and may only use it to provide services to us.
  • Professional advisers and authorities where required to comply with the law, exercise or defend legal rights, or respond to lawful requests.
  • A successor entity in the event of a business sale, merger or reorganisation, subject to this Policy.

We do not sell your personal information.

7. Cross-border transfers

Some of our service providers may store or process information outside of South Africa. Where we transfer personal information across borders, we do so in accordance with section 72 of POPIA, ensuring that the recipient is subject to laws, binding rules or agreements that provide an adequate level of protection.

8. How we protect your information

We take reasonable technical and organisational measures to secure your personal information against loss, damage, and unauthorised access or use, as required by section 19 of POPIA. These include access controls, encryption in transit, and restricting access to personal information to those who need it. No method of transmission or storage is completely secure, but we work to protect your information and to address any security incidents appropriately.

9. How long we keep your information

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, including to meet legal, accounting, tax or reporting requirements. When information is no longer required, we will delete or de-identify it. Enquiry information from prospective customers is kept for a reasonable period to allow us to follow up and to maintain our business records.

10. Your rights

Subject to applicable law, you have the right to:

  • request access to the personal information we hold about you;
  • request that we correct or update inaccurate or incomplete information;
  • request that we delete or destroy your personal information;
  • object, on reasonable grounds, to the processing of your personal information;
  • withdraw consent where we rely on consent (without affecting prior lawful processing);
  • not be subject to direct marketing to which you have objected;
  • lodge a complaint with the Information Regulator.

To exercise any of these rights, please contact our Information Officer using the details in section 1. We may need to verify your identity before acting on a request. The Information Regulator's prescribed forms (including the Request for Access and Objection to Processing forms) are available on its website.

11. Cookies and browser storage

We do not use cookies for analytics, advertising or third-party tracking on our website or portal. To keep you signed in, we store a secure authentication token in your browser's local storage — this is strictly necessary for the portal to function. During sign-in you are briefly redirected to our authentication provider (Auth0), which may set its own first-party cookies on its domain to manage your login session; those cookies are outside our control. For a full explanation, see our Cookie Settings page.

12. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be brought to your attention where appropriate.

13. Complaints

If you believe we have not handled your personal information in accordance with POPIA, please contact our Information Officer first so that we can try to resolve the matter. You also have the right to lodge a complaint with:

14. Contact us

For any questions about this Policy or how we handle your personal information, please contact us at info@flavourfactory.africa or 010 442 8781.