Legal
Privacy Policy
Last updated: · Effective date:
1. Who we are
This website and loyalty programme are operated by (“Con Leche”, “we”, “us”), a business registered in South Africa with registration number and its principal place of business at .
We are the “responsible party” for your personal information under the Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, why, who we share it with, and the choices and rights you have.
2. Information we collect
2.1. Identity & contact data
Your name, email address, and mobile number. We don't ask for your date of birth — accounts are 18+ only, and collecting birth dates would mean also having to verify age, so we simply don't collect it.
2.2. Order history
Your past purchases, favourite drinks, dietary notes you choose to share, loyalty stamps earned, and promo-code usage. This is what powers your Pase de Café loyalty progress.
2.3. Payment data
When you pay online, your card or digital-wallet details are entered on the secure page of our payment gateway, Ozow — not on our own servers. We never see or store your full card number, CVV, or banking PIN. We only receive a confirmation that a payment succeeded or failed, plus a reference number.
2.4. Technical data
Your IP address, device and browser type, and basic cookie/analytics data about how you use the site (see Cookies).
2.5. Signing in with Google
If you choose “Continue with Google”, Google shares a limited part of your Google profile with us so we can create or access your account: your name, email address, profile photo, and your Google account ID. We use these only to set up and sign you into your Con Leche account.
We never receive your Google password, and we can't see anything else in your Google account (your contacts, Gmail, files, and so on stay private). You're always in control: you can disconnect Google at any time from your account settings, or by removing Con Leche's access at myaccount.google.com/permissions. Disconnecting Google doesn't delete your Con Leche account — you can still sign in with your email and password (or set one via “Forgot password”).
2.6. Delivery data
Con Leche is collection / pick-up only — we do not deliver, so we do not collect physical street addresses, gate codes, or delivery instructions. If that changes, this section will be updated to cover the data needed for delivery, and this policy will be re-issued.
3. How we use your information
- Order fulfilment & loyalty: preparing your order, keeping you updated on its status, and running the Pase de Café loyalty programme (awarding stamps, tracking rewards, redemptions).
- Customer support: answering questions and resolving complaints about an order, a missing item, or a reward.
- Order updates: notifying you when your order is confirmed or ready — by email and, where you've provided a number, by WhatsApp/SMS.
- Marketing (only if you opt in): sending special offers, loyalty updates, and new menu announcements.
- Legal & security: keeping financial records the law requires us to keep, and protecting the site against fraud and abuse.
4. Your privacy choices
Here's exactly what each choice covers, what it's used for, and whether you can turn it off:
- Essential — running your account & orders. Processing your orders, loyalty stamps, and account security. This can't be switched off — we can't run the service without it.
- Order notifications. Messaging you (email or WhatsApp) about a specific order — confirmed, ready for collection, or an issue. Tied directly to placing orders, so it isn't a separate toggle.
- Events & truck locations. Where to find us. On by default — you can turn this off.
- Birthday treat. A small reward around your birthday, only if you ever add a birth date to your account. You can turn this off.
- Specials & promotions (marketing). Discounts, loyalty perks, new menu announcements — off unless you opt in. You can turn this on or off, and pick email or WhatsApp, any time.
- Analytics & personalisation. Non-essential cookies that help us see what's popular and improve the site. On by default — you can turn this off.
If you have a Con Leche account, every togglable choice above lives on your account page — Pase de Café → Notifications — and takes effect immediately when you change it. This page is informational only; changing something here would do nothing, which is why there's nothing to click.
Not signed up yet? Nothing is collected from you until you create an account, at which point these same choices become yours to set.
6. How we protect your information
- Encryption in transit: the site is served over HTTPS with SSL/TLS encryption, so data moving between your device and us is encrypted.
- Restricted access: customer records are accessible only to authorised staff who need them for their role, protected by individual logins and strong, hashed passwords.
- No card storage: card and banking details are handled by Ozow's PCI-DSS-compliant systems — we don't store them.
- Ongoing measures: input sanitisation, secure session cookies, and body-size limits guard against common attacks.
7. How long we keep your information
We keep your information only as long as we need it:
- Active accounts: for as long as your account is open.
- Inactive accounts: if you don't order or log in for 12 months, we'll notify you and then delete or anonymise your profile and marketing data.
- Financial records: invoices and transaction records are kept for 5 years as required by South African tax and company law (SARS / Companies Act), even after an account is closed. These are kept in a minimised form and used only for compliance.
8. Your rights
Under POPIA you have the right to:
- Access the personal information we hold about you;
- Correct anything that's wrong or out of date;
- Delete your information (subject to records we must keep by law);
- Object to processing, including marketing;
- Withdraw consent at any time; and
- Complain to the Information Regulator of South Africa.
Deleting your information: you can ask us to delete your personal information at any time — either from your account settings (which removes your account) or by contacting our Information Officer. We'll delete or anonymise your profile and marketing data on request, free of charge, keeping only the minimal financial records the law requires (see How long we keep it).
To exercise any of these, contact our Information Officer (below), or use the controls in your account settings. We'll respond within a reasonable time and at no charge for a standard request.
9. Marketing & opt-out
We only send marketing if you've opted in. Every marketing email includes a one-click unsubscribe link, and you can stop promotional WhatsApp/SMS messages by replying STOP or turning off the marketing toggle on your account page. Opting out of marketing never affects order or account messages.
10. Cookies & analytics
We use one cookie: an essential session cookie that keeps you logged in and your session secure. It's always on — the site can't work without it.
Separately, we count how many times each page and each drink's detail card is viewed, so we know what's popular. This isn't done with a cookie or any other identifier — we don't know it was you, only that a page was viewed, so there's nothing here that identifies you personally. If you're signed in, you can still switch this off on your account page. We never use cookies or this counting to build advertising profiles, and none of it is shared with ad networks.
11. Children
You must be 18 or older to create an account and use the loyalty and ordering service. We don't knowingly collect information from anyone under 18. If we learn that we have, we'll delete it. (See the Terms & Conditions for the full eligibility rule.)
12. PAIA manual
In line with the Promotion of Access to Information Act, 2000 (PAIA), we publish a manual that explains what records we hold and how you can request access to them. You can read it here: PAIA Manual.
13. Contact & Information Officer
For any privacy question or to exercise your rights, contact our designated Information Officer:
Information Officer:
Email:
Phone:
Address:
You may also lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.