Kibaz — Course SpecificationMQA Non-Award submission

Draft — for MQA / HRDC approvalBuilt to disappear

kibaz academy

Non-award course · for MQA approval

Applied AI for Restaurant Operations

A short, practical, AI-focused course delivered in-house on a restaurant's own floor. This is the specification you submit to the MQA for Non-Award course approval — which in turn unlocks the HRDC refund (up to 90% for explicitly AI-focused courses).

First, the three answers you asked for — audience, how long, and what we charge — then the full course document.

Audience

A restaurant's whole floor team

Owner / manager, waiters & cashier, kitchen lead. Up to 25 per batch. No qualifications needed.

How long

1 off-day (~6 hrs) + a live shift

~8 contact hrs total — comfortably above the HRDC 4-hour minimum. Batches can be staggered (each batch still gets ≥4 hrs). MQA approval: allow 6–12 weeks.

What we charge

Rs 75,000

per in-house cohort. ~Rs 7,500 net to the merchant after 90% refund.

Note: to deliver for refund, Kibaz must first be a Registered Training Institution (MQA) and the trainer an MQA-registered resource person — a one-time prerequisite that runs in parallel and takes its own lead time. Figures indicative; verify live rules with MQA / HRDC.

A — Pricing & our margin

Why Rs 75,000, and how we keep a margin

We price the cohort, not the head — one in-house programme for the whole team. Rs 75,000 is deliberate: high enough that the HRDC refund and the certificate carry real perceived value, low enough that the net (~Rs 7,500) is a trivial yes for the owner.

List price (per in-house cohort, ≤25 staff)	Rs 75,000
Our delivery cost (trainer day + live-shift assessment, materials, G1/G3 admin)	≈ Rs 18,000
Gross margin per cohort	≈ Rs 57,000
Merchant's net cost (after 90% AI refund)	≈ Rs 7,500

So a single sale both funds the onboarding and turns a profit — while the merchant pays almost nothing. Where a venue is strategic, we can discount toward our cost and treat the delivery purely as paid customer acquisition; we should not give it away free, because a zero price makes the refund meaningless and cheapens the certificate.

Per-head equivalent ≈ Rs 3,000 for a full team of 25. Multi-site groups priced per venue. Fees must be paid through bank channels — HRDC does not refund cash payments.

Catering is a live purchase, not a training cost. The practical meal is a real order Kibaz places through the restaurant's own Kibaz system at full menu price, separately invoiced as a Kibaz hospitality expense. It is deliberately kept out of the HRDC claim — the refundable base is only the trainer fee and materials — so there is no circular money-flow and no conflict of interest. The purchase is not contingent on enrolment.

B — The course document

1 · Course identification

Course title	Applied AI for Restaurant Operations
Course type	Non-Award course (short course), MQA Approval of Non-Award Courses Regulations 2021
Level	Below Diploma (introductory / applied). Within the HRDC "AI up to Diploma level" band.
Field	Artificial Intelligence applied to hospitality & food service
Duration	One off-day session of ~6 contact hours, plus a ~2-hour assessed practical folded into a normal service. ~8 contact hours / ~12 notional hours total — the classroom day alone exceeds the HRDC minimum of 4 hours. Deliberately kept to a single rest-day so the team only gives up one day.
Mode	In-house, face-to-face, at the employer's premises (the working restaurant)
Scheduling	The classroom day runs on the team's rest day; the practical is assessed during a real service, so it costs no extra off-day time. Batches may be staggered or repeated across runs — the whole team need not attend the same day, but every batch receives the full ≥4-hour programme (never a shortened split).
Batch size	Up to 25 trainees per batch
Language	English / French; floor practice in Kreol as needed
Certification	Kibaz Academy Certificate of Completion (non-award)

2 · Rationale & need

Mauritian restaurants are adopting AI-driven ordering, customer-insight and marketing tools faster than their teams can use them well. This course builds practical AI literacy and the hands-on competence to operate an AI-assisted service — improving speed, accuracy, customer retention and data-informed decisions — using a live platform as the teaching environment.

3 · Target audience & entry requirements

Primary audience	Restaurant front-of-house and management: owner / manager, supervisors, waiters, cashier / POS operator, kitchen lead.
Entry requirements	No academic qualification required — open to staff below HSC. Currently employed in a food-service business; able to follow instructions and use a smartphone / tablet with guidance. No prior IT, AI or formal background needed. This is a practical course built for the working floor, not the classroom.
For HRDC refund eligibility	Trainees must be Mauritian citizens or permanent residents; the employer must contribute the training levy.

4 · Aim

To enable a restaurant team to understand what AI does in a hospitality setting and to confidently operate an AI-assisted ordering, service and customer-engagement system end-to-end, responsibly and to a measurable standard.

5 · Course learning outcomes

On successful completion, trainees will be able to:

#	Learning outcome
LO1	Explain in plain terms what AI is and identify where recommendation, ranking, forecasting and language models add value in a restaurant.
LO2	Operate an AI-assisted digital table and ordering flow, from a guest joining to sending an order.
LO3	Process orders and payments on the POS and kitchen display, including rounds, settlement and closing a table.
LO4	Interpret AI-generated customer segments and analytics to make a service or stock decision.
LO5	Design and run a targeted win-back campaign and a loyalty / deal offer, and read its results.
LO6	Apply data-protection and responsible-AI practices, including consent and fair use of customer data.

