Privacy
A short privacy notice.
This notice explains what personal information this website processes, why, and what you can ask of us. It covers enquiries sent through the Contact page, the voluntary mailing list, support payments, and the private visitor statistics we keep.
Who is responsible
Paul Dukai, trading as DUKAI, is responsible for deciding why and how the information described here is used. Any question or request about it can be sent through the Contact page.
Website enquiries
The Contact form collects the name, email address, optional organisation, enquiry type and message that you choose to provide, together with the browser type the enquiry was sent from, which helps identify automated or abusive submissions. This is collected so that Paul can read the enquiry and reply, and so that a proper record of professional correspondence can be kept.
Enquiries are stored using Supabase and a copy is delivered to Paul by email using Resend. They are kept only for as long as reasonably necessary to respond, follow the conversation through and meet legitimate record-keeping or legal requirements. You can ask for an enquiry to be deleted at any time. Sending an enquiry does not create a contract or any obligation on either side, and it never adds you to the mailing list.
The voluntary mailing list
Your email address is collected for the mailing list only when you deliberately fill in the “Stay at the table” form, with your first name if you choose to give it. Subscribing is a two-step process: after you submit the form, a confirmation email is sent to that address, and you join the list only if you use the link in it. An unused link expires after 48 hours and nothing is sent to you until you confirm.
The list is used to send occasional DUKAI news: upcoming events, new menus, recipes, culinary projects and related updates. Your consent is recorded, with the date and time of your request and confirmation, the page the form was on and the version of the consent wording you agreed to. Every promotional email includes a working unsubscribe link. Unsubscribing stops future promotional messages; your address is then kept only so that it is not mailed again.
- Contact-form enquiries are never treated as consent to the mailing list.
- Past enquiries and ordinary visits to the website are never added to the list automatically.
- Subscriber addresses are never included in visitor statistics or in the reports described below.
Support payments
The Support the Journey page never asks for or accepts card numbers, online-banking passwords, PINs, CVVs or one-time passwords. When a hosted payment option is available, the support link takes you to an HTTPS checkout operated outside DUKAI. Payment credentials are entered with that provider, not on this website, and the provider identifies itself before payment is made. Its own privacy terms apply to the payment information it processes.
DUKAI may receive the ordinary confirmation information needed to recognise and account for a payment, such as the amount, payment status, reference and a payer name or email address when the payment provider or bank supplies it. If direct bank transfer details are shown, the transfer is made from your own bank or banking app. In the ordinary course of banking, the receiving account may show the amount, payer name and payment reference. This website does not collect or store your online-banking login or card credentials.
If Paul enables FNB PayShap on the Support page, the public ShapID includes his registered cellphone number and the recipient name that visitors should verify in their banking app. PayShap payments are completed in the visitor's bank app, not on DUKAI. The site does not receive the visitor's banking login or payment credentials.
Visitor statistics
We may keep private statistics about how the website is used. When this is switched on, each page view is recorded as a small event holding the date, the page, the broad type of device, the website a visit came from if any, and the country reported by the hosting service. To count visitors approximately without identifying them, the event also holds a one-way identifier.
That identifier is made from the network address of the request together with the device type, the date, and a secret key held only on the server. The network address is read from the request in memory and transformed immediately; it is never stored, never shown and never included in any email. Because the date is part of the transformation, the identifier changes every day and cannot be used to follow anyone from one day to the next. Raw events are kept for no more than 48 hours, after which only daily totals remain: how many views and approximate visitors each page had, where visits came from, the types of device and the countries, and a running total of page views since tracking began. No advertising profile is built and no cross-site tracking takes place.
Summaries of these totals are emailed privately to authorised DUKAI recipients, so that Paul can understand how the website is used, improve its content and measure genuine interest. Those summaries contain aggregate figures only: no network addresses, no identifiable browsing histories, no subscriber email addresses and no Contact messages.
Protecting the forms
To limit automated and abusive submissions, the website may derive the same kind of one-way, keyed value from a request's network address and keep it briefly, at most 30 days and usually far less, purely to count attempts. Confirmation and unsubscribe links are stored only as one-way hashes.
Service providers and where processing happens
Supabase stores the enquiries, the mailing list, the statistics and the security counters, and Resend delivers the email. Each acts only on this website's instructions to store and deliver, and neither uses the information for its own purposes. Both are international services and may hold the information outside South Africa; this notice does not claim that it stays in South Africa. No system can promise absolute security, but the information is kept to the minimum needed and protected with access controls, one-way hashing of links and server-only credentials.
Your rights
Under the Protection of Personal Information Act (POPIA) you may ask us to:
- Tell you what personal information we hold about your enquiry or subscription
- Correct information that is inaccurate
- Delete information that is no longer required
- Withdraw your consent to the mailing list, which you can also do at any time with the unsubscribe link
- Object to processing where the law allows
Send the request through the Contact page from the same email address you used originally, so that it can be verified. You also have the right to complain to the Information Regulator of South Africa, whose contact details are on its official website.
Cookies
The public website uses no advertising, analytics or behavioural-tracking cookies. The forms and the statistics described above set none.