Privacy Policy

This notice explains what personal information Apron & Atlas collects throughhttps://apronandatlas.com, why, how long it is kept, and what you can ask me to do about it. It is written under the South African Protection of Personal Information Act 4 of 2013 (POPIA).

The short version: the only personal information I ask for is what you type into the quote form, I use it to answer you, I do not sell it and I do not send marketing. Audience measurement is off until you switch it on.

Who is responsible for your information

My physical address is not published on this site at this time. The email address and telephone number above reach me directly, and either can be used to ask a question about your information or to exercise any of the rights set out below.

What is collected, and why

The quote request form

This is the only place on the site where you are asked to give me anything. The form collects:

• your name;
• your email address;
• your telephone number, if you choose to give it — the field is optional;
• the kind of occasion you are planning and the approximate number of guests;
• your preferred date, an alternative date if you give one, and whether you are flexible;
• roughly where in Cape Town you are, so I know whether and how far I am travelling;
• whatever you write in the message — which may include dietary requirements or allergies, if you choose to tell me about them.

Purpose: to read your request, write you a menu and a quote, and correspond with you about it. Nothing else. Justification under POPIA: the information is necessary to take steps at your request before entering into a contract, and you consent to it explicitly by ticking the box on the form.

Health-related information. If you tell me about an allergy or a dietary requirement, that is special personal information under POPIA section 26. I ask for it only so that nobody at your table is served something they should not eat, I use it for no other purpose, and you give it to me voluntarily by choosing to write it in the message field. If you would rather not put it in writing on the site, leave it out and tell me by telephone instead.

All fields except the telephone number are required, because a request without them cannot be answered. There is no account to create, no newsletter to subscribe to, and no marketing list.

Audience measurement

The site uses Google Analytics 4 to understand which pages are useful and which are confusing. It is switched off until you accept it — until then the Google tag is not even downloaded, so nothing about your visit reaches Google at all — and you can change your mind at any time from the "Manage cookies" link in the footer. Withdrawing stops the measurement in the same moment and deletes the cookies it had set.

If you do accept, what Google receives is how the site is used, not who you are: the pages you open and in what order, how you arrived, the kind of device and browser you use, an approximate location worked out from your IP address, and a randomly generated identifier held in the cookies listed in the Cookie Policy. I see it only as aggregated reports. It is never combined with anything you send through the quote form.

It is not used for advertising. The tag is loaded with Google's advertising, advertising-data and personalisation permissions all set to "denied", and this site never lifts them — accepting measurement is not, and cannot become, permission to advertise to you.

Session recordings and heatmaps

The site separately uses Microsoft Clarity to record how visitors scroll and click through pages, and to build heatmaps from that — a visual complement to what Google Analytics reports in numbers. It has its own, independent switched off until you accept it choice in the cookie banner: accepting Google Analytics does not turn this on, and declining it does not turn this off. Until you accept it, nothing is requested from Microsoft at all.

If you do accept, Clarity records the pages you visit and how you interact with them — scrolling, clicks, and, where content is not explicitly masked, on-page text. It does not knowingly record what you type into the quote form: see the Cookie Policy for the cookies it sets.

Microsoft describes Clarity as operating under its own control, not solely on my instructions. Every other recipient on this page — the host, Web3Forms, Google — acts only as I direct it to and for no purpose of its own. Microsoft's own published position for Clarity is different: its FAQ states Clarity is "GDPR-compliant as a data controller," meaning Microsoft itself decides some of what it does with the data Clarity collects, not only what I instruct. I am relying on that as Microsoft's own accurate description of its role, not reinterpreting it — see Microsoft's Privacy Statement for what Microsoft itself says it does with this data.

Server logs

The hosting provider records standard technical information for every request — IP address, date and time, page requested, browser type. This happens for security and reliability, and it happens on every website. It is not linked to anything you send through the form.

What is not collected

No payment details of any kind — nothing is sold or paid for through this site. No advertising or profiling cookies. No social network trackers. No location tracking. Nothing is sold or rented to anyone, ever.

Who else sees it

The host, Web3Forms and Google each act as an operator under POPIA: they process information on my instructions and for no purpose of their own. Microsoft is the one exception — see "Session recordings and heatmaps" above for why Clarity is described differently. Nobody else receives your information, and it is never sold.

