Protection of Personal Information Act

Privacy Policy

This policy explains what personal information Graze Cafe collects about you, why we collect it, who we share it with, and what you can do about it. We have tried to write it in plain language rather than legalese.

Effective from 11 August 2026

Contents

  1. Who we are
  2. What information we collect
  3. Why we collect it, and our lawful basis
  4. Do you have to give us your information?
  5. Who we share it with
  6. Where your information is stored
  7. How long we keep it
  8. How we protect it
  9. Your rights under POPIA
  10. Marketing and how to opt out
  11. Children
  12. Cookies and website data
  13. Changes to this policy
  14. How to complain

01Who we are

Graze Cafe is a trading name of Graze Cafe (Pty) Ltd (registration number
2025/849101/07). In the language of the Protection of Personal Information Act 4 of 2013 ("POPIA"), we are the responsible party for the personal information described here, meaning we decide why and how it is processed.

Our Information Officer is Brendon Koekemoer. If you have a question about this policy, or you want to exercise any of the rights described in section 9, contact us:

hey (at) grazecafe.co.za
072 929 3298
770 Jacqueline Drive, Garsfontein, Pretoria, 0081

What this policy covers

One policy, all of it. This document applies to:

  • This website, grazecafe.co.za, including the event enquiry forms, the general contact form and the franchise interest form
  • Our table booking system
  • Coffee tasting bookings made through graze-cafe-booking.vercel.app
  • The cafe itself, including CCTV and card payments

02What information we collect

Almost everything we hold about you is information you gave us yourself, whether you booked a table, booked a coffee tasting, enquired about an event, or registered your interest in franchising. The next section lists every category, why we hold it, and the legal basis we rely on.

We do not buy personal information about you from anyone else, and we do not build profiles of you from third-party sources.

A note on dietary, health and religious information

If you tell us about an allergy, a medical condition or a religious dietary requirement in the special-requests box, or in the message field of any enquiry form, that counts as special personal information under section 26 of POPIA, which the law protects more strictly. We collect it only because you chose to tell us, we use it only to prepare your visit safely, and you are free to leave that box empty and tell
us in person instead.

03Why we collect it, and our lawful basis

POPIA requires us to have a lawful basis for each thing we do with your information. Here is the full picture.

Your name, email address and phone number

WhyTo hold your booking, confirm it, remind you, and contact you if something changes. On the enquiry forms, to reply to you.

Lawful basisNecessary to perform, or take steps towards, what you asked us for (s11(1)(b)).

Your table booking details, being date, time, party size and table

WhyTo reserve the right table for the right number of guests at the right time.

Lawful basisNecessary to perform the booking (s11(1)(b)).

Your coffee tasting booking details

WhyTo hold your seats for the tasting you chose and prepare for your group.

Lawful basisNecessary to perform the booking (s11(1)(b)).

Event enquiry details, being event type, date, guest numbers and area

WhyTo understand what you need and prepare a quote for a mobile coffee bar or canned drinks.

Lawful basisNecessary to take steps towards a contract at your request (s11(1)(b)).

Franchise interest details, being your name, contact details and the area you have in mind

WhyTo contact you if and when we open franchise applications. Nothing else.

Lawful basisYour consent (s11(1)(a)), given by ticking the box on that form, which you can withdraw at any time.

Job application details, being your name, contact details, work history, what you choose to tell us about yourself, and your CV

WhyTo consider you for the role you applied for, and to contact you about it. Nothing else.

Lawful basisYour consent (s11(1)(a)), given by ticking the box on the Careers form, and taking steps towards a possible employment contract (s11(1)(b)).

Special requests and notes you choose to give us

WhyTo accommodate dietary requirements, allergies, accessibility needs, seating preferences or a special occasion.

Lawful basisYour consent (s11(1)(a)). This field is optional.

Your marketing preference

WhyTo know whether you want to hear from us about news, events and specials.

Lawful basisYour consent (s11(1)(a)), which you can withdraw at any time.

A record of your visits, being how many times you have dined with us and when you last did

WhyTo recognise returning guests and remember preferences you have told us about.

Lawful basisOur legitimate interest in running the cafe and serving guests well (s11(1)(f)).

Notes our staff add about your preferences

WhyTo remember things like a favourite table or a usual order.

Lawful basisOur legitimate interest in serving guests well (s11(1)(f)).

