Privacy Policy

1. 1

   Who we are

   The Baking Genius ("we", "us") is a home bakery operated by Khusela Kgalane in South Africa. For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), we are the responsible party for the personal information described here.

   Information Officer: Khusela Kgalane
   Email: khuskgalane@gmail.com
   Phone: +27 (0)83 797 6769
   Address: 28 Lemur Street Nietgedacht Johannesburg 1739

2. 2

   What we collect, and why

   We only collect what we need to bake and hand over your order:

   • When you place an order — your name, email address, phone number, collection date, order items and any notes you add. We need these to prepare your order and to contact you about collection.
   • When you request a custom cake — your name, email, phone, the occasion, size, flavour, collection date and your description of what you want, so we can quote and plan the bake.
   • When you use the contact form — your name, email and message, so we can reply.
   • When you create an account — your email address, your name, and either a securely hashed password or, if you use Google Sign-In, the name, email and profile picture Google gives us. We never see or store your Google password.
   • When you pay online — your card and banking details are entered on Paystack's secure payment pages and are never sent to, seen by, or stored on our website. We only receive confirmation that a payment succeeded.
3. 3

   Our lawful basis

   We process your information because it is necessary to carry out the order you asked us for (section 11(1)(b) of POPIA), because you have consented by submitting a form, or because we have a legal obligation to keep records of sales. You are never required to give us information that is not needed for your order.

4. 4

   Who we share it with

   We do not sell your personal information, and we never share it for advertising. We use a small number of service providers (POPIA calls these operators) purely to run the bakery:

   • Airtable — stores our order records (United States).
   • Paystack — processes card and EFT payments and holds the payment details we never see.
   • Google — provides optional Google Sign-In (United States).
   • Gmail / Google Workspace — delivers our order and contact emails (United States).

   Each of these is bound by its own security and privacy obligations, and may only use your information to provide the service to us.

5. 5

   Information sent outside South Africa

   Some of the providers above store data on servers outside South Africa, mainly in the United States. As required by section 72 of POPIA, we only use providers that are subject to laws or binding agreements giving your information a level of protection substantially similar to POPIA. By placing an order or creating an account, you agree to this transfer.

6. 6

   How long we keep it

   Order records are kept for five years to meet South African tax and accounting record-keeping requirements. Contact and custom-order enquiries that do not become orders are deleted once the enquiry is closed. Account details are kept until you ask us to delete your account.

7. 7

   How we protect it

   The site is served over HTTPS, passwords are stored only as bcrypt hashes (never as readable text), and card details never touch our servers. Access to order records is limited to the bakery owner. No system is perfectly secure, but if a breach ever affects your personal information we will notify you and the Information Regulator as section 22 of POPIA requires.

8. 8

   Your rights

   Under POPIA you have the right to:

   • Ask what personal information we hold about you, free of charge (section 23).
   • Ask us to correct or delete information that is wrong, misleading or outdated (section 24).
   • Object to us processing your information (section 11(3)).
   • Withdraw your consent at any time, where consent was our basis for processing.
   • Lodge a complaint with the Information Regulator.

   To exercise any of these, email khuskgalane@gmail.com. We will respond within a reasonable time, and never charge you to correct or delete your information.

9. 9

   Cookies

   We use only what the site needs to work: a secure session cookie if you sign in, and your shopping cart, which is stored in your own browser and never sent to us until you place an order. We do not use advertising or third-party tracking cookies. Clearing your browser data removes both.

10. 10

    Complaints to the Information Regulator

    If you believe we have mishandled your personal information, please contact us first — we would like to put it right. You may also complain directly to:

    The Information Regulator (South Africa)
    JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
    Email: complaints.IR@justice.gov.za
    Website: inforegulator.org.za

See also our Terms & Conditions for ordering, collection and refunds.