Privacy Policy

1. Introduction

Welcome to Brewster ("Brewster", "we", "us", or "our").

Brewster is a pickup ordering and café management platform for South African cafés. Brewster includes both a customer-facing application and a merchant or admin application. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you:

• visit our website at https://brewster.co.za
• join our waitlist
• create or use a Brewster account
• use Brewster as a café owner, staff member, or customer
• use the Brewster customer app
• use the Brewster merchant or admin app
• place or manage café pickup orders through Brewster
• communicate with us for support, onboarding, billing, or other service-related matters

We are committed to processing personal information lawfully and in a manner consistent with the Protection of Personal Information Act, 4 of 2013 ("POPIA"), and, where applicable, other relevant laws.

2. Who We Are

Responsible Party: Olio Technologies (Pty) Ltd trading as Brewster
Trading Name: Brewster
Email: [email protected]
Support Email: [email protected]
Registered Address: 11 Greyvenstein Close, Plattekloof Glen, Cape Town, South Africa, 7460

Information Officer / Privacy Contact
Name: Tyrone Smith
Email: [email protected]

If you have any questions about this Privacy Policy or how we process your personal information, please contact us using the details above.

3. Scope of This Privacy Policy

This Privacy Policy applies to personal information processed by Brewster in connection with:

• our public website
• waitlist and marketing sign-up forms
• the Brewster customer application
• the Brewster merchant and admin platform
• customer-facing ordering flows and mobile or web interfaces
• order management, customer support, and communications
• merchant onboarding, subscription billing, and account administration
• payment enablement and transaction-related processes
• integrations with third-party service providers

This Privacy Policy does not apply to third-party websites, products, or services that may be linked to or integrated with Brewster and that have their own privacy notices.

4. Categories of Personal Information We Collect

Depending on how you interact with Brewster, we may collect the following categories of personal information.

4.1 Information You Provide Directly

Café owners, managers, and staff

• full name
• email address
• phone number
• job title or access role
• café or business name and trading details
• physical address and operating hours
• profile details and account preferences
• subscription and billing contact information
• information submitted during onboarding, setup, support, or billing

Customers

• full name
• email address
• phone number
• order details
• pickup preferences
• loyalty or rewards information, where applicable
• support messages and communications
• saved preferences or favourite orders, where available

Waitlist and marketing contacts

• name
• email address
• business name
• city or region
• any details you choose to include in forms or enquiries

4.2 Account and Authentication Data

We may collect login and account identifiers, user IDs, organisation or tenant identifiers, session information, account creation records, invitation records, and authentication metadata necessary to operate secure sign-in and access control.

Authentication and access management within Brewster is handled using OAuth 2.0 compliant identity and access controls through Keycloak.

4.3 Order and Transaction Information

We may collect order contents and item selections, modifier selections and special instructions, order timestamps and status history, pickup confirmations, refund or reversal-related records, and settlement or remittance records relevant to merchant operations.

4.4 Payment-Related Information

Depending on the payment model used, we may process or receive payment status, transaction references, settlement information, billing details, and limited fraud, dispute, refund, or chargeback-related information.

Brewster uses:

• PayFast for merchant subscription payments
• Yoco for customer payments and merchant payment processing
• merchant-managed bring-your-own-key Yoco integrations, where a merchant elects to connect and manage its own Yoco credentials within Brewster

We do not intentionally store full payment card numbers or card security codes unless explicitly required and lawfully handled through a certified payment provider. Payment card processing is handled by third-party payment service providers.

4.5 Device, Technical, and Usage Information

When you use our website or platform, we may automatically collect your IP address, browser type and version, device type and operating system, referring URLs, pages viewed, timestamps, application usage events, cookies and similar technologies data, and log and diagnostic data.

4.6 Location-Related Information

Where relevant to discovery or nearby café functionality, we may collect approximate location inferred from device or browser settings, location information you choose to provide, and address information relevant to café listings.

We will only collect precise location data where this is enabled by your device or browser permissions and needed for a feature you use.

4.7 Support and Communications

If you contact us, we may keep records of support requests, email or chat correspondence, feedback, call notes, issue reports, and attachments or screenshots you send us.

5. Personal Information We Collect From Other Sources

We may receive personal information from:

• payment service providers
• authentication and identity providers
• merchant partners
• referral or onboarding partners
• customer support tools
• fraud prevention or risk management providers
• social login providers where you choose to use them

Where website analytics are used, Brewster uses Google Analytics to understand how its public website is used. Analytics cookies are only set if you accept them, and nothing is loaded before you do.

