Privacy notice

This app belongs to The Barn. Responsibility is split the way POPIA sees it. For the order you place here (your first name, your table and what you ordered) The Barn is the responsible party. The app is built and run for The Barn by Brendon Mapinda, Cape Town, South Africa, who acts as its operator and processes that information only on the venue's instructions. For the app's own analytics, which wait for your consent, and for the page counting described below, which does not, Brendon Mapinda is the responsible party.

Information Officer: Brendon Mapinda, mapindabrendon@gmail.com.

Orders. Your first name, your table, the items you ordered and a note if you leave one. Where you pay at the counter, also any tip you chose, when the order was paid, how it was paid and which staff member took the payment, which is how the venue squares its till. This is needed to run the order, the lawful basis is performing the service you asked for. Orders are kept for 12 months for The Barn's records, after which your name is removed and only the anonymous sales figures remain.

Counting customers, only with your consent. Where you can order from your phone and collect at the counter, and only if you allow analytics in the banner, your phone keeps a random id for this venue and sends it with each order. It lets The Barn count how many different people ordered and how many came back, rather than how many orders there were. It is not your name, it is never sent to any other venue or app, and it is removed from orders after 6 months. Withdrawing analytics consent deletes it from your phone, and orders from then on carry none. Without consent each order is simply counted on its own.

A spot held at an event. If you hold a spot at a night The Barn runs itself, we store the first name you type, how many of you are coming and a random code that reopens the booking. No surname, no email address and no phone number, because the door only has to find you. The lawful basis is the same as an order, doing the thing you asked for. Where entry is paid, we also keep the price you were quoted, when it was paid and when the door let you in. It is kept for the event and for The Barn's records afterwards, no longer than 12 months, and sooner than that if you ask for it to go.

The camera. Scanning a QR code in the app uses your camera only while the scanner is open. The picture is read on your phone and never sent anywhere or stored. Staff scanners work the same way.

The table bill. Where a table runs one bill instead of paying every round, staff give that bill a short label so they can tell one table from another, for example "Table 6, Sipho". Staff type it, so it can hold your first name. It is capped at a few words on purpose. It sits with that bill on the same 12 months as an order, and it is not a customer record, there is nothing else attached to it.

Waving somebody over. When you tap to ask for somebody to come to your table, we record which table it was and the time, and later whether somebody answered it. That is the whole record. No name, no reason and nothing you typed, because there is nothing to type. It exists so staff can see whose hand is up and how long they have been waiting, which is the service you asked for by tapping. The row is kept for 90 days so the venue can see how quickly it answers, and is then deleted.

Photographs of the place. The gallery is The Barn's own photographs of the room, and a photograph of a full room can show people who are recognisable, which makes it personal information. Only The Barn chooses what appears there, patrons cannot upload anything, and no photograph is tagged with a name, matched to a face or linked to an order. The lawful basis is the venue's own legitimate interest in showing what a night there looks like. If you are in one and you would rather not be, email the Information Officer and it comes down.

Analytics, only with your consent. If you allow it in the banner, we count events like a menu being opened or an order being placed. Each event carries a random anonymous id, a session id, the page path, your device type and your city, never your name, never your contact details and never your exact location or IP address. Raw events are kept for 90 days, then only daily totals remain. If you do not consent, nothing is counted by that.

Page counting, which does not wait for consent. This is a separate and much smaller thing from the analytics above, and it is the one item on this page that starts on. Six things are recorded, and this is the whole list. Which page was opened. How many seconds it was actually on your screen. The website you followed a link from, if you followed one, and only its name and never the full address. The city the request came from. Which kind of device and which browser, kept as a category like "phone" and "Safari" rather than the long technical line a browser sends about itself. And a daily counting number, described in the next paragraph because it is the one part of this that needs more than a line.

