Skip to content
Brewster← Back

POPIA Compliance

Last updated 13 April 2026

1. Introduction

This POPIA Compliance Notice explains Brewster's approach to compliance with the Protection of Personal Information Act, 4 of 2013 ("POPIA").

Brewster is operated by Olio Technologies (Pty) Ltd trading as Brewster ("Brewster", "we", "us", or "our").

2. Our Commitment

Brewster is committed to processing personal information lawfully, reasonably, and in a manner that protects the privacy rights of data subjects.

We take steps to ensure that personal information is processed in line with the principles and requirements of POPIA, having regard to the nature of our platform, the services we provide, and the information we process.

3. Information Officer

Information Officer: Tyrone Smith
Email: [email protected]
General Contact: [email protected]
Physical Address: 11 Greyvenstein Close, Plattekloof Glen, Cape Town, South Africa, 7460

The Information Officer is responsible for supporting and overseeing Brewster's compliance with POPIA and related access-to-information responsibilities.

4. Role of the Information Officer

In line with applicable legal duties, the Information Officer's role includes:

  • encouraging compliance with the conditions for the lawful processing of personal information;
  • dealing with requests made to Brewster pursuant to POPIA;
  • working with the Information Regulator in relation to investigations or compliance matters; and
  • supporting internal governance and accountability around personal information processing.

5. Deputy Information Officers

Brewster may designate one or more Deputy Information Officers where appropriate.

Where designated, Brewster intends that Deputy Information Officers should be accessible, have a reasonable understanding of POPIA and PAIA, and have sufficient familiarity with Brewster's business operations and processes to perform their responsibilities effectively.

6. Categories of Personal Information Processed

Brewster may process categories of personal information including:

  • name and contact details;
  • account and authentication information;
  • merchant, store, and staff account records;
  • customer order and transaction records;
  • subscription, billing, refund, remittance, and support records;
  • technical, device, security, and usage information; and
  • other information reasonably required to provide, secure, administer, and improve the Brewster platform.

7. Purposes of Processing

Brewster processes personal information for purposes including:

  • operating the website, customer application, and merchant or admin platform;
  • creating and managing accounts;
  • secure authentication and access control;
  • processing customer orders and merchant workflows;
  • merchant onboarding and store management;
  • subscriptions, billing, payment enablement, and remittance support;
  • customer service and support;
  • security, fraud prevention, and audit logging;
  • legal and regulatory compliance; and
  • service improvement and anonymised analytics.

8. Lawful Processing Approach

Brewster aims to ensure that personal information is processed on a lawful basis, including where processing is necessary for contract performance, compliance with legal obligations, legitimate operational purposes, protection of a legitimate interest, or consent where consent is required.

Where consent is relied on, Brewster aims to ensure that such consent is specific, informed, and voluntary, and that it may be withdrawn subject to applicable limitations.

9. Security Safeguards

Brewster applies reasonable technical and organisational safeguards to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction.

These safeguards may include:

  • encryption in transit and at rest;
  • role-based access controls;
  • OAuth 2.0 compliant authentication and access management using Keycloak;
  • logging and audit trails;
  • environment segregation;
  • monitoring and alerting; and
  • service-provider due diligence and operational controls.

10. Data Localisation

Brewster is designed so that personal information is encrypted and remains hosted within South Africa as part of normal platform operations.

If an exceptional support, legal, or integration scenario requires cross-border processing, Brewster will take reasonable steps to ensure appropriate protection in accordance with applicable law.

11. Data Subject Rights

Subject to applicable law, data subjects may have rights to:

  • request confirmation of whether Brewster holds personal information about them;
  • request access to their personal information;
  • request correction, updating, deletion, or restriction in appropriate circumstances;
  • object to certain processing;
  • withdraw consent where processing is based on consent; and
  • lodge a complaint with the Information Regulator.

Requests may be directed to the Information Officer using the contact details above.

12. Complaints

If you have a complaint about how Brewster processes personal information, you may contact Brewster first so that the matter can be investigated and, where possible, resolved.

You may also contact the Information Regulator.

Information Regulator (South Africa)
Website: https://inforegulator.org.za/
General enquiries: [email protected]
Telephone: 010 023 5200
Toll Free: 0800 017 160
POPIA complaints: [email protected]
PAIA complaints: [email protected]
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

13. Related Documents

This notice should be read together with Brewster's:

  • Privacy Policy;
  • Terms of Service;
  • Cookie Policy;
  • Customer Refund Policy; and
  • Merchant Platform Rules, where applicable.

14. Updates

Brewster may update this POPIA Compliance Notice from time to time to reflect changes in law, platform operations, governance, or personal information processing practices.