Web3Forms handles the whole of what you type into the quote form — your name, email address, phone number if you give one, the number of guests, the occasion, the dates, the area you are in and everything you write in the message box — because that is the message it delivers to me. It states that it does not store submissions: it processes each one and forwards it to my inbox. Its server logs may contain personal information for a short period, and it states that it deletes them roughly every two months. It does not send you an email; the confirmation you see after sending is shown on this site, not delivered to your inbox.

Information leaving South Africa

The recipients above are outside South Africa — in the United States, and in India in the case of Web3Forms' parent company — so your information is transferred across borders. POPIA section 72 permits this where the recipient is bound by rules providing an adequate level of protection, or where the transfer is necessary to perform a contract at your request, or to take steps at your request before entering one. The second ground is the one relied on for the quote form: sending me your request necessarily means passing it through the provider that delivers it. The providers publish their own data-protection terms, which you can read on their sites; none of them has given me an assurance specific to South African law.

Audience measurement is a transfer as well — to Google in the United States — and it rests on a different ground: your consent. Section 72 also permits a transfer that the data subject has consented to, and consent is the whole of the basis here. Nothing reaches Google unless you have accepted measurement, and withdrawing that acceptance ends the transfer from that moment. Google publishes its own data-protection terms; as with the others, none of them is an assurance given to me specifically under South African law.

Session recordings and heatmaps are the same kind of transfer, to Microsoft in the United States, resting on the same ground — your consent, and nothing else. Nothing reaches Microsoft unless you have accepted that specific service, separately from audience measurement, and withdrawing ends the transfer from that moment.

How long it is kept

If your enquiry does not become a booking, I keep it for twelve months and then delete it. That is long enough to follow up on what you asked for and to recognise you if you come back later in the season, and POPIA section 14 does not allow me to hold personal information for longer than I actually need it.

If your enquiry does become a booking, I keep the record for five years after the event. Records tied to a paid booking are kept to meet South African tax record-keeping obligations — keeping information to satisfy an obligation imposed by law is one of the grounds POPIA section 14 allows.

Web3Forms does not store what you send through the form, and it states that it deletes its server logs roughly every two months, as described above.

Audience measurement data is a separate matter and has nothing to do with the two periods above, which cover only what you send through the quote form. I do not hold it: Google does, and Google deletes it on a schedule set inside the Analytics property rather than by anything on this site. Google offers two values for a property of this kind, 2 months and 14 months, and I have set it to 14 months — so the event and visitor-level analytics data Google holds for a visit is deleted 14 months after that visit. This applies only if you accepted audience measurement: if you declined, nothing about your visit ever reached Google, so there is no analytics data of yours to keep or delete. Deleting the cookies, or withdrawing your consent, stops any further data being collected but does not by itself erase what was already sent — for that, write to me and I will make the request to Google.

Session recordings and heatmaps are held by Microsoft on its own retention schedule, published in Clarity's own documentation rather than set by me: a session recording is generally kept for 30 days from when it was recorded, and a sample of recordings, along with heatmap data, for up to 9 months. This applies only if you accepted that service — declining means nothing about your visit ever reached Microsoft. As with Google, withdrawing consent stops further collection but does not itself erase what was already sent; write to me and I will make the request to Microsoft.

You can ask me to delete your request at any time. Where a record is being kept to meet a tax obligation I may not be able to delete all of it before those five years are up — if that applies to you, I will tell you so and delete what I can.

How it is protected

The site is served only over HTTPS. The form posts directly to a transactional email provider and is not stored in a database on this site — there is no visitor database to breach. Access to the inbox that receives requests is limited to Antoine Essig. If a breach ever affects your information, POPIA section 22 requires me to notify you and the Information Regulator, and I will.

Your rights

Under POPIA you may:

• ask what personal information I hold about you, and be given a copy (section 23);
• ask me to correct or delete anything inaccurate, irrelevant or out of date (section 24);
• object to my processing your information (section 11(3));
• withdraw a consent you previously gave, at any time, without giving a reason;
• complain to the Information Regulator.

Write to [email protected] and I will reply within a reasonable time. There is no charge for a first request.

If you are not satisfied with my answer, you can complain to the Information Regulator (South Africa) — inforegulator.org.za.

Children

This site is not aimed at children and I do not knowingly collect information about anyone under 18. If a child's information reaches me through the form, tell me and I will delete it.

Changes to this notice

If this notice changes, the date at the top of the page changes with it. Material changes will be flagged on the site rather than made quietly.

Questions about any of this: [email protected].