6 · Course structure & contact hours

Mod	Title	Hrs	LO
Off-day classroom — one rest day
1	AI foundations & responsible AI	1.0	LO1, LO6
2	The AI-assisted table & ordering	1.0	LO2
3	Running the floor — POS & kitchen screen	1.5	LO3
4	Customers, campaigns & loyalty — AI insights, win-back & deals	1.5	LO4, LO5
5	Guided practice / dry run	1.0	LO2–LO5
Off-day subtotal		6.0
On a real shift — no extra off-day time
6	Assessed live service — a real Kibaz-funded order processed end-to-end	2.0	LO2–LO6
Total contact hours		8.0

Plus ~4 hours self-paced revision in the app = ~12 notional learning hours. The only time staff give up is the single classroom day; the practical happens while they work. In that practical, Kibaz places a real order for the participants' meal through the restaurant's own system — the team processes a genuine ticket end-to-end, and the food doubles as the working lunch.

7 · Delivery & teaching methods

Short tutor-led briefings, live demonstration on the restaurant's own devices, supervised hands-on practice at each station, and a final assessed service. Concept modules (1, 4, 7) use plain-language explanation and worked examples; tool modules are entirely practical.

Because most floor staff have no formal qualifications, the course is deliberately demonstration-led and visual, delivered in Kreol where it helps, with minimal reading. Learners are shown, then do — never asked to study from text.

8 · Assessment

Component	Weight	Assesses
Continuous station checkpoints (observed)	40%	LO2, LO3
Short knowledge check (concepts & responsible AI) — oral or practical, no written exam	20%	LO1, LO6
Practical: assessed live service end-to-end	40%	LO2–LO5

Pass mark 50% overall, with a mandatory pass on the practical. The knowledge check is conducted orally or by demonstration so that staff with no formal schooling are assessed on competence, not literacy. Attendance recorded per session and submitted to HRDC within 12 hours of completion, as required.

9 · Trainer & resources

Trainer	MQA-registered resource person; Diploma or above in a relevant field and/or substantial F&B / digital-systems experience; trained on the Kibaz platform.
Trainer : trainee ratio	1 : up to 25 (a floor assistant supports during the practical)
Resources	The restaurant's own devices (phones / tablet / printer), the Kibaz apps in a training mode, printed quick-guides, attendance register.
Venue	Employer's premises (the working restaurant) — no external venue required.

10 · Approval & quality assurance — and timeline

Prerequisite — RTI registration. Kibaz registers as a Training Institution with the MQA (one-time). Runs in parallel; budget its own lead time.

Submit this spec to MQA via the online Non-Award Courses portal (MAUPASS login), with fee. Days to prepare.

MQA review & outcome. Statement of Approval issued for a fixed validity period. Allow 6–12 weeks from a complete file.

Deliver & claim. With the MQA approval live, file HRDC G1 before each run and G3 after — the merchant claims up to 90% back.

Draft for submission. Course must be delivered in strict compliance with the MQA Statement of Approval and not run after its expiry. MQA / HRDC regulations, fees, the AI 90% measure, processing times and eligible costs are set by those authorities and change over time — confirm the current rules and your grant ceiling before relying on any figure here.

Kibaz — Merchant handbookLegal · Payments · Training

Working drafts — counsel / HRDC / MQA review requiredBuilt to disappear

kibaz

Merchant handbook · one pack

Legal, Payments & Training

Every document a Kibaz merchant signs or relies on, gathered into a single reference: the legal pack, the data-protection playbook, the payments & fees addendum, and the team-training programme.

Operated by Posterita Ltd ("Kibaz", "we"). Drafts for counsel / HRDC / MQA review — see the note in each part.

Working drafts, not legal advice. Each part is a template tailored to Kibaz. Have a qualified Mauritian lawyer review the legal and payment parts, confirm data-protection points with the Data Protection Office, and verify training/refund figures with HRDC and MQA before relying on them.

Contents

Part 1

Privacy Notice & Terms of Service

Diner privacy notice, diner terms, the nine merchant clauses, and contact.

Part 2

Data Protection playbook

How Kibaz meets the Data Protection Act 2017 in practice.

Part 3

Payments & Fees addendum

What Kibaz charges, and when it charges nothing.

Part 4

Training & the Academy

Team onboarding, delivered in-house and part-funded by the State.

Part 5

Billing & subscription forms

How the monthly Pro fee is collected, and the forms signed at onboarding.

Part 1

Legal pack · Privacy, Terms & Merchant clauses

Legal pack · the documents themselves

Privacy Notice & Terms of Service

The full text — diner Privacy Notice, diner Terms of Service, and the merchant terms (reused from the onboarding flow). Written for the Kibaz model and the Mauritius Data Protection Act 2017.

Operated by Posterita Ltd ("Kibaz", "we"). Plain-language draft to be issued in English, French and Kreol.

Draft template, not legal advice. These documents are a working draft tailored to Kibaz. Have a qualified Mauritian lawyer review and finalise them, and confirm the data-protection points against the Data Protection Office's current guidance, before you publish or rely on them.

Contents

A · Diner Privacy Notice

B · Diner Terms of Service

C · Merchant terms (onboarding)

D · How to reach us

A — Diner Privacy Notice

Your data on Kibaz

Last updated: [date] · Version 1.0

1. Who we are

Kibaz is a Mauritian taste network operated by Posterita Ltd. For the personal data described here, Posterita Ltd is the data controller. Our Data Protection Officer can be reached at the details in section D.

2. What this notice covers

It explains what personal data we collect when you use the Kibaz app, why, the legal basis we rely on, who we share it with, how long we keep it, and the rights you have under the Data Protection Act 2017.

3. The data we collect

Account & identity — your name, phone number, and anything you add to your profile.

Taste data — the places and dishes you rank and like, your favourites, and the food categories you engage with. This is the heart of Kibaz.

Activity — your orders, the tables you join, points and vouchers, and your visit history.

Photos — pictures you take or upload during a meal.

Location — if you allow it, your approximate location, to find places near you and detect when you're at a venue.

Device & usage — basic technical data needed to run the app securely.

4. Why we use it, and our legal basis

To provide the service (run your account, take orders, manage tables, points and vouchers) — on the basis of our contract with you.