These analytics rely on a randomly generated identifier stored on your device. That identifier does not carry your name or contact details, and Brewster does not use analytics to identify individual users or to build advertising profiles. Brewster does not serve advertising and advertising features are switched off. Because such an identifier may still constitute personal information, we treat it as such.

This information is processed by Google outside South Africa. Where you accept analytics cookies, that transfer takes place on the basis of your consent. If you decline, no analytics identifier is created and nothing is transmitted.

We may combine information from different sources where permitted by law and necessary for our legitimate business purposes.

6. How We Use Personal Information

We may use personal information to:

• provide and operate the Brewster website, apps, and platform
• create and manage user accounts
• authenticate users and secure access
• onboard cafés and configure tenant environments
• process and manage pickup orders
• enable team management and role-based access
• provide customer order history and re-order functionality
• facilitate subscriptions, subscription billing, and account administration
• facilitate or coordinate payments, settlements, refunds, reversals, and chargebacks
• communicate service updates, order notifications, and support responses
• improve our products, services, and user experience
• monitor performance, reliability, and security
• produce anonymised analytics and operational reporting
• detect, investigate, and prevent fraud, abuse, misuse, or other unlawful activity
• comply with legal and regulatory obligations
• enforce our terms, policies, and rights
• send direct marketing where permitted by law and where required consent has been obtained

7. Lawful Bases for Processing

Under POPIA and other applicable laws, we process personal information where this is lawful and justified, including where:

• you have consented
• processing is necessary to conclude or perform a contract with you
• processing is required to comply with a legal obligation
• processing protects a legitimate interest of yours
• processing is necessary for pursuing our legitimate interests or the legitimate interests of a third party, provided your rights do not override those interests

Where we rely on consent, you may withdraw it at any time, subject to legal and contractual limits.

8. Direct Marketing

We may send you service-related communications without marketing consent where those communications are necessary for your use of Brewster, such as account notices, onboarding emails, security alerts, receipts or transaction notices, and support-related communications.

Where we send direct marketing by electronic means, we will do so in accordance with applicable law, including POPIA. You may opt out of marketing communications at any time by using the unsubscribe mechanism in the message or by contacting us directly.

9. Cookies and Similar Technologies

We may use cookies, pixels, local storage, and similar technologies to:

• keep you signed in
• remember your preferences
• maintain security
• analyse service performance
• improve functionality and user experience
• support platform reliability and diagnostics

Cookies may be:

• strictly necessary
• functional
• analytics cookies, where you have accepted them
• limited service measurement cookies

You can usually control cookies through your browser settings. Disabling certain cookies may affect site functionality.

10. When Personal Information Is Mandatory

Some personal information is necessary for us to provide services. If you do not provide certain information, we may not be able to:

• create your account
• onboard your café
• process an order
• send order notifications
• provide support
• comply with legal requirements
• process merchant subscriptions or billing
• process merchant payment enablement or settlements

11. Sharing Personal Information

We may share personal information with the following categories of recipients, only where necessary and lawful:

11.1 Service Providers and Operators

These may include providers of:

• hosting and cloud infrastructure located within South Africa
• authentication and identity management services
• email and communications tools
• customer support tools
• payment processing and settlement support
• security, fraud prevention, and logging
• data storage, backups, and recovery

11.2 Merchant Cafés and Their Staff

Where you place an order through Brewster, relevant information may be shared with the café and authorised staff members so they can:

• prepare your order
• communicate order status
• verify collection
• manage customer service
• administer loyalty or reward programmes

11.3 Payment Providers and Financial Partners

Depending on the payment model used, personal information may be shared with:

• PayFast for subscription billing
• Yoco for customer payment processing and merchant payment functionality
• merchant-managed Yoco integrations where a merchant elects to connect its own credentials
• financial institutions or service providers involved in settlement, refunds, disputes, or chargebacks

11.4 Professional Advisors

We may share information with our legal, accounting, auditing, insurance, or other professional advisors where necessary.

11.5 Regulators, Law Enforcement, and Authorities

We may disclose personal information where required to:

• comply with law
• respond to lawful requests
• protect rights, property, or safety
• investigate unlawful conduct or policy violations

11.6 Corporate Transactions

If Brewster is involved in a merger, acquisition, restructuring, financing transaction, or sale of assets, personal information may be disclosed as part of that process, subject to appropriate safeguards.

We do not sell personal information as a standalone data-broker business.

12. Data Localisation and Cross-Border Processing

Brewster stores and processes personal information within South Africa.

