Privacy Policy

This policy explains what personal information Quiver Café and Liège Waffles collect through quivercafe.co.za and liegewaffles.co.za, why we collect it, who we share it with, and what rights you have over it under South Africa's Protection of Personal Information Act (POPIA).

Who we are

The "responsible party" for the personal information described here is Quiver Foundation NPC (PBO 930086507), trading as Quiver Café and Liège Waffles, 96 Victoria Rd, Woodstock, Cape Town 7925. For any privacy question or request, contact us at info@quiverfoundation.org.

Our Information Officer is Luke McGowan, who you can reach at luke@quiverfoundation.org.

What we collect

Ordering waffles online

When you order and pay on liegewaffles.co.za, we collect:

• Your name — so we know whose order it is.
• Your phone number — so we, or your delivery driver, can reach you about your order.
• Your delivery address — only if you choose delivery, so we can quote the delivery fee and send a driver.
• What you ordered — the items, quantities and total, and whether you are collecting or having it delivered.
• WhatsApp community opt-in — only if you tick the box asking to join, we note that you'd like to be added.

When you enter an address to see the delivery fee, we send it to Uber to get a quote, even if you don't go on to order. We never see or store your card details: you pay on Yoco's secure payment page, and your card information goes straight to Yoco.

Ordering on WhatsApp

Sometimes we take orders on WhatsApp instead, and the basket opens a WhatsApp chat with your order filled in. We then see your WhatsApp name and number and anything you write to us, such as your address.

Booking and hire requests

When you send a booking request on quivercafe.co.za, we collect your name, email address, phone number (if you give it) and the event details you enter: date, type, location, number of guests, package, add-ons and your message. The form emails these to the café team. The website itself does not store them.

Newsletter

If you sign up for our newsletter, we collect your email address. You are only added once you click the link in the confirmation email we send you, and every newsletter has an unsubscribe link.

Emails and messages

If you email or message us, we keep what you send so that we can reply.

Visiting the websites

Our hosting provider, Cloudflare, processes your IP address and basic technical details, such as your browser type and the pages you request, to deliver the websites and protect them from abuse. We use your IP address briefly to limit repeated form submissions. We don't store it with your orders or requests.

Why we use it

We use your information only for the reason you gave it to us:

• To prepare, deliver or hand over your order, and to contact you about it.
• To reply to your booking request and plan your event.
• To send you the newsletter or add you to our WhatsApp community, only if you asked us to. You can withdraw that consent at any time.
• To keep the websites secure and prevent abuse.
• To keep the accounting records the law requires.

Your name and phone number are needed to complete an order, and your address is needed for delivery. Without them, we can't fulfil it. Everything else is optional. We do not sell or rent your information, or use it for advertising.

Who we share it with

We share only what each service needs to do its job:

• The Quiver Café team, who see order details, booking requests and messages so they can prepare your order and reply to you.
• Yoco, which processes card payments. It receives the order total and an order reference, as well as the card details you enter on its page.
• Uber Direct, which delivers orders. It receives your name, phone number, delivery address and the items, so the driver can find you. Uber may contact you about the delivery.
• Slack, the café team's messaging tool. Each new order is posted to a private channel so the team can prepare it.
• Cloudflare, which hosts the websites and stores our online order records.
• Resend, which delivers booking requests to our inbox as email.
• Mailchimp (Intuit), which stores your email address and sends the newsletter.
• WhatsApp (Meta), if you order or message us on WhatsApp.
• YouTube (Google), only if you press play on a video. Nothing loads from YouTube until you do.

Each of these services has its own privacy policy. We don't share your information with anyone else unless the law requires it.

Information sent outside South Africa

Some of these services, including Uber, Slack, Cloudflare, Resend, Mailchimp, WhatsApp and YouTube, store or process information outside South Africa. We use them because we need them to run the café online, and they are bound by data protection laws or agreements that protect personal information to a standard similar to POPIA.

How long we keep it

• Online orders: we remove your name, phone number and delivery address from our order records 30 days after you order. We keep the order number, what was ordered and the amount paid, without your details, for our accounting records.
• Order messages in Slack: kept in a private channel that only the café team can see, and deleted after one year.
• Booking requests, emails and WhatsApp messages: kept for as long as we need them to arrange your event or answer you, and for accounting records where the law requires.
• Newsletter: until you unsubscribe.
• WhatsApp community: until you leave the group.

Yoco and Uber keep their own records of payments and deliveries, as the law requires them to.

Cookies and tracking

These sites don't use advertising or tracking cookies, and we don't run analytics that profile individual visitors. Your basket is saved in your own browser so it's still there if you reload the page. It isn't sent to us until you check out. If you play a video, YouTube may set its own cookies.

Security

These sites are served entirely over HTTPS, and order data is encrypted in transit and at rest. Only the people and services who need your information to run the café can see it. The order confirmation page has its own private link that shows your order's status, but never your phone number or address.

Your rights

Under POPIA, you have the right to:

• Ask what personal information we hold about you, and request a copy of it.
• Ask us to correct or delete information that's inaccurate or no longer needed.
• Object to how we're using your information, and withdraw your consent to the newsletter or WhatsApp community at any time.
• Lodge a complaint with South Africa's Information Regulator if you believe we've mishandled your information — see inforegulator.org.za for how to do this.

To exercise any of these rights, email our Information Officer at luke@quiverfoundation.org and we'll respond promptly.

Changes to this policy

If this policy changes, we'll update the date at the top of this page. Significant changes will be reflected here before they take effect.