Privacy, in plain language.

Who is responsible

Xpresso Cafe (Pty) Ltd is the responsible party for the XPRESSO customer programme and determines why customer information is used. Best Pos (Pty) Ltd is the app developer and technology operator that processes information on XPRESSO’s documented instructions to provide loyalty, ordering, wallet records, security and customer support. The operator relationship requires confidentiality, appropriate safeguards, controlled access and prompt security-incident reporting. Participating XPRESSO stores receive only the information needed to fulfil and support your orders.

Company details

Xpresso Cafe (Pty) Ltd, registration number 2015/444438/07, is a South African private company with its registered physical address at 4 Kiewiet Close, Eagle Street, Okavango Park, Brackenfell, 7560, South Africa. Directors: N. Elhadad and T. Elhadad. Head office: 021 286 0744. Franchise enquiries: franchise@xpressocafe.co.za. Information Officer: Alwyn Neethling, contactable for XPRESSO privacy matters at info@xpressocafe.co.za.

Best Pos (Pty) Ltd, registration number 2017/092129/07 and VAT number 4820298125, is located at 2nd Floor, The Zone, 177 Oxford Street, Rosebank, Johannesburg, Gauteng, 2196, South Africa. Director: A. Neethling. Telephone: 011 880 0420. Fax: 086 615 4139. Information Officer: Alwyn Neethling. App, technology and Best Pos privacy enquiries: support@bestpos.co.za.

Information we handle

• Your verified mobile number, first name and surname.
• Your optional nickname, email address, preferred store and communication choices.
• Your loyalty member code, wallet balance and transaction records.
• Your orders, selected products and options, collection times, order notes, status events and cancellations.
• Your current device location only when you choose “Use my location”. It is used to return nearby participating stores and is not used for advertising.
• Security, session, device and diagnostic information needed to authenticate you, prevent fraud and keep the service reliable.
• Support messages and the order, wallet or transaction references you choose to attach.

Why we use it

We use personal information to create or link your loyalty profile, verify sign-in, provide your loyalty card and wallet history, show participating stores, process and track collection orders, send essential service messages, answer support requests, prevent misuse, reconcile transactions and meet legal obligations. Marketing messages are sent only when you choose to receive them, and you can change that choice in the app.

Who receives it

Information may be shared with the XPRESSO store fulfilling your order, Best Pos (Pty) Ltd as the platform operator, and carefully selected contracted service providers that deliver verification messages, hosting, communications or payments when those features are enabled. A transactional SMS or WhatsApp provider may receive your verified mobile number and a protected redemption link when a remaining wallet balance must be resolved after account deletion. We do not sell your personal information. We may disclose information when required by law or to protect customers, stores and the service.

Where and how it is stored

Customer profiles, loyalty records, orders and wallet ledgers are stored in access-controlled cloud databases used by the BestPOS platform. Authentication secrets and sensitive tokens are stored in protected or non-readable form where appropriate, data is encrypted in transit, privileged access is restricted and audited, and backups and incident-response controls are maintained. Approved operators may process information outside South Africa only where POPIA’s cross-border safeguards and the parties’ written contractual requirements are satisfied.

Retention and deletion

Your active profile is kept while you use the service. When you request account deletion, personal profile information is deleted or de-identified unless a law requires a record to be retained. Order, financial, wallet and audit records may be retained only for applicable legal, fraud-prevention, reconciliation and accounting periods, with their use restricted accordingly. Retention periods are recorded in the XPRESSO and Best Pos retention schedule and records are securely deleted or de-identified when no longer required.

Your choices and rights

You may request access to, correction of or deletion of your information, object to certain processing, withdraw optional marketing consent, or disable location access in your device settings. Account deletion can be started directly in the XPRESSO app under Profile.

Contact and complaints

For access, correction, objection, deletion or other XPRESSO privacy requests, contact Information Officer Alwyn Neethling at info@xpressocafe.co.za. Best Pos technology-operator privacy enquiries may also be sent to support@bestpos.co.za. Please do not send passwords, verification codes or payment-card details. You may also lodge a complaint with the Information Regulator (South Africa) if a privacy concern is not resolved.

Changes to this notice

We may update this notice when the app or legal requirements change. The current version and effective date will remain available on this page and through the app.