←Back to home

Privacy Policy

Effective: 18 June 2026POPIA · GDPR · CCPA · FTC

Bobos Mini Bites respects your privacy. This policy explains in plain language what data we collect, why we collect it, and the rights you have over it. We are based in Johannesburg, South Africa and this policy is aligned with South African POPIA, the EU/UK GDPR, the US CCPA/CPRA, and FTC guidelines.

1. Who We Are

Bobos Mini Bites (“we”, “us”, “our”) is a South African dessert business operating from Johannesburg, South Africa, specialising in mini donuts and mini pancake skewers for events and catering. This Privacy Policy explains how we collect, use, share and protect your personal information when you use our website, place an order via WhatsApp, or contact us.

We are the data controller of your personal information. You can reach us at hello@bobosminibites.co.za.

2. Information We Collect

We only collect what we need to take and deliver your order:

Contact details

Name, phone number, email address.

Order details

Event date, location, guest count, flavour preferences, dietary notes, special requests.

Communications

Messages you send via WhatsApp, email or our contact form.

Technical data

IP address, browser type, device, pages viewed, referring URL collected via standard server logs and privacy-respecting analytics.

Cookies

Strictly necessary cookies for the site to function. No advertising or cross-site tracking cookies.

We do not knowingly collect information from children under 13 (or under 16 in the EU/UK). If you believe a child has provided us personal information, contact us and we will delete it.

3. How We Use Your Information (Lawful Basis)

To fulfil your order — Performance of a contract (POPIA s11(1)(b), GDPR Art. 6(1)(b)).
To respond to enquiries — Legitimate interest in operating our business (POPIA s11(1)(f), GDPR Art. 6(1)(f)).
To comply with laws — Tax, accounting and food-safety obligations (POPIA s11(1)(c), GDPR Art. 6(1)(c)).
To improve our website — Legitimate interest, based on aggregated, non-identifying data.
Marketing — Only with your opt-in consent. You may withdraw consent at any time.
We do not sell or “share” your personal information for cross-context behavioural advertising as defined by CCPA/CPRA. We do not engage in automated decision-making or profiling that produces legal effects.

4. WhatsApp Ordering

When you click an order button, your browser opens WhatsApp with a pre-filled message. Once you send it, the conversation is also governed by WhatsApp's Privacy Policy (Meta Platforms). We receive your phone number, profile name and the messages you send — used only to process your order and send order-related updates.

5. Sharing Your Information

We share personal information only with:

Service providers

Hosting, email delivery, payment processors all bound by data-processing terms.

Delivery partners

Only the details needed to deliver your order.

Authorities

Where required by law, court order, or to protect our legal rights.

Successors

In connection with a merger or sale of assets, with notice to you.

We never sell your personal information.

6. International Transfers

Our hosting and email providers may store data outside South Africa (typically the EU or USA). We rely on Standard Contractual Clauses and provider certifications (e.g. EU–US Data Privacy Framework) as required by POPIA s72 and GDPR Chapter V.

7. How Long We Keep Your Information

Data typeRetention
Order records5 years
Marketing contactsUntil unsubscribed
Website analyticsUp to 14 months
WhatsApp chatsRelationship + 12 months

8. Your Rights

Depending on where you live, you have the right to:

Access the personal information we hold about you

Correct inaccurate or incomplete information

Delete your information ("right to erasure")

Object to or restrict certain processing

Withdraw consent at any time

Data portability receive data in machine-readable format

🇿🇦

South Africa (POPIA)

Right to complain to the Information Regulator at inforegulator.org.za.

🇪🇺

EU / UK (GDPR / UK-GDPR)

Right to lodge a complaint with your local supervisory authority.

🇺🇸

California (CCPA / CPRA)

Right to know, delete, correct, limit use of sensitive personal information, and non-discrimination. We do not sell or share personal information.

To exercise any right, email hello@bobosminibites.co.za. We respond within 30 days. No fee unless your request is manifestly unfounded or excessive.

9. Security

We use TLS encryption in transit, access controls, and least-privilege principles hosted on reputable infrastructure. No system is 100% secure — if a breach affects your personal information we will notify you and the relevant regulator within 72 hours as required by POPIA s22 and GDPR Art. 33.

10. Cookies

We use strictly necessary cookies to keep the site working. We do not use advertising, retargeting or cross-site tracking cookies. You can clear cookies from your browser settings at any time. Because we use no non-essential cookies, no consent banner is shown.

11. Third-Party Links

Our site links to Instagram, Google Maps and WhatsApp. We are not responsible for the privacy practices of these third parties — please review their policies directly.

12. FTC Compliance (US Visitors)

In line with FTC guidance on online disclosures, we commit to:

  1. Presenting all material terms clearly and conspicuously before purchase.
  2. Honest pricing with no hidden fees.
  3. Clearly disclosing any sponsored or endorsed content.
  4. Honouring all advertised offers.

If you believe any claim on this site is misleading, contact hello@bobosminibites.co.za.

13. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be highlighted on the homepage for 30 days.

14. Contact Us

Bobos Mini Bites

Johannesburg, South Africa

Email Us