Privacy policy

Who is responsible for your information

The responsible party, in the language of the Protection of Personal Information Act 4 of 2013, is Entle Coffee (Pty) Ltd, a private company registered in South Africa, trading as Entle Coffee, at 1 Fourth Avenue, Summerstrand, Gqeberha, 6019.

Our Information Officer is Meredith Catherine Law, who you can reach at hello@entle.coffee. Every question, correction or complaint about your personal information goes to that address.

What we hold, and why

We ask for as little as will get coffee to your door. Everything below is something we either need to complete a sale, are required by law to keep, or hold because you asked us to.

Your name, email address and phone number

To identify your order, send you its confirmation and dispatch notice, and reach you if something goes wrong with it.

Your delivery address

To print the waybill and get the parcel to you. Saved to your account only if you have one.

Your order history — what you bought, when, at what price, and its roast date

To fulfil and support your orders, to run your subscription, and because tax law requires us to keep records of our sales.

Your password

Only ever as a one-way hash. We cannot read it, and nobody at Entle can tell you what it is — a reset is the only route back in.

Session and password-reset tokens

To keep you signed in and to let you reset a forgotten password. These are stored hashed, expire on their own, and are deleted once expired.

A payment reference from PayFast

To match your payment to your order and to process a refund. It is a reference to a payment, not a means of taking one.

A saved-card token, if you subscribe

PayFast keeps your card and gives us a token that lets us charge it for your subscription deliveries. It is not a card number, it works nowhere but your Entle subscription, and cancelling that subscription deletes it. Only subscribers have one.

We never hold your card details. Card numbers are entered on PayFast's own payment page and stay with PayFast; they do not reach our servers. We hold no card number, no expiry date and no CVV. If you subscribe, we hold the token described above — which lets us ask PayFast to charge your subscription, and does nothing else.

On what legal basis

Most of what we hold, we hold because it is necessary to perform the sale you asked for, which POPIA permits without separate consent. Some of it — our sales records — we keep because tax and company law obliges us to. Where we rely on your consent, such as sending you marketing email, you can withdraw it at any time without it affecting your orders.

Who else sees it

We do not sell your personal information, and we do not share it for anyone else's marketing. It goes to these operators, each of whom may only use it to do the job we have given them:

PayFast

Takes the payment. Receives your name, email, order reference and amount.

Our courier

Delivers the parcel. Receives the name, address and phone number on the waybill.

Our email provider

Sends order confirmations, dispatch notices and password resets. Receives your email address and what the message says.

Our hosting provider

Runs the servers and the database this site and your account live on.

We will also hand information over where the law requires it — to SARS, or under a court order.

Some of these operators process information outside South Africa. POPIA allows this where the receiving country or the contract with the operator gives your information protection substantially similar to POPIA's own, and we require that of every one of them.

How long we keep it

Order records are kept for five years from the end of the tax year they fall in, because tax law requires it. Account details, saved addresses and subscriptions are kept while your account is open and deleted when you close it, except where they form part of an order record we must keep. Session and reset tokens are deleted automatically once they expire.

How we protect it

The site is served over HTTPS. Passwords are stored only as one-way hashes, and session tokens are hashed too, so a copy of our database would not hand anyone a working login. Access to the shop dashboard is restricted to staff accounts, each with its own login, and revoking someone's access ends their sessions immediately rather than waiting for a cookie to expire.

No system is perfectly secure. If your personal information is ever compromised in a way that creates a real risk to you, POPIA requires us to notify both you and the Information Regulator, and we will.

Cookies

We use cookies for one purpose: keeping you signed in. The cookie holds a random signed token that points at your session — no personal information travels in it — and it is marked HttpOnly, so scripts in your browser cannot read it. Your cart is kept in your own browser's storage and never leaves your device until you check out.

We run no advertising cookies, no third-party trackers and no cross-site profiling. Blocking our cookies will stop you signing in; everything else on the site will work.

What you can ask us to do

POPIA gives you the right to:

• ask what personal information we hold about you, and get a copy of it;
• have anything wrong corrected, or anything incomplete completed;
• have information deleted where we no longer have a reason to keep it — noting that we cannot delete an order record the law requires us to retain;
• object to us using your information for a particular purpose;
• withdraw consent to marketing at any time; and
• complain to the Information Regulator.

Write to hello@entle.coffee and we will answer within a reasonable time, and within any period POPIA sets. We may need to confirm who you are first, so that nobody else can ask for your information.

Marketing

We send transactional email — order confirmations, dispatch notices, subscription cycles, password resets — because you bought something or asked for it, and you cannot opt out of those while you have an active order or subscription. Anything promotional is separate, goes out only to people who asked for it, and every one of those messages has an unsubscribe link that works.

Children

This shop is not intended for children, and we do not knowingly collect the personal information of anyone under 18. If you believe a child has given us information, tell us and we will delete it.

Complaining to the regulator

If you are not satisfied with how we have handled your information you may complain to the Information Regulator of South Africa, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, at complaints.IR@justice.gov.za. We would rather you came to us first — see the contact page — but the right is yours either way.

Changes

We may update this policy. The current version is always the one on this page, and we will tell account holders by email before any change that materially affects them takes effect.