Privacy Policy

1. Information we collect

We may collect information that you provide directly to us, including:

• • Your name
• • Email address
• • Mobile number, where provided
• • Account and profile information
• • Information relating to your use of Secret, including orders, rewards, loyalty activity and preferences where applicable
• • Communications you send to us
• • Other information you voluntarily provide

We may also automatically collect certain technical information when you use our website, such as your device type, browser, IP address, pages visited and general usage information.

2. Google Sign-In and Google user data

Secret allows users to create and access their Secret account using Google Sign-In.

Data we access

When you choose "Sign in with Google", Secret accesses only the basic Google account information that you authorise Google to provide to us:

• • Your name
• • Your email address
• • Your Google profile image, if available
• • Your unique Google account identifier

Secret does not access your Gmail messages, Google Drive files, Google Calendar, Google Contacts or other Google Workspace data.

How we use Google user data

We use Google user data solely to:

• • Authenticate your identity
• • Create your Secret account
• • Sign you into your existing Secret account
• • Associate your Google identity with your Secret customer profile
• • Provide and improve the user-facing functionality of your Secret account

We do not use Google user data for advertising, personalised advertising, retargeting, determining creditworthiness, lending purposes or the creation of advertising profiles.

We do not sell Google user data.

We do not use Google user data to develop, improve or train general-purpose or non-personalised artificial intelligence or machine-learning models.

Sharing of Google user data

We do not sell, rent or trade Google user data.

Google user data may only be processed by service providers acting on our behalf where necessary to operate Secret's authentication, hosting, database or other essential technical infrastructure.

We do not transfer or disclose Google user data to third parties for advertising, data brokerage, information resale, creditworthiness, lending or the training of general-purpose artificial intelligence or machine-learning models.

We may disclose information where required by applicable law or a valid legal process.

Protection of Google user data

We use reasonable technical and organisational security measures designed to protect Google user data against unauthorised access, disclosure, alteration, loss or misuse.

These measures include access controls and secure transmission of information using industry-standard encryption technologies where appropriate.

Retention and deletion of Google user data

We retain Google user data only for as long as necessary to maintain and provide your Secret account and services, or as otherwise required by applicable law.

You may request deletion of your Secret account and associated Google user data at any time by contacting us at hello@secretcoffee.co.za.

Following a valid deletion request, we will delete or anonymise the Google user data associated with your account unless retention is required by law, security, fraud prevention or another legitimate legal obligation.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use your information

We may use your personal information to:

• • Create and manage your Secret account
• • Authenticate your identity
• • Provide Secret products, services and website functionality
• • Process and manage transactions where applicable
• • Operate loyalty, rewards or customer programmes
• • Communicate with you about your account or our services
• • Provide customer support
• • Improve our website, services and customer experience
• • Maintain the security and integrity of our systems
• • Prevent fraud, misuse and security incidents
• • Comply with applicable legal and regulatory obligations
• • Send marketing communications where you have consented to receive them or where otherwise permitted by applicable law

You may unsubscribe from marketing communications at any time.

4. How we share information

We do not sell your personal information.

We may share information with trusted service providers that help us operate Secret, including providers of website hosting, authentication, databases, analytics, communications, payments and other technical infrastructure.

These providers may only process personal information as necessary to provide their services to us and subject to appropriate data protection obligations.

We may also disclose information where required by law, regulation, legal process or to protect the rights, safety and security of Secret, our customers or others.

5. Data storage and security

We use reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Where service providers process or store information outside South Africa, information may be transferred internationally. Where applicable, we take reasonable steps to ensure that personal information remains appropriately protected.

6. Data retention

We retain personal information only for as long as reasonably necessary to provide our services, maintain your account, fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes and enforce agreements.

When personal information is no longer required, we will delete, anonymise or securely dispose of it, subject to applicable legal and operational requirements.

7. Deleting your account and data

You may request deletion of your Secret account and associated personal information at any time by contacting us using the details below.

Where technically available, account deletion may also be provided directly within your Secret account.

Following a valid deletion request, we will delete or anonymise personal information that we are not legally or legitimately required to retain.

This includes personal information obtained through Google Sign-In, subject to any information we are required to retain for legal, security, fraud-prevention or legitimate business purposes.

8. Your rights

Subject to applicable law, including South Africa's Protection of Personal Information Act, 2013 (POPIA), you may have the right to:

• • Request access to personal information we hold about you
• • Request correction of inaccurate or incomplete information
• • Request deletion of your personal information
• • Object to or restrict certain processing
• • Withdraw consent where processing is based on consent
• • Opt out of direct marketing
• • Lodge a complaint with the relevant regulatory authority

To exercise these rights, contact us using the details below.

9. Cookies and analytics

Secret may use cookies and similar technologies to operate the website, maintain sessions, remember preferences, understand how our services are used and improve the customer experience.

Where required by applicable law, we will obtain consent before using non-essential cookies or similar technologies.

10. Third-party services

Our services may use or link to third-party services, including Google.

Those third parties may process information according to their own privacy policies. We encourage users to review the privacy policies of services they choose to use.

Google's processing of information is governed by Google's own privacy policies and terms.

11. Children's privacy

Secret's online services are not intended to knowingly collect personal information from children without the consent required by applicable law.

If we become aware that personal information has been collected from a child contrary to applicable law, we will take appropriate steps to delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or data practices.

When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice.

13. Contact us

If you have questions about this Privacy Policy, how Secret handles personal information, or would like to exercise your privacy rights or request deletion of your data, please contact us at:

• Secret
• Website: secretcoffee.co.za
• Email: hello@secretcoffee.co.za
• South Africa

14. South African privacy law

Secret processes personal information in accordance with applicable South African data protection legislation, including the Protection of Personal Information Act, 2013 (POPIA).

Where applicable, individuals may also lodge a complaint with the Information Regulator of South Africa.