Privacy Policy

Last updated: 26 August 2026

1. Who we are

Lunchbox CRM (Pty) Ltd (registration number 2026/614099/07) ("Lunchbox", "we", "us") operates the Lunchbox CRM service at app.lunchbox-crm.com and this website. Our registered address is 26 Royce Road, Bryanston Ext 45, Johannesburg, 2191, South Africa.

For anything in this policy, including requests under the Protection of Personal Information Act, 2013 (POPIA) or the EU/UK General Data Protection Regulation (GDPR), contact our Information Officer at privacy@lunchbox-crm.com.

2. Our two roles

Lunchbox is a business tool, so we wear two hats:

If you are a contact of a business that uses Lunchbox and want your information corrected or deleted, the quickest route is to contact that business; you may also contact us and we will assist.

3. Information we process

4. How we use information

5. Who we share information with

We share information only with the service providers (operators/sub-processors) needed to run Lunchbox, each bound by their own data protection commitments:

We may also disclose information where the law requires it, or as part of a corporate transaction with equivalent protections.

6. International transfers

Several providers above process data outside South Africa (largely in the United States and the EU). We transfer personal information only under the conditions in section 72 of POPIA, and for GDPR-covered data we rely on appropriate safeguards such as adequacy decisions and Standard Contractual Clauses.

7. Retention

We keep information for as long as the related account is active. When an organisation deletes data or closes its account, the data is deleted from the live service, and expires from encrypted backups on a rolling schedule. We may retain limited records where the law requires (for example tax and billing records).

8. Security

All traffic is encrypted in transit with TLS. Stored integration credentials are encrypted at rest. Incoming webhooks are verified with cryptographic signatures. Access to production systems is restricted and logged. No system is perfectly secure, but if we learn of a breach affecting your personal information we will notify you and the applicable regulator as the law requires.

9. Your rights

Under POPIA you may ask us to confirm what personal information we hold about you, and to access, correct or delete it, or object to its processing. Contact privacy@lunchbox-crm.com. If you are unsatisfied with our response you may complain to the South African Information Regulator (inforegulator.org.za).

Under the GDPR / UK GDPR (where it applies to you) we process personal data on the lawful bases of contract performance, legitimate interests in operating and securing the service, and consent where required. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your supervisory authority.

10. Children

Lunchbox is a business service and is not directed at persons under 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy as the service evolves. The "Last updated" date above always reflects the current version, and material changes will be notified to registered users. Our Terms of Service incorporate this policy.

12. Contact

Information Officer, Lunchbox CRM (Pty) Ltd (2026/614099/07)
26 Royce Road, Bryanston Ext 45, Johannesburg, 2191, South Africa
privacy@lunchbox-crm.com