To power recommendations (suggest places and dishes through the taste network) — on the basis of your consent and our legitimate interest in making Kibaz useful; you can object at any time.

To send you offers over WhatsApp — only if you have subscribed; this is based on your consent, which you can withdraw at any time.

To keep Kibaz safe and lawful (security, fraud prevention, complying with the law) — on the basis of our legitimate interest and legal obligations.

5. Sensitive data

We do not ask for special-category data. Some food choices could imply things like religion or health (for example halal-only or allergy-related choices). We do not build profiles from such inferences, and we ask for your explicit consent before using any data in a way that would reveal them.

6. Who sees your data

People at your table — when you join a dining session, others at that table see your first name and the photos taken during the meal. Anyone at the table can delete a photo.

Your friends — if you accept someone as a friend, they can see your rankings and likes. Your spend, visit history, vouchers and points stay private by default. You control this in Me → Privacy, and can mute or remove a friend.

Restaurants — a restaurant sees your order and, if you subscribe to it, your contact for its offers. A restaurant only gains access to your wider profile with your consent. Photos you take of a dish may appear on that venue's page. A venue can hide a shot from its own pages but never delete it from yours; if a venue features your shot, you earn a royalty at the rate published on its page.

Our service providers — we use trusted suppliers (messaging, hosting, payments) who process data only on our instructions under a contract.

We never sell your personal data.

7. Points, vouchers and merchants

Loyalty points and vouchers are issued by each restaurant, scoped to that restaurant, and held in your Kibaz wallet. Where you order at a place that has not yet joined Kibaz, points are held for you and become usable only if and when that restaurant joins and honours them.

8. Automated decisions & profiling

Our recommendations and offer-targeting involve automated profiling of your taste data. We do not make solely-automated decisions that significantly affect you. You have the right to object to this profiling — turn off personalised offers in Me → Offers from Kibaz, or contact us.

9. Sending data outside Mauritius

Some providers store or process data outside Mauritius. When that happens we rely on a destination with equivalent protection, or put approved safeguards (such as standard contractual clauses) in place, or act on your explicit consent or to perform our contract.

10. How long we keep it

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. Location and visit history are kept for a limited period. You can ask us to delete your account and data at any time (section 11).

11. Your rights

Under the Data Protection Act 2017 you can ask to access your data, correct it, have it erased, object to or restrict its use, withdraw consent, and receive a copy to take elsewhere. To exercise any of these, contact us (section D). You also have the right to complain to the Data Protection Office of Mauritius.

12. Security

We protect your data with appropriate measures including encryption, access controls and logging, and we will notify the Data Protection Office and, where required, you, if a personal data breach occurs.

13. Children

Kibaz is not intended for children under [16/18]. We do not knowingly collect their data without parental consent.

14. Changes

We may update this notice; we'll show the new version in the app and, for material changes, tell you directly.

B — Diner Terms of Service

Using Kibaz

Last updated: [date] · Version 1.0 · These terms are separate from, and do not bundle, the consents in the Privacy Notice.

1. Agreement

By using the Kibaz app you agree to these terms. If you don't agree, please don't use Kibaz. Kibaz is operated by Posterita Ltd, Mauritius.

2. Who can use it

You must be at least [16/18] and provide accurate details. You're responsible for activity on your account and for keeping your phone secure.

3. What Kibaz does

Kibaz helps you discover places through people whose taste you trust, build a food order at your table, join a shared dining session, collect points and vouchers, and pay where supported. Kibaz is a platform — the food, service and prices are the restaurant's responsibility.

4. Ordering and your "food list"

Adding dishes builds your list. Sending a round commits it: at a restaurant on Kibaz it goes to the kitchen; at a place not yet on Kibaz it is sent as a request that staff confirm the usual way, and your bill there is provisional until the restaurant confirms it. Sent rounds are locked and shown on your bill.

5. Shared tables

Anyone at a table can order and see the shared session. Roles are earned by action — whoever first sends a round takes order-taking; whoever first pays takes the bill. Joining a table does not make you friends with others; friendship is always explicit and mutual.

6. Payments

Where you pay through Kibaz, payment is handled by our payment provider. Some venues are settled at the counter or by other methods. You're responsible for paying for what your table orders.

7. Points, vouchers and deals

Points and vouchers are issued by each restaurant, are scoped to that restaurant, are not cash, have no cash value, and can be changed or expired under the restaurant's published rules. A claimed deal applies only on a qualifying bill paid through Kibaz. Points you earned at a place that hasn't joined Kibaz are held and become usable only if it joins and honours them. Points may be pooled with others only as the app allows.

8. Reviews and recommendations

Kibaz is positives-only: you recommend places and dishes; you do not post negative public ratings. Private feedback about a poor experience goes to the restaurant, not onto a public wall. Recommendations are guidance, not a guarantee of any experience.

9. Photos and your content

You keep ownership of photos you add. You grant Kibaz a licence to show them to your table, to your friends, on the venue's page, and to operate the service. A venue may hide your photo from its own pages; it stays in your history and your friends' feeds. If a venue features your photo, you accrue a royalty at the rate published at feature time, credited to your Kibaz wallet. Don't upload content you don't have the right to share, or anything unlawful or offensive. Anyone at the table can remove a photo.

10. Acceptable use

Don't misuse Kibaz — no fraud, gaming the points system, scraping, harassment, or interfering with the service. We may pause or close accounts that break these terms.

11. Availability & changes

We work to keep Kibaz running but don't guarantee it will always be available or error-free. We may change or withdraw features, and we'll update these terms from time to time.

12. Liability

To the extent the law allows, Kibaz is provided "as is" and Posterita Ltd is not liable for the quality of food or service, for losses outside our reasonable control, or for indirect losses. Nothing here limits liability that cannot be limited by law.

