Privacy Notice

Version 2026-10-20.

Chumi is operated by Ross Mackintosh as a sole proprietor. The South African address below is the correspondence contact address. Data may be processed outside South Africa.

Responsible party and contact

For Chumi account administration, authentication, support and billing, the responsible party is Ross Mackintosh, sole proprietor trading as Chumi, using the trading brand Chumi. South African correspondence address: 18 Victoria Street, Robertson, Western Cape, 6705, South Africa. Information officer/contact: Ross Mackintosh, owner and privacy contact ([email protected]). South African telephone: +27 76 917 3535. Privacy enquiries: [email protected].

Our role with hospitality records

Your hospitality business normally decides the purpose and means of processing staff and operational records and is the responsible party for those records. Chumi generally processes that information as its operator to provide the service under the customer's instructions. People whose information belongs to an employer's workspace should initially contact that employer; we assist the employer as appropriate.

What information is processed and why

• Workspace owner name, business name, login email, password verifier, account role and authentication logs, to set up and secure access.
• Subscription identifiers, billing status and invoices, to administer plans and respond to payment disputes. Stripe processes card payment details; Chumi does not need to store full card numbers.
• Staff, rota, time/attendance, leave, HR document, pay-rate and site records entered by customers, to provide workforce functions.
• Supplier invoices, product/ingredient prices, recipes, stock counts, operations checklists and uploaded files, to provide hospitality cost and operations functions.
• Contact, support and diagnostic records, to respond to enquiries, protect accounts and investigate misuse.
• Optional location, camera images, health or other special personal information when customers enable such functions. Customers must establish a valid purpose, lawful basis and required safeguards before collecting these records.

Lawful reasons and required information

Account details are generally required to create and administer a contracted workspace; without them we cannot provide the account. Some data are processed to perform contracts, meet legal requirements or pursue legitimate operational and security purposes, as permitted under POPIA. Where consent is actually required, it must be obtained separately and appropriately. The signup acceptance of service terms and acknowledgement of this notice is not consent to optional marketing.

How information is collected and shared

Information is obtained from account owners, authorised colleagues and customer-entered records, plus security and billing systems. Chumi uses cloud-hosting/storage providers (including Cloudflare), payment processing (Stripe), transactional email providers (Resend), and document or AI processing tools where enabled (which may include OpenAI). Only the information required for each purpose should be shared with the applicable provider. Customer-selected integrations may involve additional services and notices.

International processing

Infrastructure or service providers may process information outside South Africa. Customers should assess these transfers and applicable agreements under POPIA section 72, especially for workforce and special personal information. We will not describe processing as wholly South African-hosted unless it has been verified.

Security, retention and compromises

Chumi uses access controls, account-scoped roles, HTTPS and cloud-hosted systems. Reasonable organisational and technical controls, incident procedures and supplier oversight are required; no online service can guarantee absolute security. Records are retained while needed for an active service, security, lawful records and backup obligations, then deleted or de-identified where appropriate. Account owners can request data export/deletion subject to legal and operational constraints. POPIA section 22 requires notification of relevant security compromises as soon as reasonably possible.

Your rights and requests

Subject to POPIA and applicable exceptions, you may ask whether we hold your information, seek access/correction/deletion, object in relevant circumstances, or complain to the Information Regulator (South Africa). Send Chumi account and support requests to [email protected], or contact your employer where it is responsible for your records.

Marketing and cookies

We do not treat acceptance of Chumi's terms as marketing permission. Any optional electronic direct marketing must be handled using the permissions and opt-out requirements that apply. Essential cookies/session tokens support login and security; any optional analytics/advertising technologies require an appropriate separate notice and controls.

Changes to this notice

We will update the version and date when our practices or legal requirements materially change. Your registration records the privacy-notice version acknowledged at the time.