POPI COMPLIANCE AND PRIVACY NOTICE
The right to privacy is an integral human right recognised and protected in the South African Constitution and the Protection of Personal Information Act 4 of 2013 (“POPIA”).
POPIA aims to promote the protection of privacy by providing guiding principles that are intended to be applied to the processing of personal information in a context-sensitive manner.
Through the provision of quality goods and services, the organisation is necessarily involved in the collection, use and disclosure of certain aspects of the personal information of clients, customers, employees and other stakeholders.
A person’s right to privacy entails having control over his or her personal information and being able to conduct his or her affairs relatively free from unwanted intrusions.
The aim of this compliance and privacy notice is to demonstrate our commitment to safeguarding your personal information and to notify you how and why we collect information from you, the way we use your information and how we share or disclose your information, as required in terms of the Protection of Personal Information Act (“POPI Act”).
This Notice provides you with the following information:
- Our commitment to compliance;
- A Summary of the compliance measures implemented;
- A notification on the collection of personal information and how we use the information;
- Your rights as a data subject;
- How to contact us in relation to this notice.
OVERVIEW OF VIDA E CAFFÈ
Vida e Caffe, as a group comprising Vida e Caffe Holdings (Pty) Ltd and Vida e Caffe Corporate Services (Pty) Ltd includes our affiliates and business partners or franchisees sharing various resources in
order to deliver goods and services to our clients. We are a privately-owned coffee shop franchise, whose services and product offerings include serving coffee, food and treats at our various locations throughout South Africa, selling coffee and gift cards and providing customers with a mobile application to enable customers to order coffee through the mobile application and earn rewards.
In this notice, when we refer to “Vida e Caffe” or “the group” we refer to one or more of the aforementioned companies, affiliates and business partners as responsible parties. Vida e Caffe has developed this compliance and privacy notice for our customers, services providers, suppliers, employees, applicants for employment and any other data subject to understand our commitment to compliance with the provisions of POPIA and how and why the group collects, uses, discloses and safeguards their personal information.
- COMMITMENT TO COMPLIANCE WITH POPI
Given the importance of privacy, Vida e Caffe is committed to effectively managing personal information in accordance with POPIA’s provisions. To meet the requirements of POPI, Vida e Caffe has drafted a POPI POPI Risk Management and compliance programme or framework which includes:
- Development and implementation of Information processing plan and procedures, including the safeguards of personal information required under POPI
- Development and implementation of a compliance monitoring plan
- Appointment of Information Officer
- Delegation of duties to staff and training on their duties
- Development of disclosures and client POPI engagement processes
- Documentation of relationships with third parties on the sharing of personal information
and/or service agreements for the outsourcing of certain POPI obligations
- PRIVACY STATEMENT
Vida e Caffe respects your right to privacy and is committed to safeguarding your personal information when processing your personal information in terms of the Protection of Personal Information Act (POPIA).
This privacy statement applies to natural and juristic persons whose personal information is processed by Vida e Caffe, including our customers, services providers, suppliers, employees and applicants for
employment. In instances where Vida e Caffe processes personal information as an operator for a responsible party in terms of a contract or mandate, we encourage you to read and understand that particular responsible party’s privacy notice.
Our privacy statement outlines our policy surrounding the protection and processing of your personal information and our commitment to comply with the conditions set out in the Protection of Personal Information Act (POPIA) when collecting, recording, storing, disseminating, and destroying personal information, and responding to government requests for our data subjects:
- In our capacity as the responsible party, we shall inform you that we shall be processing personal information, the purpose or reasons for the collection of personal information and we shall endeavour to obtain information directly from you upon your consent or if we can demonstrate a justifiable reason for collecting personal information;
- We shall process information for a specific, lawful reason and only adequate, relevant information which is limited to the purposes for which they are processed and which relates to the functions or the activity for which it is intended;
- We shall delete or otherwise de-identify your personal information after the minimum storage periods required under our risk and statutory record keeping periods have expired.
- We shall take reasonable steps to ensure personal information obtained from our data subjects or third parties is complete, accurate, not misleading and updated where necessary.
- We take measures to ensure data is kept safe and prevent loss of, damage to, or unauthorized destruction of personal information, and unlawful access to or processing of personal information.
- We undertake to review and update our security measures in accordance with future legislation and technological advances.
- Vida e Caffe is obligated to inform the Information Regulator and the affected data subject if there is a breach of personal information. We shall aim to assist in minimising any losses that may result from such a breach in security.
- We shall not contact/solicit you unless you have given us your consent to do so;
- We shall implement the necessary measures that will give effect to your rights as a data subject
as provided in terms of POPIA.
- COLLECTION AND PROCESSING NOTIFICATION
The vida app collects, stores and transmits the contact number of the recipient to enable the sending of gifts through the app.
This notification applies to natural and juristic persons (which includes) customers, suppliers, service providers, employees and applicants for employment whose personal information is processed by the group in its capacity as a responsible party.
Vida e Caffe collects personal information directly from you where you provide us with your details. In addition to the aforementioned, we shall, subject to your consent, or to execute our service agreement with you, obtain further information required from third parties and other sources where necessary.
In the provision of goods and services, we process personal information as follows:
Information being collected
The type of personal information we collect depends on the purpose and reason for which it is processed and relates to the functions or the activity for which it is intended. This will differ if you are a customer, supplier or employee.
Personal information is information that identifies a person, examples of personal information we collect are; your name, ID number, date of birth; contact details; information surrounding your personal circumstances such as your race, gender, nationality, marital status, medical, financial (such as banking details and credit card data), criminal and employment history. Juristic persons may be identified by their registered or trade name, registration numbers and business addresses. We may further collect information such as tax numbers, VAT numbers, PAYE numbers and bank account details.