13. Governing law

These terms are governed by the laws of Mauritius, and the courts of Mauritius have jurisdiction.

C — Merchant terms

Accepted at onboarding

A restaurant's authorised signatory accepts these nine clauses during the Kibaz onboarding flow (reused here, unchanged), recorded with a terms version and a verified WhatsApp claim.

The nine acceptance clauses

Authority

Authority to bind the BRN company and the named signatory.

Business accuracy

Business, BRN, address, phone, email and trading details are accurate.

Menu rights

Posterita Ltd may digitise, host and display this establishment's menu on Kibaz.

Media rights

Uploaded photos, logos, descriptions and menu media are covered by the Kibaz terms.

Voucher rules

Voucher value, quantity, expiry, eligibility, redemption, kill and refund rules are accepted.

Customer data & consent

Customer CRM access is allowed only after the customer gives consent.

Points policy

Points and vouchers are issued per venue, scoped to that venue, minted only on settled bills, and are not cash.

Promotion credits

Merchant Promotion Credits are non-cash Kibaz service credits for promotion only.

Suspension & review

Posterita Ltd may pause, review, reverse or suspend claims, offers, credits or listings.

Where Kibaz processes a restaurant's customer or staff data on its behalf, a separate Data Processing Agreement applies (see the Data Protection playbook). Clause 6 is the consent gate that backs the diner Privacy Notice.

C2 — Mall venue agreement

Signed with each mall

Two different contracts hold a food court together. The merchant terms above are about a kitchen trading. This one is about the venue: it lets Kibaz operate ordering, payments and QRs inside the mall's premises, and lets the mall syndicate restaurants Kibaz already onboarded into its court. One venue agreement per mall, signed by the mall's authorised signatory and Posterita Ltd.

🏬 The mall doesn't sign for the restaurants. Each kitchen keeps its own Kibaz merchant terms; the mall agreement covers the court, the tables and the commercials — not the trading relationship with any individual restaurant.

The ten venue clauses

Parties & authority

The mall operator (BRN company) and Posterita Ltd, each through an authorised signatory.

Premises & access

Right to operate Kibaz in the court and to place QRs, A-frames and signage on tables and counters.

Syndication

The mall may add restaurants Kibaz has already onboarded as kitchens in its court — same menu, same backend.

Commercials

The Court plan: a flat monthly fee per court from day 31, never a percentage of sales; invoicing terms and the founding-court rate lock where it applies.

Exclusivity & term

Kibaz as the sole ordering platform in the court, a 36-month term, and a performance break if Kibaz share is under 20% at month 6.

Responsibilities

Who installs and maintains QRs and signage, who fields floor support, who keeps table & zone data current.

Data ownership

Kibaz keeps the diner relationship and CRM; the mall sees aggregate court analytics, not personal data.

Payments & liability

Each kitchen is charged and settled directly by a licensed payment provider. Refunds are run from the kitchen's POS; order disputes are handled by Kibaz support. Nothing sits with the mall.

Branding

Co-branding ("Kibaz × [Mall]") on posters and in the app, and use of the mall's name in the court code.

Termination & offboarding

Notice periods, what happens to QRs and live orders on exit, and that kitchens stay on Kibaz independently.

Where the mall agreement touches personal data (e.g. shared court analytics), the Data Processing Agreement and cross-border rules in the Data Protection playbook apply. This is a commercial template — have counsel finalise it per mall.

D — How to reach us

Contact & complaints

Posterita Ltd — operator of Kibaz
Data Protection Officer: [name / email]
Address: [registered address], Mauritius
In-app: Me → Help & privacy

You also have the right to lodge a complaint with the Data Protection Office of Mauritius if you believe your data has been mishandled.

Bracketed items ([date], [name], age threshold, address) are placeholders to complete. This draft must be reviewed and finalised by a qualified Mauritian lawyer, and checked against the Data Protection Office's current guidance, before publication.

Part 2

Data Protection · Compliance playbook

Data protection — what we must do

Complying with the Data Protection Act 2017

Kibaz holds exactly the kind of data the law cares most about — who people are, what they like, where they eat, their photos, and staff records. This is the playbook: what we must do, and every contract and document we need in place.

Mauritius's Data Protection Act 2017 (in force 15 Jan 2018) is closely modelled on the EU GDPR and enforced by the Data Protection Office (the Commissioner). Get this right once and it protects the whole business; get it wrong and processing without registration alone carries a fine up to Rs 200,000 and up to 5 years' imprisonment.

The principle behind everything below

Collect only what you need, for a clear purpose, with a lawful basis; tell people plainly; keep it safe; let them control it; and have a contract wherever data moves to someone else.

01 — Where Kibaz stands in law

Are we a "controller" or a "processor"? Both.

The Act splits responsibility between the controller (decides why and how data is used) and the processor (handles it on the controller's instructions). Kibaz wears different hats depending on the data — and each hat needs its own paperwork.

Data	Kibaz is…	What that means
Diner accounts & the taste network (rankings, likes, photos, location, order & spend history)	Controller	We decide the purpose, so we own the privacy notice, consent, rights handling and security for all of it.
A merchant's own customer list, loyalty & campaigns	Processor for the merchant (often joint)	The restaurant is the controller of its customer relationship; we process on its instructions — so we need a Data Processing Agreement with every merchant.
Staff records — attendance, leave, the staff app	Processor for the employer	The restaurant is the employer/controller; covered by the same merchant DPA plus an employee notice.

The Act applies to any controller/processor established in Mauritius (and to foreign ones using equipment here). Both controllers and processors must register with the Data Protection Office.

02 — The duties we sign up to

The core principles (Part IV)

Lawfulness & transparency

A valid lawful basis for every use, explained in plain language.

Purpose limitation

Use data only for the purposes you stated when you collected it.

Minimisation & accuracy

Collect the least you need; keep it correct and up to date.

