Privacy Policy

1. Who we are

Early Bird Coffee (“Early Bird”, “we”, “us” or “our”) operates the Early Bird mobile app, including online coffee ordering, payments, customer accounts and the loyalty programme.

For the purposes of applicable data-protection law, the responsible party/controller is EARLY BIRD COFFEE CO (PTY) LTD, with its address at 9 Valley Cres, Centurion Golf Est, Centurion – 0157, South Africa (ZA).

2. Information we collect

Location

The app asks for your location when it opens and when it returns to the foreground. It compares that location on your device with configured store coordinates to decide whether online ordering is available. Early Bird does not store your device’s precise location as part of this check.

Payments

Payments are processed by Yoco. We receive payment and checkout information needed to create, confirm and support your order, but we do not store your complete card number or card security code.

3. How we use your information

We use personal information to:

• create and secure your account and verify your phone number;
• process, prepare, fulfil and support coffee orders and payments;
• calculate loyalty stamps, show loyalty and reward QR codes, and prevent duplicate reward use;
• confirm whether online ordering is available at your current store location;
• send transactional notifications, such as order-status updates;
• operate the staff approval and audit trail for loyalty activity;
• maintain security, prevent fraud and troubleshoot errors; and
• comply with legal, accounting and regulatory obligations.

Where required, we rely on your consent (for example, location access and optional notifications), the performance of our agreement with you, our legitimate operational interests, or a legal obligation.

4. Service providers and sharing

We do not sell personal information. We share information only where needed to run the app, complete an order, comply with law or protect our rights.

• Supabase provides authentication, database and secure backend services.
• Yoco processes online payments and payment confirmations.
• BulkSMS sends one-time SMS verification codes.
• Firebase Cloud Messaging delivers app notifications.
• Apple and Google provide the app-distribution, operating-system and notification infrastructure for their respective platforms.
• Authorised Early Bird staff may see the order, loyalty or approval information necessary to serve you and operate the programme.

Some providers may process information outside South Africa. Where this occurs, we take reasonable steps to use providers and safeguards appropriate for the transfer.

5. Retention and security

We retain account, order, loyalty, payment-reference and audit information for as long as reasonably needed for the purposes described here, including customer support, fraud prevention, financial recordkeeping and legal obligations. We then delete or de-identify it where appropriate.

We use access controls, authentication, role-based staff permissions and service-provider safeguards designed to protect personal information. No online system can guarantee absolute security, so please keep your device and account access secure.

6. Your choices and rights

You can manage certain permissions, including location and notifications, in your device settings. You may also ask us to access, correct or delete personal information, object to certain processing, or raise a privacy concern using the contact details below. We may need to verify your identity before actioning a request.

If the Protection of Personal Information Act, 2013 (POPIA) applies to you, you may also lodge a complaint with South Africa’s Information Regulator. Information about POPIA rights and complaints is available from the Information Regulator.

7. Children

The app is not intended for children where parental or guardian consent is required by applicable law. If you believe a child has provided us with personal information without appropriate consent, contact us so that we can review the request.

8. Changes to this policy

We may update this policy when our services, data practices or legal obligations change. We will publish the revised version here and update the effective date. Where a change is material, we will provide additional notice where required.

9. Contact us