The daily counting number, and why we do not call it anonymous. To avoid counting one person opening five pages as five people, each request carries a scrambled number worked out from today's date, this app's name, your network address and your browser, run through a one way calculation with a secret only Brendon Mapinda holds. Your network address itself is never stored, only that number. It changes at midnight, so nothing links what you did today to what you do tomorrow, and the secret is different for every app Brendon Mapinda runs, so it cannot be matched to you on any other one. But it is honest to say that somebody holding that secret, who already knew your network address and your browser, could work out whether a row was yours. So we do not tell you it is anonymous. We tell you it is hard to trace and kept for three days.

One cookie named _bza is kept on your device and it holds three things, the date you first opened the app, how many separate days you have opened it, and the date you last did. There is no identifier in it at all, so two people who happened to visit on the same days carry the same cookie byte for byte. Your device does the remembering, and what reaches Brendon Mapinda from it is only whether you had been before and a rough band like three to five days, never the dates themselves. No outside analytics company is involved and none of this is ever sold. The lawful basis is legitimate interest under section 11(1)(f) of POPIA, because seeing which screens people actually use is how The Barn's app gets fixed and improved, and because what is kept is deliberately the least that answers that question. Section 11(3) gives you the right to object, and section 11(4) has no override in it, so an objection simply stops it. The switch is further down this page. Rows are kept for three days and only daily totals remain after that, and those totals hold no counting number and nothing about a device.

Consent records. We keep a record of what you agreed to, when, and the exact wording version you saw, because POPIA requires consent to be provable. Withdrawing consent rotates your anonymous id so the old trail cannot be linked to the new one.

Staff accounts. Staff sign in with an email address and a password stored only as a salted hash. A new staff member joins through a one time link, and only a scrambled copy of that link is kept until it is used or expires after 7 days. Each payment taken records which staff member took it. Patrons never create accounts.

We never sell personal information. We never store a raw IP address in analytics or in the page counting. We never take payment details, paying happens at the bar. We send no marketing without a separate opt in, as section 69 of POPIA requires. There is no advertising network, no tracking pixel and no outside analytics company anywhere in this app.

The app stores on your device: your age gate answer, your consent choices, your cart, a count of how many times you have opened the app, which is what decides when it offers to install itself, an anonymous analytics id if you consented, and for staff a signed session cookie. A table cookie remembers which table you scanned for three hours, and if you waved somebody over, a note of when, so the screen still says somebody has been told after you reload. That note is dropped when you close the tab.

Where you order and collect at the counter, the app also keeps on your phone: the first name you typed last time, so you do not type it again, the codes of your recent orders and tickets so you can find them, which open those orders and tickets for whoever holds the phone, the random customer id described above if you allowed analytics, and a bar pass cookie for 4 hours after you scan the code on the bar screen. Clearing this site's data in your browser removes all of it.

One more cookie, _bza, holds the page counting described above, a first seen date, a number of days and a last seen date, with no identifier in it. If you switch that counting off, _bza is deleted and a cookie recording your objection takes its place, so the choice survives you closing the app.

Page counting is the one thing here that does not ask first, so here is the switch for it. It applies to this device, it takes effect on the very next page you open, and turning it back on is the same single tap. Everything else on this page either happens because you asked for it, like placing an order, or waits for the consent banner.

Operators under POPIA section 20 and 21: Cloudflare (hosting, bot defence, and where the page counts are stored on Brendon Mapinda's own account), Neon (database) and Resend (staff account email). They process outside South Africa under their own safeguards, which is the section 72 basis for the transfer. We name them here so nothing about the plumbing is a secret.

You may ask what is held about you, ask for it to be corrected or deleted, and complain to the Information Regulator (inforegulator.org.za, complaints.IR@inforegulator.org.za). Your order status page already shows you everything an order holds. For anything else, email the Information Officer at mapindabrendon@gmail.com and you will have an answer within 30 days. If we ever suffer a breach that touches your information, we notify you and the Regulator as section 22 requires.