Storage limitation

Keep it no longer than needed, then destroy it (a duty under the Act).

Security

Appropriate technical & organisational measures — encryption, access control.

Accountability

Be able to prove compliance — records, DPIAs, contracts.

03 — The action checklist

Ten things to do, in order

Register with the Data Protection Office as both controller and processor — before processing, and renew on time. This is the single most important step; skipping it is the offence with the heaviest penalty.

Appoint a Data Protection Officer (a named, responsible person) as the point of contact for the DPO and for data subjects.

Map your data — build the ROPA. A written Record of Processing: what you hold, why, the lawful basis, where it's stored, who it's shared with, how long you keep it.

Run a DPIA on the risky bits — AI profiling / recommendations, win-back targeting, location, and photos. The Act requires an impact assessment for high-risk processing.

Fix your lawful basis & consent. Granular, unbundled, opt-in — separate toggles for WhatsApp, marketing, photo sharing and friend visibility. Consent must be a clear affirmative action, never pre-ticked or buried in the T&Cs.

Put the contracts in place — every document in section 05.

Secure the data — encryption in transit and at rest, role-based access, logging, and a prior security check on sensitive processing.

Stand up a 72-hour breach plan and a DSAR process — a written drill for breaches and a way to answer access / correction / deletion requests on time.

Sort cross-border transfers — anything sent to Meta, your cloud host, SMS gateway or payment processor abroad (section 07).

Train the team & review yearly. Compliance is a habit, not a one-off file. Re-check the ROPA, consents and contracts annually.

04 — Every document & contract you need

The legal pack

A · Public-facing (diners & merchants see these)

Privacy Notice	How Kibaz collects and uses data, the lawful basis, retention and the user's rights. One diner version (in-app, plain + Kreol/French), one merchant version.
Terms of Service	The agreement to use Kibaz. Kept separate from consent — you cannot bundle marketing consent into the T&Cs.
Consent records	A logged, time-stamped record of each granular opt-in (WhatsApp, marketing, photo sharing, friend visibility) and any withdrawal.
Cookie / tracking notice	For the PWA — consent for any non-essential cookies or analytics.

B · Contracts with merchants & suppliers

Merchant Agreement	The commercial contract with each restaurant, including the data-protection clauses and roles.
Data Processing Agreement (Kibaz ⇄ Merchant)	Required by the Act wherever we process on a merchant's behalf: scope, instructions, security, sub-processors, breach duties, return/deletion. Covers staff data too.
Employee data notice	Given to staff for attendance, leave and the staff app — what's collected and why.
Sub-processor DPAs	A data agreement with every external supplier that touches the data: the WhatsApp Business provider (Meta), cloud hosting, SMS gateway, payment processor.
Standard Contractual Clauses	Transfer safeguards attached to any supplier that stores or processes data outside Mauritius (section 07).

C · Internal documents (you must hold, may be asked for)

Record of Processing Activities (ROPA)	The master register of everything you process — a duty under the Act.
Data Protection Impact Assessment (DPIA)	For the AI profiling, location and photos — the high-risk processing.
Data Retention & Deletion Policy	How long each data type is kept and how it's destroyed (the duty to destroy).
Information Security Policy	Your technical & organisational measures — access, encryption, backups.
Breach Response Plan + Register	The 72-hour drill and a log of every incident.
DSAR Procedure	How you handle access, rectification, erasure, portability and objection requests.

Templates exist (the DPO publishes guidance), but each should be tailored to Kibaz and reviewed by a Mauritian data-protection lawyer before use.

05 — The parts specific to Kibaz

Where our data gets sensitive

Taste can reveal "special category" data. A halal-only or no-pork pattern can imply religion; allergy or "diabetic-friendly" choices can imply health. These categories get the strictest protection — so don't infer or store them as profile attributes without explicit, separate consent.

Photos are personal data. They can show people's faces (and ethnicity). Sharing to the table, to friends or to the restaurant each needs a clear basis — and anyone must be able to delete a photo, as the app already allows.

Location & visit history are revealing. Auto-detecting "you're near a restaurant" and the visit log need their own consent and a tight retention limit — keep it only as long as it's useful.

Profiling triggers the right to object. Recommendations and win-back targeting are automated profiling — the Act gives people the right to object to it, so offer a clear opt-out and never make a solely-automated decision that significantly affects someone.

Children's data is special. If minors can hold an account, you need parental consent and extra care, or set a minimum age in the terms.

WhatsApp marketing needs its own opt-in. The subscribe step is exactly right — it's the consent. Keep the record, honour unsubscribes immediately, and don't message non-subscribers.

06 — Sending data abroad

Cross-border transfers

The moment data leaves Mauritius — to Meta's servers, a cloud host, an SMS gateway or a card processor — transfer rules apply. It's only allowed if the destination offers equivalent protection, or you put an approved safeguard (Standard Contractual Clauses) in place, or you have the data subject's explicit consent, or it's necessary for the contract.

Practical step: list every supplier that stores data outside Mauritius, note where, and attach SCCs to each. Prefer hosting Mauritian personal data in-country or in an adequate jurisdiction where you can.

07 — When something goes wrong

The 72-hour breach rule

≤ 72 hrs

Notify the Commissioner after becoming aware of a breach. Late? You must give reasons.

High risk

Tell the affected people too, without undue delay, where the breach is likely to harm them.

As processor

If a breach hits merchant data, tell that merchant (the controller) without undue delay.

Log every incident in the breach register, even the ones you don't have to report — accountability means showing your working.

This playbook is a practical summary for internal planning and is not legal advice. The Data Protection Act 2017, the Data Protection Office's guidance, registration procedure, fees and timelines govern and change over time. Confirm current requirements with the Data Protection Office and engage a qualified Mauritian data-protection lawyer to draft and review the documents before you rely on them.

