Privacy Policy

1. What We Collect

We only collect information necessary to operate our catering service and app. This includes:

• Identity & Contact Data: Names, company membership, phone numbers, and email addresses.
• Account & Order Data: Saved addresses, favourites, history, quotes, invoices, and payment records. Guest counts and specific delivery/order notes.
• Dietary Data (Sensitive/Health-related): Dietary and allergy information provided to safely prepare orders. This is strictly access-limited to staff and providers who need it for preparation and fulfilment.
• Operational Data: Referrals, account credits, feedback, driver/admin routing data, Proof of Delivery (POD) photos, signatures, and recipient names.
• Technical Data: IP addresses, request metadata, and server logs to ensure system security, monitor infrastructure, and prevent abuse.

2. How We Collect It

We collect information directly from you when you create or use an account, join or manage a company account, save a location or favourite, place an order, request or approve a quote, make or arrange a payment, submit feedback, use a referral, or contact us. We also receive information from an authorised colleague or organiser who provides delivery, recipient, guest or dietary details for an order.

Our app and hosting infrastructure automatically create essential session records and operational request logs. Drivers and authorised staff add operational records such as delivery status, recipient names, signatures and proof-of-delivery photos.

3. Purposes of Collection

We use this data to verify accounts, fulfil orders and dietary needs, process invoices, route drivers, provide support, and communicate regarding your orders.

We also count predefined website events using first-party, cookieless analytics: page, menu and product views, successful additions to cart, checkout starts, submitted orders and selected payment methods. Event payloads contain no personal information, full URLs or visitor identifiers, and are not linked to customer records or individual journeys. Analytics uses no cookies, browser storage or fingerprinting and honours Do Not Track and Global Privacy Control. Counts are available to authorised administrators; identifier-free events also appear in operational logs subject to our security and retention practices. Normal infrastructure and security logs are separate. See our Cookies & Tracking Notice for details.

The current app does not combine order acceptance with marketing consent. If optional direct marketing is offered, consent will be requested separately. You may opt out of marketing at any time using the unsubscribe method in the message or by contacting us; service and order communications may still be sent where necessary.

4. Security & Retention

We use reasonable technical and organisational safeguards, including authenticated accounts, role-based access, restricted proof-of-delivery storage, secure session controls and access logging. No internet service can guarantee absolute security. We retain data (including operational logs and sensitive dietary information) only for as long as reasonably needed for fulfilment, support, safety, dispute handling and legal, tax or accounting obligations, after which it is deleted or de-identified where practicable.

5. Service Providers & Overseas Processing

We disclose information only where reasonably needed to operate the service, fulfil orders, comply with law, or protect our rights and users. Service providers used by the current app include:

• Replit: Application hosting, PostgreSQL databases, object storage, and operational infrastructure.
• Google Maps Platform (Places): When you search for or select an address using Google suggestions, our server sends the search text and selected place reference to Google to return suggestions and structured address details. Google's own privacy policy and Maps Platform terms apply.
• OpenStreetMap (Nominatim): Our server also uses Nominatim for separate address lookups and delivery-zone geocoding. It is distinct from Google Places autocomplete; address queries are sent to the service when those lookups run.
• Google Calendar: Integrated strictly for scheduling booking details, only when connected and enabled by our team.
• Stripe (independent payment provider): When card payment is available, Stripe processes card details and payment transactions. Zest receives payment status and transaction references, not complete card numbers or card security codes.

Card Payments: Online card payment may be offered at checkout; availability is shown there. When available, card details are processed by Stripe through its embedded payment components. Zest does not receive or store complete card numbers or card security codes. We retain payment status, method and transaction references needed for order, accounting and support records. Bank transfer and other invoice arrangements may also be available.

Overseas Processing: These providers may process information using infrastructure outside Australia under their own privacy terms. Specific processing countries are not identified in the current configuration, so we do not list or guess them. Contact us if you would like the current information available to us.

6. Access, Correction & Complaints

You have the right to request access to the personal information we hold about you and to ask for corrections if it is inaccurate.

If you have a complaint about how we handle your privacy, please contact us at alysha@zestcatering.com.au or 0400 000 161 (Entity: ZEST EVENTS & CATERING, ABN 89 650 509 103, 323 Castlereagh Street, Haymarket NSW 2000). If you are not satisfied with our response, you have the right to escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.