Privacy Policy
Last updated: March 20, 2026
This Privacy Policy explains how Naughty Bean Consulting (Pty) LTD ("Company", "we", "us", or "our") collects, uses, stores, shares, and protects personal information when you use:
- the ClickCollect website at https://clickcollect.coffee
- the ClickCollect application and related tenant storefronts hosted on
clickcollect.coffee subdomains
- our related pages, communications, tools, and services, including order, account, billing, onboarding, and support features
This Privacy Policy applies to website visitors, prospective customers, merchants using our SaaS platform, end customers placing orders through storefronts powered by ClickCollect, and other individuals who interact with us.
1. Who We Are
Business name: Naughty Bean Consulting (Pty) LTD
Trading name / platform name: ClickCollect
Registered address:
Shop 14 The Kruin Centre
528 Banket Road
Helderkruin
Johannesburg
1724
South Africa
Email: hello@clickcollect.coffee
Privacy policy page: https://clickcollect.coffee/privacy-policy/
For the purposes of privacy laws, we may act as:
- a data controller / responsible party / APP entity when we decide how personal information is processed for the ClickCollect platform itself
- a service provider / processor / operator when we process information on behalf of coffee shops and other merchants using ClickCollect
2. Scope of This Policy
This policy covers personal information collected through:
- our website and marketing pages
- our web application
- storefronts powered by the ClickCollect platform
- account registration and sign-in flows
- online ordering and click-and-collect transactions
- subscription, onboarding, support, and business account management
- email, WhatsApp, analytics, and security tools connected to the platform
- our Facebook presence, including the Naughty Bean Coffee Facebook Page
Depending on how you use ClickCollect, we may collect the following categories of personal information.
- first name and last name
- email address
- phone number or WhatsApp number
- account details you provide when creating or managing an account
- merchant or business onboarding details, such as business name, owner name, billing details, operating preferences, storefront branding choices, and business contact information
- information submitted in support requests, forms, or direct communications
- order details, including collection location, order contents, preferences, notes, and transaction-related details
- account identifiers and login status
- order history and order status
- payment status, payment references, and limited payment response metadata returned by payment providers
- tenant subscription and billing records
- loyalty or promotional program participation data
- timestamps and records of actions taken in the platform
When you use our website or app, we and our service providers may automatically collect technical and usage information, such as:
- IP address
- browser type and version
- device type
- operating system
- referral URLs
- pages viewed
- time spent on pages
- clicks, navigation paths, and feature usage
- approximate location inferred from IP address
- cookie, session, and similar identifier data
- crash, diagnostic, and error information
We may receive information from:
- payment processors such as Stripe and Yoco
- authentication providers such as Google when you sign in using Google OAuth
- analytics and security providers such as Google Analytics, Google reCAPTCHA, and Sentry
- email service providers such as Mailchimp
- social platforms such as Meta if you interact with our Facebook Page
- merchants using ClickCollect who provide customer information needed to fulfill orders or operate their storefront
Based on the template you provided and the current platform setup:
- we do not intentionally target children under 13
- we do not run third-party display ads on the service
- we do not knowingly ask users to provide special category or sensitive personal information unless it is necessary and legally permitted
If you believe a child under 13 has provided personal information to us, please contact us at hello@clickcollect.coffee.
We collect personal information when you:
- visit our website or a storefront powered by ClickCollect
- create an account or sign in
- place an order
- choose a collection location
- sign up for updates or marketing emails
- contact us by email or through the website
- join a waitlist, request onboarding, or start a trial
- subscribe to a paid plan
- interact with our Facebook Page
- engage with email campaigns or analytics tools
- complete payment through a third-party payment processor
We use personal information to:
- provide and operate the ClickCollect website and app
- create and manage user accounts
- authenticate users and secure access
- process, confirm, manage, and fulfill orders
- provide click-and-collect services and order status updates
- onboard and manage merchant tenants on the platform
- process subscription billing and maintain billing records
- communicate with users about accounts, transactions, service issues, updates, and support requests
- send marketing or promotional emails where permitted and, where required, with consent
- analyze usage and improve our website, app, products, and customer experience
- monitor performance, troubleshoot problems, and detect fraud, abuse, or security incidents
- comply with legal obligations, accounting requirements, tax obligations, and law enforcement requests
- enforce our terms, policies, and contractual rights
7. Legal Bases for Processing Under GDPR and Similar Laws
If the GDPR or similar laws apply, we rely on one or more of the following legal bases:
- Contract: to provide our services, process orders, manage accounts, and fulfill transactions
- Consent: for certain marketing communications, optional cookies where required, and similar elective processing
- Legitimate interests: to improve our services, secure our systems, prevent fraud, understand usage, manage our business, and communicate with customers in a proportionate way
- Legal obligation: to comply with tax, accounting, regulatory, consumer-protection, and law-enforcement requirements
- Vital interests or public interest: where exceptionally required by law
8. Cookies, Analytics, and Similar Technologies
We use cookies, session technologies, and similar tools to operate the website and app, remember preferences, keep users signed in where applicable, measure usage, and help secure the service.