Part 3

Merchant agreement · Payments & Fees addendum

Payments & Fees

How Kibaz charges, and — just as importantly — when it doesn't. The principle in one line: you pay only where Kibaz brings the diner or carries the money; you never pay a percentage on business you settle yourself.

1 · Scope

This addendum governs all fees between Kibaz and the Merchant for ordering, discovery and payment services. It supplements and, on fees, prevails over the main Merchant Agreement.

2 · Definitions

2.1 Kibaz-Acquired Order — an order from a diner who discovered or chose the Merchant through the Kibaz app (Discover / Top dishes), evidenced by the unique first-visit dinner-session code.

2.2 Own-Customer Order — an order from the Merchant's existing customer placed via the Merchant's table QR, own link, or entered by staff.

2.3 In-App Self-Pay — a bill the diner settles themselves inside Kibaz (card or Juice / MauCAS), charged directly to the Merchant by a licensed payment service provider.

2.4 Counter Settlement — a bill closed on the Merchant's own POS, card terminal, or in cash.

3 · The fees

3.1 · Net-new order fee 8% of the bill, minimum Rs 20, per fulfilled Kibaz-Acquired Order (§2.1). 3% on a remote order from the Merchant's own regular carried on Kibaz rails. Charged only on orders the kitchen accepts and fulfils — never on cancellations or no-shows.

3.2 · Processing fee 1.9% + Rs 4 per In-App Self-Pay (§2.3). Each payment is charged directly to the Merchant's own account by a licensed payment service provider; Kibaz's fee is deducted by that provider. Kibaz never holds the Merchant's funds.

3.3 · Rs 0 — your own business No fee whatsoever on Own-Customer Orders (§2.2) or Counter Settlements (§2.4). Kibaz charges no percentage on any bill the Merchant settles itself.

3.4 · No blending Targeted deals the Merchant chooses to run are charged 15% of the deal value, minimum Rs 50, on redemption only. Every fee appears as a separate line item on every statement. Neither is, or may be presented as, a commission on the Merchant's own sales.

4 · Included at no charge

POS / Posterita sync, QR dine-in ordering, kitchen display, the staff order app, attendance tracking, loyalty & rewards, basic analytics and viewing the customer list are provided free. Paid tiers (Pro) and metered services (WhatsApp / SMS campaigns) are governed separately.

5 · Settlement, refunds & guarantee

5.1 Settlement. In-App Self-Pay funds settle from the payment service provider to the Merchant's own account under that provider's terms; Kibaz is not a party to the funds flow. Order fees (§3.1) and deal fees (§3.4) are invoiced monthly.

5.2 Refunds & chargebacks. Refunds are initiated from the Kibaz POS and executed by the payment service provider against the Merchant's account; chargeback liability follows the provider's rules.

5.3 Order guarantee (paid tiers). If Kibaz delivers fewer than [N] net-new orders in a calendar month, that month's subscription fee is waived.

5.4 Changes. Fee levels are pilot-calibrated and may be revised on [30] days' written notice; the Merchant may terminate without penalty if it does not accept a change.

For the Merchant · name, signature, date

For Kibaz · name, signature, date

Plain-language draft — not legal advice. Bracketed values are placeholders. Before use, confirm with counsel and the payment service provider that direct per-merchant charging with an application fee is in place, and align settlement, refund and chargeback terms with the PSP contract.

Part 4

Kibaz Academy · Team training & funding

Onboarding, paid for by the State

Get your team trained on Kibaz — and claim up to 90% back from HRDC

Kibaz onboards a restaurant by training its people, not by handing over a login. The training is an AI-focused programme delivered on your own floor — so your staff learn the tools by using them on a real service.

Because the course is explicitly focused on Artificial Intelligence, it qualifies for the HRDC's enhanced refund rate — up to 90% of the training cost for levy-paying employers. Onboarding stops being a cost and becomes a near-free, certified upskilling of your whole team.

The idea in one line

An MQA-approved, AI-focused course, run inside your restaurant, that teaches your team to run on Kibaz — with the State refunding most of the bill.

01 — The HRDC mechanism

Why AI training is refunded at 90%

Every registered employer in Mauritius already pays a monthly Training Levy (a percentage of payroll) into the National Training Fund. The HRDC lets you claim a large share of approved training back through the Levy / Grant System — normally around 70–75% of the cost.

As a 2024 Budget measure, for courses explicitly focused on Artificial Intelligence starting on or after 1 July 2024, that rate is lifted to up to 90%, for AI courses up to Diploma level. Kibaz Academy is designed from the ground up to sit squarely inside that definition.

~70–75%

Standard refund
on approved training

→

up to 90%

For courses explicitly
focused on AI

Refunds are subject to your annual grant ceiling (which scales with the levy you paid the previous year), to MQA / HEC course approval, and to HRDC rules in force at the time. Figures here are indicative — confirm your ceiling and the live rate with HRDC before enrolling.

02 — Your floor is the classroom

In-house training, on your own premises

We run it under the HRDC In-House Training scheme — delivered solely for your restaurant, by our trainer, at your venue. No one leaves the floor, there's no venue hire, and the "practical" is a real service on your own tables.

Trained where they work. Waiters, cooks, cashier and owner learn on the exact stations they'll use — Dine-In, POS, the kitchen screen, the staff app.

A whole cohort at once. Up to 25 trainees per batch are eligible — enough for the entire team of most restaurants in a single programme.

The assessment is a live service. The hands-on module is your real dinner rush, run on Kibaz — so by the time the course ends, you're already operating on it. Training is the onboarding.

Eligible costs under the scheme typically include trainer fees and course materials; because we train on your premises there's no venue cost to claim. Cash payments are not refundable — fees must be paid through bank channels.