Special personal information refers to religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject as well as criminal behaviour. Vida e caffe only collects special personal information and personal information of a child if it is necessary for the performance of the client engagement or required by law.
Source of information
Vida e caffe collects personal information in several ways which include but are not limited to:
Vida e Caffe collects information directly from you where you provide us with your details or if personal information is available in public records. In addition to the aforementioned, we may obtain information from third parties subject to your consent.
The personal information provided by you may be processed across the group to ensure efficient interaction with Vida e Caffe. Such information is processed, stored and retained through the group’s shared data technology platform.
Purpose of processing information
Vida e caffe shall collect personal information for a specific, explicitly defined and lawful purpose that relates to the function or the activity of our organisation for which it was intended. The information collected by Vida e Caffe may be used, transferred, stored, disseminated, shared or processed for the following purposes:
collect orders and provide you with goods);
delivery and provisions of goods;
Service providers & suppliers:
provisions of goods;
rendered in terms of the agreement with the service provider or supplier
Applicants for employment:
South African conditions of employment legislation framework;
Voluntary/Mandatory provision of information
The Data subject provides the information on a voluntary basis and understands that certain information is mandatory for the purpose of administration of the Responsible party-Data subject relationship.
The requirement to process in terms of legislation
Vida e Caffé may process information to comply with legislative requirements which include:
tax evasions and other crimes;
Consequences of failure to provide
Failure to provide the information will result in the Responsible party failure to comply with the requirements in terms of the service agreement and
Cross border transfer
Where necessary information may be shared with organisations outside South Africa for legitimate purposes who subscribe to similar personal information protection laws. Information shall not be shared with countries that do not subscribe to personal information protections laws unless the Responsible party has entered into an agreement in terms of which the third party subscribes to the obligations for lawful processing of personal information.
Recipients of personal information
The Responsible Party shall only share information outside of the group in the following circumstances:
Access to data subject personal information from within the group is limited to essential staff or specialist contractors that are required to access our systems for client service or maintenance purposes, who are bound by the requirements of the legislation and are required to maintain safety and security measures.
Nature and category of information
Vida e Caffe does not collect and process the special personal information unless it is a requirement by law to process such information as part of our service delivery, in which case we shall obtain consent from you before collection thereof. We do not knowingly collect personal information from children (under 18 years of age) without the permission of their parent/s or guardian.
- MARKETING AND PROMOTION
Vida e Caffè shall not process personal information of a data subject for the purposes of direct marketing by any form of electronic communication unless Vida e Caffè has obtained consent from the data subject or if the data subject is a customer of Vida e Caffè.
If a customer submits personal information, by using our website, mobile application, electronic mail or telecommunications, in the contexts of the sale of products or services, Vida e Caffè may process personal information for the purpose of direct marketing to market Vida e Caffès own or similar products orservices. Acustomerwillalwaysbegivenareasonableopportunitytoobjecttotheuseofelectronic details at the time when the data was collected and on the occasion of each communication.
- YOUR RIGHTS AND RESPONSIBILITIES
7.1 Your rights
A data subject has a right to object to the use of personal information or complain about instances where any of their rights under POPIA has been infringed upon. In certain instances failure to provide us with personal information may result in the inability to deliver said services or goods to you, alternatively, you shall receive limited services or we shall not be able to enter into a business or employment relationship with you, as the case may be.
In addition to the aforementioned right, you have the right to request access to personal information and, where necessary, that the personal information held by Vida e Caffè must be corrected, destroyed or deleted.
7.2 Your responsibilities
To ensure that Vida e Caffè at all times has the correct information of the person to whom the personal information relates(the data subject), we require our data subjects to supply us with information that is complete, accurate, and not misleading and to inform Vida e Caffè when their personal information changes.
If a data subject submits personal information, or a record thereof, through our website, mobile application, social platforms, by using email or via telephonic communication you are responsible to read and herewith acknowledge that you understand the terms of this POPI Compliance and Privacy notice and gives Vida e Caffe consent to process and further process personal information as explained in this notice.
- DATA SUBJECT ENGAGEMENT PROCEDURES
Access to information requests can be made by email, addressed to the Information Officer. The Information Officer will provide the data subject with the prescribed form. Once the completed form has been received, the Information Officer will verify the data subject’s identity before handing over any personal information. All requests will be processed and considered against the organisation’s PAIA Policy, recordkeeping policies and any other requirements in terms of the law.
Vida e Caffè takes all complaints very seriously and will address all POPI related complaints in accordance with the following procedure:
- POPI complaints must be submitted to the organisation in writing. Where so required, the Information Officer will provide the data subject with a “POPI Complaint Form”.
- The Information Officer will provide the complainant with a written acknowledgement of receipt of the complaint.
- The Information Officer will carefully consider the complaint and amicably address the complainant’s concerns. In considering the complaint, the Information Officer will endeavour to resolve the complaint in a fair manner and under the principles outlined in POPIA.
- Where the data subject is not satisfied with the Information Officer’s suggested remedies, the data subject has the right to complain to the Information Regulator.
The Information regulator’s contact details are as follows: Complaints email: complaints.IR@justice.gov.za
General enquiries email: email@example.com
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 P.O Box 31533, Braamfontein, Johannesburg, 2017
Should you have any questions relating to this notice, you can contact the Information Officer. Our Information Officer is: Marx Swanepoel- Finance Director at Marx@Caffe.co.za.
- POLICY CHANGES
This notice was last revised on 07 July 2021. Any material changes hereto will be published on our website or distributed to clients in writing. Your continued use of our services following the update means that you accept Vida e Caffè’s updated notice.