A log of the emails we have sent you about your booking

WhyTo confirm what was sent and when, and to resolve disputes about whether you were notified.

Lawful basisOur legitimate interest in keeping accurate records (s11(1)(f)).

Messages you send us on WhatsApp

WhyTo answer your question and arrange whatever you are asking about.

Lawful basisNecessary to respond to you (s11(1)(b)), and our legitimate interest in handling enquiries (s11(1)(f)).

CCTV footage on our premises

WhyFor the safety and security of our guests, our staff and our property.

Lawful basisOur legitimate interest in protecting people and property (s11(1)(f)).

Payment card transactions

WhyTo take payment for your order. We do not store your full card number, our payment provider handles the card details.

Lawful basisNecessary to perform our contract with you (s11(1)(b)).

Loyalty programme membership and activity

WhyTo run the rewards programme and apply the benefits you have earned.

Lawful basisYour consent when you join (s11(1)(a)).

Website analytics and advertising cookies

WhyTo understand how people use the website, and to measure advertising.

Lawful basisYour consent (s11(1)(a)), given through the cookie banner. These do not run unless you accept them. See section 12.

04Do you have to give us your information?

Giving us your information is voluntary, but some of it is genuinely necessary. We cannot hold a table or a tasting without a name and a way to reach you, and we cannot quote on an event without knowing roughly when and where it is. If you would rather not provide those, you are welcome to phone us, message us, or walk in instead.

Everything else is entirely optional: special requests, your marketing preference, loyalty programme membership, and registering franchise interest. Declining has no effect on your booking or on how you are treated as a guest.

05Who we share it with

We do not sell your personal information. We never share it for anyone else's marketing.
We share it only with the service providers who operate parts of our systems on our behalf.
In POPIA terms these are our operators, and they may only act on our instructions.

  • Afrihost hosts this website and delivers the enquiry forms to us.
  • Cloudflare checks that the forms on this website are sent by a person and not an automated program. To do that it receives technical details about your browser and device, including your IP address.
  • Supabase hosts the database that stores your table booking and contact
    details.
  • Resend sends booking confirmation, reminder and follow-up emails on our behalf.
  • Vercel hosts the booking website itself.
  • YouCanBook.me runs our coffee tasting booking page and holds the details you enter there.
  • Our payment provider processes card payments made at the cafe. Your card details go to them directly, and we never see or store your full card number.
  • Google provides the map on our Find Us page and, where you have accepted analytics cookies, website analytics.
  • Meta operates WhatsApp, if you choose to message us there, and the
    advertising pixel where you have accepted advertising cookies.

We may also disclose information where the law requires it, for example to comply with a court order, or to establish or defend a legal claim.

06Where your information is stored

Section 72 of POPIA requires us to tell you when your information leaves South Africa. Some of it does.

  • This website and the enquiry forms are hosted in South Africa.
  • The spam check on our website forms is run by Cloudflare, which processes data in the United States and other countries where it operates.
  • Our booking database is hosted in Ireland (European Union).
  • Our booking email and booking website hosting process data in the United
    States     and other countries where those providers operate.
  • Coffee tasting bookings are processed in the United Kingdom.
  • Analytics and advertising providers process data in the United States and
    elsewhere, and only where you have accepted those cookies.

The European Union and the United Kingdom have data-protection laws that provide protection substantially similar to POPIA. For providers operating elsewhere, we rely on the contractual terms in their data processing agreements, which oblige them to protect your information to a
comparable standard and to act only on our instructions.

07How long we keep it

We keep your booking and contact details for 24 months after your last
visit or booking. After that we anonymise the record rather than delete it outright. We strip out everything that identifies you and keep only the statistical shape of the booking, being party size, date and table, so we can understand how busy the cafe is over time. Once anonymised, the record can no longer be linked back to you.

  • Job applications are kept for 6 months after the role is filled, so we can contact you if a similar position opens, and then deleted. Your CV reaches us by email and is not stored on this website. If you are appointed, your application becomes part of your employee record.
  • Messages sent through a form on this website are also kept on the website itself, so that none is lost if an email goes astray. That copy is deleted after 12 months, or sooner where this section gives a shorter period for that kind of message. Franchise sign-ups are kept as set out below. CVs are not part of that copy.
  • Event enquiries are kept for 24 months after the enquiry, or after the
    event if one goes ahead, whichever is later.
  • Franchise interest details are kept until we open franchise applications
    and contact you, or until you ask to be removed. We review that list every 24 months and remove anyone we have not heard from.
  • CCTV footage is retained only for a short period and then overwritten in
    the normal cycle of the system, unless it has been kept for a specific security or legal reason.