03 — What we cover

The curriculum

Eight modules, roughly two days on the floor. Every module pairs a genuine AI concept with the Kibaz tool that puts it to work — so the team builds real AI literacy and leaves running the restaurant on Kibaz.

AI in hospitality — the foundations

What AI actually is, where it helps a restaurant, and where it doesn't. Recommendation, ranking, forecasting and language models in plain terms. AI concept · sets the qualifying frame.

The AI-assisted table

How diners order on Kibaz, how the taste network recommends dishes, and how the QR table session works. Tool · Kibaz Dine-In.

Running the floor — POS & kitchen screen

Taking and routing orders, the rounds, the bar and kitchen displays, closing and settling a table. Tool · Kibaz POS + KDS.

Reading your customers — AI insights

How the CRM segments diners, what "lapsed" and "regular" mean, and how to read the analytics without a data team. AI concept + tool · Kibaz CRM.

AI win-back & campaigns

How targeting picks who to message and when, writing a good offer, and reading campaign results. The genuine "applied AI" core of the course. AI concept + tool · Win-back AI.

Loyalty & deals that pay off

Designing a points programme, funding a deal, and the rule that a deal only costs you when a real guest redeems it. Tool · Loyalty + Deals.

Data, privacy & responsible AI

What data Kibaz holds, consent and the WhatsApp opt-in, and using AI fairly. Genuine AI-ethics content that strengthens the course's standing. AI concept.

Hands-on — your restaurant as the lab

A live, assessed service run end-to-end on Kibaz. Pass it and your team is certified — and you are live on the platform. Practical assessment.

To draw the 90% rate the programme must be genuinely and explicitly AI-focused and carry MQA / HEC approval at Diploma level or below. The AI-concept modules above are not dressing — they are what makes the course qualify, and what your team actually keeps.

04 — The economics

What it actually costs you

An illustrative in-house programme for a full team. Your real numbers depend on your grant ceiling — but the shape is the point: the State carries most of it.

Illustrative — in-house AI programme, up to 25 staff

Programme fee (trainer + materials, on your premises)	Rs 75,000
HRDC AI refund @ 90%	− Rs 67,500
Net cost to your restaurant	Rs 7,500

For roughly the price of a slow Tuesday, the whole team is certified on AI tools and the restaurant is live on Kibaz. Compare that to the usual onboarding cost — staff time, mistakes, a consultant — and it inverts: onboarding now pays for itself.

Refund is capped by your annual grant ceiling and paid after the claim is processed (typically a few weeks). If AI rules change, the standard ~70–75% rate still makes the maths work. Numbers indicative only.

05 — How it runs

From sign-up to refund — we handle the paperwork

Eligibility check

We confirm you contribute the training levy and estimate your grant ceiling. A few months of contributions is enough to start.

G1 before we start

We file the G1 grant application on the HRDC online system ahead of the course — for in-house training, at least 5 working days before the start date. The MQA-approved course is registered against it.

Two days on your floor

We deliver the eight modules at your venue around your service hours. Attendance is recorded and sent to HRDC, as required, within 12 hours of completion.

G3 claim → refund

After the course we file the G3 with certificates, attendance and the (bank-paid) invoice. HRDC refunds your account, usually within a few weeks. You're certified, live on Kibaz, and out only the small net.

Only employers can claim the refund, and only for Mauritian / permanent-resident trainees. Deadlines and forms follow current HRDC rules; we keep to them so the claim isn't rejected.

06 — Why this is the onboarding

Training is the cheapest, stickiest way in

Free to the merchant, funded onboarding for us. The refund covers the cost of getting a restaurant fully trained and live — the hardest, most expensive part of adoption — with the State carrying ~90%.

A trained team is a retained team. Once the whole floor knows Kibaz by hand and is certified on it, switching away is a re-training cost. Competence creates stickiness no contract can.

MQA credibility, not a sales pitch. An accredited AI certificate is something an owner is proud to put their staff through — it reframes Kibaz from "an app to install" to "an upskilling the business gains from."

The pitch to the owner

"Let us certify your whole team on AI tools, on your own floor, for about Rs 7,500 net — and you'll be running on Kibaz by the time we leave."

This document is indicative and for internal/merchant discussion. HRDC refund rates, the AI 90% measure, ceilings, eligible costs and deadlines are set by the HRDC and MQA and change over time; the course must hold valid MQA/HEC approval and be delivered by a Registered Training Institution to qualify. Verify current terms with the HRDC before relying on any figure here.

Part 5

Billing & subscription · How Pro is collected

The subscription, and how we collect it

Pro is a monthly subscription per store, invoiced by Posterita Ltd with VAT. The merchant picks a collection method at onboarding — in practice almost everyone should take the first one, because it needs no bank paperwork at all.

Collection methods · in order of preference

1 · Settlement offset — the default

Kibaz already processes the restaurant's in-app payments and settles the takings to their bank. The monthly fee (and any per-redemption deal commission) is netted from the next settlement — no direct debit, no failed payments, no chasing. Authorised once at onboarding (Form F4). If a month's takings don't cover the fee, the shortfall carries to the next settlement, then falls back to method 2 or 3.

2 · Direct debit — MauCAS / bank mandate

For merchants with little in-app volume (e.g. POS-only). A signed Direct Debit Mandate (Form F3) lodged with their bank authorises the monthly pull on the billing day. Mandate ceiling set to plan price + 25% headroom so a plan upgrade doesn't need a new form.

Prerequisite — Posterita must first become a PLACH Originator with MCB. Not automatic: the BoM Direct Debit Scheme requires the bank to approve us as Originator and we sign a Direct Debit Indemnity (liability runs ~180 days per claim). We must archive every signed mandate (image included, even after cancellation), and payers can reclaim unauthorised / wrong-amount / duplicate debits within 3 months — the paying bank refunds in 5 days and recovers from us. Each new mandate also takes ~14 days of bank approval before the first pull. Until Originator status is live, methods 1 and 3 carry all billing.

