Privacy Policy Effective date: 14 April 2026 Last updated: 14 April 2026

This Privacy Policy explains how Coffee First Holistic Marketing Solutions (Pty) Ltd ("we", "us", "our") collects, uses, shares, and protects personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).

This policy applies to personal information collected through our website, our marketing activities, email communications, and any other channels where we collect personal information.

1. Who we are (Responsible Party)

Responsible Party: Coffee First Social Registered name: Coffee First Holistic Marketing Solutions (Pty) Ltd Registration number: 2017/132104/07 Address: 22 Finsbury Avenue, Newlands, Western Cape, 7700, South Africa Email: lucy@coffeefirst.co.za

2. What personal information we collect

Depending on how you interact with us, we may collect:

Identity and contact details: name, surname, email address, phone number
Business details: company name, job title, industry
Enquiry information: messages, requirements, and service interests
Technical data: IP address, device type, browser type, pages visited, and referral source (via cookies and analytics)
Marketing preferences: whether you opt in or out of marketing communications

If we collect additional information on a form, it will be described at the point of collection.

3. Where we collect personal information from

We collect personal information:

Directly from you when you submit a form, request information, or contact us
Automatically through website cookies and analytics where enabled

4. Why we collect personal information

We process personal information for the following purposes:

To respond to enquiries and provide requested information or proposals
To arrange consultations or strategy sessions
To provide and improve our services
To manage our relationship with clients
For marketing where permitted, including newsletters, service updates, and event invites
To comply with legal, regulatory, or contractual obligations
To protect our business and systems

5. Lawful basis for processing

We process personal information where:

You have consented, for example where you opt in to marketing communications
Processing is necessary to take steps related to a contract or to provide a service you requested
We have a legitimate interest in conducting and growing our business, balanced with your rights
Processing is required to comply with law

Where consent is used, you may withdraw it at any time. See Section 10.

6. Marketing communications

If you opt in, or where permitted by law, we may send you information about our services, resources, or insights relevant to your business.

You can opt out at any time by:

Clicking "unsubscribe" in any of our emails, or
Emailing us at lucy@coffeefirst.co.za

7. Sharing your personal information

We may share personal information with:

Service providers who support our business, including hosting providers, email platforms, and analytics providers, under appropriate safeguards
Professional advisors including legal and accounting professionals where necessary
Authorities where required by law

We do not sell personal information.

8. Cross-border transfers

Some of our service providers may store or process information outside South Africa, for example through cloud-based platforms. Where this occurs, we take reasonable steps to ensure appropriate protection consistent with POPIA's requirements.

9. Security safeguards

We use reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction. No system is completely secure, but we continuously review and improve our safeguards.

10. Your rights

Subject to applicable law, you may request to:

Access the personal information we hold about you
Correct or update your personal information
Object to certain processing, including direct marketing
Withdraw consent where processing is based on consent

To exercise any of these rights, please contact lucy@coffeefirst.co.za.

11. Retention of personal information

We keep personal information only for as long as necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law or needed for legitimate business purposes such as audit or dispute resolution.

12. Cookies and analytics

Our website may use cookies and similar technologies to improve functionality, measure performance, and understand how visitors use our site. You can control cookies through your browser settings. Where applicable, a cookie notice will be displayed.

13. Complaints

If you believe we have processed your personal information unlawfully, please contact us first so we can try to resolve the matter.

You also have the right to lodge a complaint with the Information Regulator of South Africa.

Information Regulator contact details: Website: https://inforegulator.org.za/

14. Changes to this Privacy Policy

We may update this policy from time to time. The latest version will always be published on our website with the updated "Last updated" date.