8.1 Google Analytics
We use Google Analytics to understand how visitors use our website and app, including page views, session information, and engagement data. Google Analytics may use cookies or similar technologies to collect information about your interactions with our services.
8.2 Session and functional technologies
We use session and similar technologies to:
- maintain secure sessions
- support login and authentication
- remember user preferences
- protect forms and requests
- help the platform function correctly
We may use Invisible reCAPTCHA or similar security tools to help distinguish legitimate users from bots and to protect our services from abuse, spam, and fraudulent activity.
8.4 Browser controls
You can usually manage cookies through your browser settings. Disabling some cookies may affect functionality, including login, checkout, or other service features.
9. Email Communications
We send emails for service and business purposes, including:
- account and login notifications
- onboarding and trial communications
- order-related communications
- subscription, billing, and administrative notices
- customer support responses
- marketing emails where a user has opted in or where otherwise permitted by law
We may use Mailchimp and other email delivery providers to send and manage email communications. These providers may process personal information such as your email address, name, campaign engagement data, and related technical metadata on our behalf.
You can unsubscribe from marketing emails by using the unsubscribe link in the email or by contacting us at hello@clickcollect.coffee. Even if you opt out of marketing messages, we may still send transactional or service-related communications.
10. Payments and Billing
Users can pay for products or services through ClickCollect. Payment processing is handled by third-party payment providers, not directly by us.
10.1 Stripe
If you choose to pay using Stripe, your payment is processed by Stripe and is subject to the Stripe Privacy Policy.
10.2 Yoco
If you choose to pay using Yoco, your payment is processed by Yoco and is subject to Yoco's privacy terms, available here: Yoco Privacy Policy.
10.3 What we may receive from payment providers
We may receive limited payment-related information from processors, such as:
- payment confirmation status
- payment references or transaction IDs
- partial card or billing metadata, where relevant for billing records
- fraud, chargeback, or verification results
We do not state in this policy that we store full payment card numbers, because payment card data is generally handled by the third-party payment processors.
11. Messaging and Notifications
ClickCollect may send operational notifications, including WhatsApp order updates, through Twilio or similar messaging providers. This may include the use of a phone number or WhatsApp number, order reference information, and limited order status details needed to deliver the message.
We use these notifications to:
- confirm new orders
- notify customers when orders are completed
- notify customers when orders are ready for collection or collected
- support merchant operations and customer communication
12. Authentication and Social Login
We may allow users to sign in using Google OAuth. If you choose this sign-in method, we may receive profile and account information from Google, such as your name, email address, and account identifier, in accordance with your Google privacy settings and permissions.
13. Error Monitoring and Service Protection
We use tools such as Sentry to monitor application performance, diagnose errors, and improve reliability. These tools may process technical data, device information, request metadata, and limited user-identifying information where necessary to investigate issues and secure the service.
14. Remarketing and Advertising
The template you provided states that we use remarketing services for marketing and advertising purposes, including Invisible reCAPTCHA in the selected provider list. We do not describe the service as showing display ads in the ordinary sense.
Where remarketing or similar audience tools are used:
- they may use cookies, pixels, tags, or similar technologies
- they may help us measure campaign effectiveness or reach users who previously visited our site
- they are subject to the privacy terms of the relevant provider
If you use browser settings or platform controls to opt out of personalized advertising or tracking technologies, some remarketing features may be limited.
15. Facebook Page and Social Media
We have a Facebook Page identified in your template as Naughty Bean Coffee. When you interact with our Facebook Page, Meta Platforms and we may each process certain information about your interaction, subject to Meta's own privacy terms and settings.
This can include:
- profile information made available to us through your interaction
- comments, messages, reactions, or reviews
- analytics or insights about page engagement
Your interactions on Facebook are also governed by Meta's own privacy policy and platform terms.
We may share personal information with:
- payment processors such as Stripe and Yoco
- analytics, hosting, security, and diagnostics providers
- email, messaging, and customer communication providers such as Mailchimp and Twilio
- authentication providers such as Google
- merchants using the ClickCollect platform, where necessary to process and fulfill orders
- professional advisers, auditors, insurers, and legal or compliance service providers
- regulators, courts, law enforcement agencies, or government authorities when required by law
- actual or prospective buyers, investors, or acquirers in connection with a merger, sale, restructuring, financing, or transfer of business assets
We do not describe ourselves here as selling personal information for money. If California law applies, please also review the California section below for additional disclosures.