3 · Card on file — fallback

A business card charged monthly. Failed charge → retry on day 3 and day 7 → a 7-day grace with a banner in the Merchant app → Pro features pause (never the POS itself, never the data). Reactivates the moment payment lands.

Billing rules

Billing day	1st of the month · first month pro-rated from go-live
Invoice	VAT invoice issued by Posterita Ltd, e-mailed and filed in Merchant → Billing
Scope	Per store per month · multi-store groups get one consolidated invoice per BRN
Cancellation	Anytime, in the app — effective end of the paid month; store drops to Free, data kept
Price changes	30 days' written notice, never mid-cycle

The onboarding forms

Five forms, signed once, mostly in the app. F1, F2 and F5 are mandatory for every merchant; F4 or F3 covers collection (card on file needs no form — it's tokenised in-app).

Form	What it captures	Who signs
F1 · Merchant account & KYC	Legal name, trading name, BRN, VAT no, registered address, settlement bank account (IBAN), signatory ID. Attach: BRN certificate, ID copy, bank detail proof.	Authorised signatory
F2 · Subscription schedule	Plan (Free / Pro), price per store, stores covered, billing day, chosen collection method, deal commission rate. One page; re-issued on any plan change.	Signatory + Posterita
F3 · Direct debit mandate	Bank, branch, account name & number, monthly ceiling, frequency, start date. Paper form lodged with the merchant's bank (bank's own DDA format where required).	Account holder + bank
F4 · Settlement-offset authorisation	One clause: Posterita may deduct subscription fees and agreed commissions from amounts it settles to the merchant, itemised on every settlement statement.	Authorised signatory
F5 · Terms acceptance	The nine merchant clauses (Part 1-C) + Payments & Fees addendum (Part 3), accepted in-app with a timestamped e-signature.	Authorised signatory

Form F3 — Direct Debit Mandate

MCB F-1316B · official form

We bank with MCB, so we use MCB's own "Application for Direct Debit" (F-1316B) — the PLACH mandate — download the official PDF from mcb.mu ↗ and lodge it at the merchant's branch. The fields below mirror it; recipient is pre-filled: Posterita Ltd (Kibaz), with our MCB account as the credit account and the merchant's store ID as the payment reference.

Date · To: The Manager, The Mauritius Commercial Bank Ltd, [branch]

Account to be debited · name & number

Recipient (claims the amount)
Posterita Ltd (Kibaz)

Reference to quote on each debit
KIBAZ-[store ID]

Frequency
Monthly, on the billing day

Signature(s) of account holder & date

The signatory acknowledges MCB's standard direct-debit conditions on the form: the bank need not advise them of entries passed; any dispute over an amount is settled directly with Posterita Ltd; the order executes only when the account has sufficient funds; bank charges, if any, are debited to their account. Cancelled in writing to the bank and to Posterita Ltd.

Onboarding kit: print MCB F-1316B from mcb.mu with the Posterita recipient block pre-filled — the merchant only adds their account details and signs. Merchants banking elsewhere use their own bank's PLACH mandate (SBM, Absa each have one); the in-app flow captures the same fields digitally where the bank supports electronic mandates via MauCAS.

Every seat in the court orders.

Scan or tap, fill one cart, pay each kitchen, collect when the board says so.

A kiosk at the door, a board over the court, a till and a kitchen screen in every stall.

Faster turns on the busiest day, and the court's numbers live.

Thirty days free. Then one flat Court plan.

Everything that runs the restaurant is free. Forever.

One system, four screens, one afternoon of training.

If it takes an order, feeds the kitchen, pays staff or rewards a regular, it's free.

We charge by who brought the order. You brought it? It's yours.

Your stall may already be on Kibaz. Make it yours.

Lunch for 400 people, without the 12:30 crush.

The kitchen sees demand before it cooks.

The food-court engine, tuned for a closed group.

Kibaz worldwide, one country partner at a time. After Tribeca.

Six structural reasons, none of them traction.

You own the floor. We own the rails. Three payments.

Everything on the shelf.

Applied AI for Restaurant Operations

Why Rs 75,000, and how we keep a margin

1 · Course identification

2 · Rationale & need

3 · Target audience & entry requirements

4 · Aim

5 · Course learning outcomes

6 · Course structure & contact hours

7 · Delivery & teaching methods

8 · Assessment

9 · Trainer & resources

10 · Approval & quality assurance — and timeline

Legal, Payments & Training

Privacy Notice & Terms of Service

Your data on Kibaz

1. Who we are

2. What this notice covers

3. The data we collect

4. Why we use it, and our legal basis

5. Sensitive data

6. Who sees your data

7. Points, vouchers and merchants

8. Automated decisions & profiling

9. Sending data outside Mauritius

10. How long we keep it

11. Your rights

12. Security

13. Children

14. Changes

Using Kibaz

1. Agreement

2. Who can use it

3. What Kibaz does

4. Ordering and your "food list"

5. Shared tables

6. Payments

7. Points, vouchers and deals

8. Reviews and recommendations

9. Photos and your content

10. Acceptable use

11. Availability & changes

12. Liability

13. Governing law

Accepted at onboarding

Signed with each mall

Contact & complaints

Complying with the Data Protection Act 2017

Are we a "controller" or a "processor"? Both.

The core principles (Part IV)

Ten things to do, in order

The legal pack

A · Public-facing (diners & merchants see these)

B · Contracts with merchants & suppliers

C · Internal documents (you must hold, may be asked for)

Where our data gets sensitive

Cross-border transfers

The 72-hour breach rule

Payments & Fees

Get your team trained on Kibaz — and claim up to 90% back from HRDC

Why AI training is refunded at 90%

In-house training, on your own premises

The curriculum

What it actually costs you

Own the roads.
We'll own the menus.