This Privacy Notice explains how personal data is collected and used through the MealTab mobile application for iOS and Android and its related services (the App). It supplements, and should be read with, the MealTab Terms and Conditions of Use (the Terms).
The App is provided by Aone Sebinanyane, Plot 7581, Maratanang, Tlokweng, Botswana (we, us, our). For privacy matters you can contact us at asbnlabs@outlook.com.
This notice is written to meet the requirements of the Botswana Data Protection Act, 2024 (Act No. 18 of 2024) (the DPA) and, where it applies, the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the GDPR). Section 10 explains when the GDPR applies and the additional protections it gives.
This notice applies to: (a) owners of food businesses who use the App (Authorised Users); (b) customers whose meal balances are recorded in the App by a food business (Customers); and (c) anyone who contacts us for support.
MealTab is built to collect as little information about Customers as possible. In particular:
Why Customer records are still treated as personal data. Because the food business knows its own Customers, a first name and last-name initial combined with a meal and payment history can still identify a particular person to the food business and its staff. Both the DPA and the GDPR treat information as personal data where a person can be identified directly or indirectly, and data that is reduced or pseudonymised in this way remains personal data. We therefore apply the full protections of this notice to Customer Data. Our minimisation approach significantly reduces the privacy risk to Customers: for us, as the service provider, and for anyone outside the food business, a Customer record will ordinarily not reveal who the Customer is. Where the Organisation adds a WhatsApp number, that record does identify the Customer, and the Organisation is responsible for doing so only with the Customer's agreement.
We collect the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account and identity data (Authorised Users) | Email address, password (stored only in hashed form by our authentication provider), the Organisation you belong to | You, when you sign up |
| Organisation data | Food business name, default meal fee, currency, and the business's own records of walk-in sales and expenses (these contain no personal data about individuals) | The Owner |
| Customer Data (processed on behalf of the Organisation) | Customer first name and last-name initial, fee override, an optional WhatsApp number (only if the Organisation adds one), deposit and meal-entry amounts and dates, short notes, archive status | Authorised Users of the Organisation |
| Audit data | When each deposit or meal entry was created | Generated automatically by the App |
| Technical and security data | Sign-in times, IP address, device type, operating system and app version, authentication and error logs | Generated automatically when you use the App |
| Support and correspondence data | Your name, email address and the content of messages you send us | You |
| Billing data (only if paid plans are introduced) | Subscription status, plan and renewal dates, linked to your Organisation's account number. Purchases would be made through Google Play, which handles your payment details; we never see or store card or payment details | Google Play |
We do not collect sensitive personal data. We do not use the App to collect location data, camera or microphone content, and the App does not read the contacts stored on your phone.
We use personal data only for the purposes below. Under the GDPR we must identify a legal basis for each purpose. The DPA recognises equivalent grounds for lawful processing, and we rely on the corresponding grounds under the DPA.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing accounts and signing users in | Account and identity data; Organisation data | Performance of our contract with you (the Terms) — GDPR Art. 6(1)(b) |
| Providing the App's meal-balance functions to the Organisation | Customer Data; audit data | Processed as processor on the Organisation's instructions. The Organisation is responsible for its own legal basis (usually its legitimate interest in keeping accurate records of prepaid or postpaid meals, or its contract with the Customer) |
| Letting an Organisation open a pre-written WhatsApp balance reminder for a Customer (optional; only if the Organisation has chosen to add that Customer's number) | The Customer's optional WhatsApp number, first name and balance figures, which are used to build the message on the Organisation's own phone | Processed as processor on the Organisation's instructions. The Organisation decides whether to add a number and is responsible for its own legal basis (usually the Customer's agreement to be messaged) |
| Keeping the App and data secure, preventing fraud and misuse, isolating each Organisation's data, and investigating incidents | Technical and security data; audit data | Our legitimate interest in running a secure service — GDPR Art. 6(1)(f) |
| Diagnosing errors, maintaining and improving the App | Technical and security data (kept at an aggregated or minimised level where possible) | Our legitimate interest in a reliable, working product — GDPR Art. 6(1)(f) |
| Sending service messages (password resets, security alerts, notices of changes to the Terms or this notice) | Account and identity data | Performance of contract; legitimate interest — GDPR Art. 6(1)(b) and (f) |
| Responding to support requests | Support and correspondence data | Performance of contract; legitimate interest — GDPR Art. 6(1)(b) and (f) |
| Billing and accounting for Pro subscriptions | Billing data | Performance of contract; legal obligation (tax and accounting records) — GDPR Art. 6(1)(b) and (c) |
| Complying with law and responding to lawful requests from authorities; establishing or defending legal claims | Any relevant data | Legal obligation; legitimate interest — GDPR Art. 6(1)(c) and (f) |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for more information about this assessment and you have the right to object (see section 9).
