🔒 Privacy Policy

Effective Date:  1st November 2025

Responsible Party: Café 1904, Hermanus

This Privacy Policy explains how Café 1904 ("we", "us", or "our") collects, uses, discloses, and protects your Personal Information, in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) of South Africa.

1. Our Commitment (Accountability)

We are committed to protecting your privacy and ensuring that your Personal Information is collected and used properly, lawfully, and transparently, as required by the POPIA Act. We act as the Responsible Party for your data.

2. Information We Collect (Minimality)

We collect and process only the minimum amount of Personal Information necessary for the specific purposes outlined below.

Source of Information	Type of Information Collected
Online Reservations/Contact Form	Full Name, Email Address, Contact Number, Date/Time of Booking, and any special requests (e.g., dietary, seating).
Website Usage (Cookies)	IP Address, geographical location, browser type, device type, pages viewed, and duration of visit.
Events Booking	All reservation information plus the nature of the event (e.g., birthday, wedding), and number of guests.

3. Purpose of Processing (Specification & Use)

We use your Personal Information solely for the following specified, legitimate, and lawful purposes:

• To Perform Contractual Obligations: To process and confirm your dining reservation or event booking.

• To Communicate: To send booking confirmations, manage changes, and respond to your general enquiries submitted via the website.

• To Improve Service: To understand website traffic patterns and improve the user experience (via cookies).

• For Direct Marketing (Consent): Only if you have given explicit consent (e.g., opted in to a newsletter), to send you updates on weekly Sunday Lunch menus and special promotions. You can unsubscribe at any time.

4. Security Safeguards

We are legally obliged under POPIA to provide adequate protection for the Personal Information we hold. We implement reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of personal information.

• Data is stored securely on servers located in South Africa or with vetted third-party Operators (booking software providers) that comply with similar security standards.

• Access to customer data is restricted to authorised personnel only (Reservations Team and Management).

5. Disclosure and Operators

We will not sell, rent, or trade your Personal Information. We may disclose your information to the following parties:

• Third-Party Operators: External service providers who process data on our behalf, such as online booking software platforms or email service providers. We have contracts in place with these parties to ensure they treat your information with the same level of confidentiality and security required by POPIA.

• Legal Obligation: Where we are legally obliged to disclose the information, such as to law enforcement or regulatory authorities.

6. Data Subject Rights (Your Rights Under POPIA)

As a Data Subject, you have the right to:

Right	Description
Access	Request a copy of the Personal Information we hold about you.
Correction/Deletion	Request that we correct or delete Personal Information that is inaccurate, irrelevant, excessive, or has been retained for longer than necessary.
Objection	Object to the processing of your Personal Information, for instance, for the purpose of direct marketing.
Withdraw Consent	Withdraw your consent to the processing of your Personal Information at any time.

7. International Guests and Data Transfer

POPIA compliance generally covers the fundamental principles of data protection for all our guests.

For our international guests, particularly those from the European Union (EU) subject to the GDPR:

• The data we process (name, email, booking details) is necessary for the performance of a contract (your booking).

• We commit to maintaining the integrity and confidentiality of your data, a central tenet of both POPIA and GDPR.

• We will not transfer your Personal Information outside of South Africa unless the recipient is subject to a law, binding corporate rules, or agreement that upholds the principles of POPIA/GDPR.

If you have specific rights under your local data protection laws (such as the GDPR's Right to Erasure/Right to be Forgotten or Data Portability), please contact our Information Officer to discuss your request.