Brewster is designed so that personal information is encrypted and does not leave South Africa as part of normal platform operations.

If cross-border processing ever becomes necessary for a specific service, support activity, legal requirement, or authorised integration, we will take reasonable steps to ensure that the recipient is subject to laws, contracts, or other safeguards that provide an adequate level of protection consistent with applicable law.

13. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, contractual performance, operational and business continuity, dispute handling, security and fraud prevention, and legal, tax, accounting, and regulatory requirements.

Retention periods may vary depending on the type of information. For example:

• account data may be retained while your account remains active and for a reasonable period afterwards
• transaction, billing, and settlement records may be retained for statutory and audit purposes
• support records may be retained for service quality, accountability, and dispute resolution
• log and security data may be retained for monitoring and incident response

When personal information is no longer required, we will delete, de-identify, or securely destroy it, unless continued retention is required by law.

14. Security Safeguards

We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, unauthorised disclosure, alteration, and destruction.

These measures include, where appropriate:

• encryption in transit and at rest
• secure authentication and access management
• OAuth 2.0 compliant identity controls using Keycloak
• role-based permissions
• audit logging
• environment segregation
• monitoring and alerting
• secure development and deployment practices
• backup and recovery controls
• service provider due diligence

Brewster is designed so that data is encrypted and remains hosted within South Africa.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Your Rights

Subject to applicable law, you may have the right to:

• request confirmation of whether we hold personal information about you
• request access to your personal information
• request correction, updating, or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained personal information
• object to certain processing
• withdraw consent where processing is based on consent
• request deletion or restriction in certain circumstances
• lodge a complaint with the Information Regulator or another competent authority

To exercise your rights, contact us using the details in section 2. We may need to verify your identity before processing your request.

16. Children

Brewster is not intended for children to independently contract for services unless permitted by law and supported by an appropriate lawful basis. We do not knowingly collect personal information from children in a manner that is unlawful.

If you believe a child has provided us with personal information unlawfully or without appropriate consent where required, please contact us so we can investigate and take appropriate action.

17. Third-Party Services and Links

Brewster may integrate with or link to third-party services, including payment gateways, identity providers, and external websites.

We are not responsible for the privacy practices of third parties operating under their own terms and privacy notices. We encourage you to review those policies before using such services.

18. Multi-Tenant and Merchant Data Handling

Brewster operates a platform used by multiple independent cafés or merchant organisations.

Where a café uses Brewster to manage customer orders, loyalty, staff accounts, subscriptions, payment operations, or merchant administration:

• Brewster may act as a responsible party for certain processing activities relating to operation of the platform, website, accounts, security, billing, subscriptions, and platform administration
• Brewster may act as an operator or service provider on behalf of the café for certain customer, order, loyalty, or transaction data processing activities

The exact role may depend on the relevant service, contract, feature, or merchant configuration.

19. De-Identified and Aggregated Data

Brewster may create and use de-identified, anonymised, statistical, or aggregated information for purposes such as:

• analytics
• product improvement
• benchmarking
• capacity planning
• reporting
• commercial insights

The platform analytics described above - reporting and commercial insight drawn from order and operational data - are aggregated and are not intended to identify individual users.

Website analytics are handled separately and are described under cookies and analytics below: they rely on a device identifier, are only enabled if you accept analytics cookies, and involve processing by Google outside South Africa on the basis of that consent.

Where data has been irreversibly de-identified so that it no longer identifies a person, this Privacy Policy may no longer apply to that data.

20. Complaints

If you have concerns about how we process your personal information, please contact us first so we can try to resolve the issue.

You may also lodge a complaint with the South African Information Regulator.

Information Regulator (South Africa)
Website: https://inforegulator.org.za/
General enquiries: [email protected]
Telephone: 010 023 5200
Toll Free: 0800 017 160
POPIA complaints: [email protected]
PAIA complaints: [email protected]
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, changes in our services, changes in our data practices, or operational improvements.

Where we make material changes, we will take reasonable steps to notify users appropriately, for example by publishing the revised version on our website or notifying affected users where required.

Your continued use of Brewster after changes are published will be subject to the revised Privacy Policy.

22. Contact Us

If you have any questions, requests, or complaints about this Privacy Policy or our privacy practices, please contact:

Brewster
Olio Technologies (Pty) Ltd trading as Brewster
11 Greyvenstein Close, Plattekloof Glen, Cape Town, South Africa, 7460
Email: [email protected]
Support: [email protected]
Information Officer: Tyrone Smith
Information Officer Email: [email protected]