Privacy Policy

Last updated: 11 October 2026

This policy explains how Plato Coffee Franchise (Pty) Ltd ("Platō", "we", "us") collects, uses, shares and protects your personal information when you visit plato.coffee, buy from our online store, book an Academy course, or contact us. It's written to meet the Protection of Personal Information Act 4 of 2013 (POPIA), in particular section 18.

Platō coffee shops are mostly run by independent franchisees, who are responsible for personal information they collect in their own stores. This policy covers plato.coffee and our online store only.

1. Who is responsible for your information

2. What we collect, and where it comes from

From you, when you order, register, book or contact us:

• Identity and contact details: name, email address, phone or WhatsApp number, delivery and billing address.

• Order details: products bought, prices, delivery method, returns and refunds, and messages about your order.

• Account details: login details, order history, and preferences (if you create an account).

• Academy bookings: the name and contact details of the attendee, and any dietary needs you choose to tell us about.

• Communications: what you tell us by email, WhatsApp, contact forms, reviews or surveys.

• Marketing preferences: whether you've agreed to, or opted out of, marketing.

Payment information: card and bank details are entered directly on the secure systems of our payment providers, Stitch and HappyPay. We never see or store your full card details. We receive only confirmation of payment and limited details, such as the payment method and last four digits.

Automatically, when you use our website: IP address, device and browser type, pages viewed, how you arrived at our site, and actions such as adding to cart or checking out. This is collected through cookies and similar technologies (see section 9).

From third parties: delivery status updates from our couriers, payment confirmation from our payment providers, and, if you interact with our ads, limited information from advertising platforms such as Google, Meta and TikTok.

We don't intentionally collect special personal information (such as health, religious or biometric information). The exception is dietary or allergy information that you choose to give us for an Academy booking. We use that only to cater for you, with your consent.

Is it compulsory? You need to give us your name, contact details and delivery address to place an order or booking. If you don't, we can't fulfil it. Everything else, such as marketing preferences and reviews, is voluntary.

3. Why we use it, and our lawful basis (POPIA section 11)

We'll only use your information for a new purpose if it's compatible with the original purpose, or if we have your consent or another lawful basis.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you (POPIA section 71).

4. Direct marketing (POPIA section 69; CPA section 11)

• If you're not yet a customer, we'll send you electronic marketing (email, SMS or WhatsApp) only if you've opted in, for example by ticking an unticked box or signing up to our newsletter.

• If you're a customer, we may send you marketing about our own similar products and services, but only if we gave you the chance to opt out when we collected your details. You can opt out at any time.

• Every marketing message tells you who it's from and includes a free and easy way to unsubscribe, such as an unsubscribe link or replying "STOP".

• We don't sell your personal information, and we don't share it with other businesses for their own marketing.

• We don't send marketing to anyone we know is under 18.

To stop marketing at any time, use the unsubscribe link, update your account, or email hello@plato.coffee.

5. Who we share it with

We share personal information only where needed for the purposes above, with service providers ("operators") that process it on our behalf under written agreements requiring them to keep it confidential and secure (POPIA sections 20 and 21):

We may also share information:

• with our professional advisers, auditors and insurers;

• with law enforcement, regulators or courts when the law requires it; and

• with a buyer or successor if our business is sold or restructured, under the same protections.

6. Sending information outside South Africa (POPIA section 72)

Some of the providers above, including Shopify, Google, Meta and TikTok, store or process information outside South Africa. We transfer information abroad only where at least one of the following applies:

• the recipient is bound by law, binding corporate rules or a binding agreement giving it an adequate level of protection, substantially similar to POPIA;

• the transfer is necessary to perform our contract with you, for example running our online store and checkout; or

• you've consented, for example to advertising cookies.

7. How long we keep it (POPIA section 14)

We keep personal information only for as long as necessary for the purpose we collected it for, or as required or allowed by law. For example:

• Orders, invoices and payment records: at least 5 years (Tax Administration Act), and up to 7 years for company accounting records (Companies Act).

• Marketing lists: until you unsubscribe. We keep a record of your opt-out so we don't contact you again.

• Website analytics and cookie data: for the periods set by each provider.

After that, we delete or anonymise the information, unless we need it for a legal claim or the law requires us to keep it longer.

8. How we protect it (POPIA sections 19 and 22)

• Our website and checkout use encryption (HTTPS/TLS).

• Payments are processed by PCI DSS-certified providers. We don't store card details.

• Access to customer information is limited to staff and providers who need it, and protected by passwords and two-step verification where available.

• Our operators must keep information secure under written agreements.

If there's a data breach: if we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we'll notify the Information Regulator and you as soon as reasonably possible. We'll tell you enough for you to protect yourself, as POPIA section 22 requires.

9. Cookies and tracking

Cookies are small files saved on your device. We use:

• Essential cookies: needed for the cart, checkout, login and security. These can't be switched off.

• Analytics cookies (for example Google Analytics): these help us understand how the site is used.

• Marketing cookies and pixels (Google Ads, the Meta Pixel and the TikTok Pixel): these measure our ads and show you Platō ads on other platforms.

Where required, we ask for your consent before using analytics and marketing cookies. You can change your choice at any time through any cookie settings we provide on the website, or block and delete cookies in your browser settings. If you block essential cookies, parts of the website (such as the cart and checkout) may not work.

10. Children

Our online store is meant for adults. You must be 18 or older to place an order, or have a parent's or guardian's consent. We don't knowingly collect personal information from children (under 18) without a parent's or guardian's consent (POPIA sections 34 and 35), and we don't direct marketing at anyone under 18. If you believe a child has given us personal information, contact hello@plato.coffee and we'll delete it.

11. Your rights

Under POPIA you have the right to:

• Know whether we hold personal information about you, and ask for a copy of it (section 23);

• Ask us to correct or delete information that is inaccurate, out of date, incomplete, excessive or unlawfully obtained, or that we're no longer allowed to keep (section 24);

• Object to us processing your information on the basis of legitimate interests, and object at any time to direct marketing (section 11(3));

• Withdraw your consent at any time. This doesn't affect processing we did before you withdrew it;

• Not be subject to decisions based solely on automated processing (section 71); and

• Complain to the Information Regulator (see section 12).

To exercise a right, email hello@plato.coffee. We'll ask you to confirm your identity first. We'll respond within a reasonable time, and within the time limits set by law. Basic requests are free. Requests for records may be handled under the Promotion of Access to Information Act (PAIA), and prescribed fees may apply. Our PAIA manual is available on request from hello@plato.coffee.

12. Complaining to the Information Regulator

If you're unhappy with how we've handled your personal information, please contact us first at complaints@plato.coffee so we can try to resolve it. You also have the right to lodge a complaint with the Information Regulator (South Africa):

• Online complaints: the Regulator's eServices portal, https://eservices.inforegulator.org.za

• Email (general enquiries): enquiries@inforegulator.org.za

• Phone: 010 023 5200, or toll-free 0800 017 160

• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

• Website: https://inforegulator.org.za

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make significant changes, we'll tell you by email or on the website.