What we do not do. We do not sell personal data. We do not use personal data for advertising or share it with advertisers. We do not carry out profiling or make decisions based solely on automated processing that have legal or similarly significant effects on anyone. The App's balance and "meals left or owed" figures are simple arithmetic on the records the Organisation enters, and any decision based on them (for example, whether to serve a Customer on credit) is made by the food business, not by us.
Personal data is visible within an Organisation to everyone who uses its account. It is never visible to other Organisations using the App.
We share personal data only with the following recipients, and only to the extent necessary:
A current list of our sub-processors is available on request from asbnlabs@outlook.com.
Our App data is hosted in data centres in Ireland, a member state of the European Union, where it is protected by the GDPR. Some of our service providers are based in, or may access data from, the United States and other countries. Personal data is also accessed from Botswana by us in order to operate and support the App.
Transfers from Botswana. When personal data of individuals in Botswana is transferred outside Botswana, we do so only as permitted by the DPA. This includes transferring it to countries or service providers that ensure an adequate level of protection, supported by contractual safeguards with our service providers.
We use appropriate technical and organisational measures to protect personal data, including:
No system is completely secure. You can help by using a strong, unique password, locking your device, and signing out or removing access for devices and staff who no longer need it. Excel backup files exported from the App leave our protection once saved or shared, so please store and share them securely.
Personal data breaches. If a breach affects personal data, we will act promptly to contain it. Where the law requires, we will notify the Information and Data Protection Commission and/or the relevant EU supervisory authority, and affected individuals. For Customer Data, we will notify the affected Organisation without undue delay so that it can meet its own obligations.
We keep personal data only for as long as it is needed for the purposes described in this notice, including to provide the App to an active Organisation and to meet our legal, accounting and reporting obligations. We may keep data for longer where required by law or where needed to establish, exercise or defend a legal claim. In that case we keep it only for as long as necessary and for no other purpose.
Subject to the conditions and exceptions in applicable law, you have the right to:
Authorised Users can view and correct much of their data directly in the App's Account and Settings screens, and can delete their account. For anything else, email asbnlabs@outlook.com. We may need to verify your identity before acting on a request.
Customers should send requests to the food business that keeps their records, because it controls that data. Organisations can view, correct, archive, export and delete Customer records within the App. If you contact us instead, we will forward your request to the Organisation and assist it.
A Customer who does not want WhatsApp reminders, or who wants their number removed, can ask the food business to do so. The Organisation can remove or change a Customer's WhatsApp number at any time by editing that Customer's record, and the rest of the record is unaffected.
We will respond without undue delay and in any event within one month of receiving a request (or any shorter period required by the DPA). Where requests are complex or numerous, this period may be extended as permitted by law, and we will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.
When the GDPR applies. MealTab is provided from Botswana. The GDPR applies to our processing where we offer the App to individuals or food businesses located in the EU/EEA, and our hosting provider processes data in Ireland. Where the GDPR applies, you have all the rights in section 9, and the legal bases in section 4 and the transfer safeguards in section 6 apply.
Organisations in the EU that use MealTab are data controllers of their Customer Data under the GDPR. We act as their processor on the terms required by Article 28 GDPR, as set out in the Terms and our data processing terms.
UK users. Where the UK GDPR and the Data Protection Act 2018 (UK) apply, the rights and safeguards described for EU users apply equally, with references to EU authorities read as references to the UK Information Commissioner's Office.
If you have a concern, please contact us first at asbnlabs@outlook.com and we will try to resolve it.
You also have the right to complain to a supervisory authority:
The App is intended for use by businesses and their adult staff. Authorised Users must be at least 18 years old. We do not knowingly collect account data from children. Food businesses that record meals for Customers under 18 (for example, school learners) are responsible, as data controllers, for having a lawful basis for doing so, including parental or guardian consent where the law requires it. They should keep such records to the minimum the App requires, and should not add a WhatsApp number for a Customer under 18 without the consent of a parent or guardian.
We may update this notice from time to time, for example when we add features such as paid plans, analytics or new service providers. The current version and its effective date will always be available in the App under the Account tab, and on this page. We will notify Owners of material changes by email or in-App notice before they take effect.
Aone Sebinanyane (MealTab), Plot 7581, Maratanang, Tlokweng, Botswana.
Email: asbnlabs@outlook.com