We keep information for longer only where the law requires it, for example records that support our tax and accounting obligations.

08How we protect it

Section 19 of POPIA requires us to secure the integrity and confidentiality of your information. In practice:

  • All traffic between your browser and our websites is encrypted (HTTPS).
  • Enquiry and franchise form submissions are emailed to us rather than stored in this website's database.
  • Your booking details are never readable by other guests. The public booking page can only see how many tables are free, it cannot read anyone's reservation.
  • Access to the admin system, where customer details are visible, requires a staff login.
  • Changes made to bookings and customer records are recorded in an audit log.

If a security compromise affects your personal information, POPIA requires us to notify both the Information Regulator and you, and we will do so.

09Your rights under POPIA

You have the right to:

  • Ask what we hold about you, and get a copy of it (sections 23 and 24).
  • Correct or update it if it is wrong, misleading or out of date.
  • Ask us to delete it where we no longer have a lawful reason to keep it.
  • Object to us processing your information on the basis of legitimate interest, on grounds relating to your particular situation (section 11(3)).
  • Withdraw consent at any time where we relied on your consent. This does not affect anything we did lawfully before you withdrew it.
  • Complain to the Information Regulator, see section 14.

To exercise any of these, email us at hey (at) grazecafe.co.za.
We may need to confirm your identity first, so that we do not hand your information to someone else. We will respond as soon as reasonably possible.

You can also view, change or cancel an upcoming booking yourself at any time from the manage booking page.

10Marketing and how to opt out

We only send marketing email if you asked for it. Booking confirmations, reminders and changes to your reservation are not marketing. They are part of the service you asked for, and you will receive those regardless.

Registering franchise interest is not a marketing subscription either. We will contact you about franchising and nothing else.

You can opt out whenever you like: use the unsubscribe link in any marketing email, untick the box the next time you book, or email us at
hey (at) grazecafe.co.za. We act on it immediately.

11Children

Our booking system and our enquiry forms are intended for adults. We do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian,
as section 34 of POPIA requires. Where a booking is made for a family, we assume the adult making the booking is providing the details.

If you believe a child has given us personal information without that consent, contact us and we will delete it.

12Cookies and website data

Cookies are small files a website stores in your browser. We use as few as we can.

Cookies that are always on

These are the ones the sites need in order to work at all. Our booking site keeps your booking session going while you complete the form. This website stores basic technical settings and, if you submit a form, whether it went through. None of these track you across other websites, and there is nothing to consent to because the site cannot function without them.

Analytics and advertising cookies

We use Google Analytics to understand how people find and use the site, and a Meta advertising pixel to measure our advertising. Both set cookies and both send information to providers outside South Africa.

These only run if you accept them. When you first visit, our cookie banner asks. If you decline, or simply ignore it, the analytics and advertising cookies are not placed and no data goes to Google or Meta. Declining does not limit any part of the site.

You can change your mind at any time through the cookie banner, or by clearing cookies in your browser settings.

The map on our Find Us page

Our Find Us page embeds a Google map so you can get directions. Loading it contacts Google, which may set its own cookies. If you would rather avoid that, our full address is written out on the page in text, and works in any maps app.

13Changes to this policy

We may update this policy as the cafe or the law changes. The effective date at the top of the page always tells you which version you are reading. If we make a change that materially affects your rights, we will take reasonable steps to bring it to your attention rather than relying on you to re-read the page.

This policy replaces our previous booking-platform privacy policy, and now covers both the website and the booking system in one place. Effective from 11 August 2026.

14How to complain

Please talk to us first. Email hey (at) grazecafe.co.za and we
will try to put it right.

If you are not satisfied, you have the right to complain directly to the Information Regulator of South Africa:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints: complaints.IR@justice.gov.za
General enquiries: enquiries.IR@justice.gov.za
inforegulator.org.za

Last updated 11 August 2026. Questions about anything on this page, email hey (at) grazecafe.co.za.
Tasting experiences · Book a table or a tasting · Franchise

Still here

The table is waiting.

Book a tasting experience in Garsfontein, Pretoria, or find us here.

Book a Tasting

Questions about anything on this page? Email hey (at) grazecafe.co.za or message us on WhatsApp.