17. International Data Transfers
Because we use third-party providers and cloud-based tools, personal information may be processed in countries other than your own, including countries that may not have the same level of data protection laws as your jurisdiction.
Where required, we take steps intended to provide appropriate safeguards for international transfers, which may include:
- contractual protections
- vendor due diligence
- reliance on recognized transfer mechanisms
- internal access controls and security measures
18. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to:
- provide the services
- maintain business and financial records
- complete transactions and fulfill orders
- comply with legal, tax, accounting, and regulatory obligations
- resolve disputes
- enforce agreements
- investigate abuse, fraud, or security incidents
Retention periods may vary depending on the type of information, the nature of the relationship, legal requirements, and the operational needs of the platform and participating merchants.
19. Security
We use reasonable technical, administrative, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures may include:
- access controls
- authentication controls
- vendor-managed payment systems
- monitoring and error logging
- role-based permissions
- HTTPS and other transport protections where deployed
No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.
20. Your Privacy Rights
Depending on where you live, you may have rights such as:
- the right to know what personal information we collect and use
- the right to access personal information
- the right to request correction of inaccurate information
- the right to request deletion of personal information, subject to legal exceptions
- the right to object to or restrict certain processing
- the right to withdraw consent where processing is based on consent
- the right to data portability in certain circumstances
- the right to complain to a supervisory or regulatory authority
- the right not to be discriminated against for exercising privacy rights, where applicable by law
To exercise your rights, contact us at hello@clickcollect.coffee. We may need to verify your identity before completing a request.
21. GDPR and UK-Style Privacy Rights
If you are in the European Economic Area, Switzerland, or the United Kingdom, you may have the right to:
- access your personal data
- rectify inaccurate personal data
- erase personal data in certain cases
- restrict processing in certain cases
- object to processing based on legitimate interests
- withdraw consent at any time where processing is based on consent
- receive a portable copy of certain data
- lodge a complaint with your local data protection authority
If we process personal data on behalf of a merchant using ClickCollect, you may need to contact that merchant directly first, because they may be the primary controller for that data.
22. California Privacy Rights: CCPA, CPRA, and CalOPPA
If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to:
- know the categories of personal information we collected about you
- know the categories of sources from which the information was collected
- know the business or commercial purposes for collecting, using, or disclosing personal information
- know the categories of third parties to whom personal information is disclosed
- request access to specific pieces of personal information, subject to legal exceptions
- request deletion of personal information, subject to legal exceptions
- request correction of inaccurate personal information
- limit the use and disclosure of sensitive personal information, where applicable
- not be discriminated against for exercising your privacy rights
22.1 California disclosures
In the preceding 12 months, we may have collected the following categories of personal information:
- identifiers, such as name, email address, phone number, IP address, account identifiers, and order identifiers
- commercial information, such as order details, purchase history, and billing records
- internet or electronic network activity information, such as website usage, analytics data, and session activity
- geolocation information derived approximately from IP address
- professional or business information relating to merchant accounts
- inferences drawn from usage data to improve and personalize the service
We collect this information from:
- you directly
- your device or browser automatically
- merchants using our platform
- payment, analytics, authentication, and communications providers
We use and disclose it for the purposes described throughout this policy.
22.2 Sale or sharing
Based on the service description available to us, we do not state that we sell personal information for monetary consideration. If remarketing, analytics, or similar tools are configured in a way that qualifies as "sharing" under California law, California users may have the right to opt out of that sharing. You can contact us at hello@clickcollect.coffee to make such a request.
22.3 Do Not Track and CalOPPA
Some browsers offer a "Do Not Track" signal. Because there is not a universally accepted standard for how to interpret or respond to these signals, we do not guarantee that we respond to all Do Not Track mechanisms in a uniform way. We encourage users to manage privacy preferences through browser settings and other available controls.
Under CalOPPA, users can visit our site anonymously in some cases, though certain features require information to function properly.
23. POPIA Notice for South Africa
If you are in South Africa, this section is intended to support compliance with the Protection of Personal Information Act, 2013 ("POPIA").
For POPIA purposes:
- Naughty Bean Consulting (Pty) LTD may act as a responsible party for platform-level processing
- in some cases we may act as an operator for merchants using ClickCollect
We process personal information in a lawful and reasonable manner to:
- provide our services
- fulfill orders
- communicate with users
- manage accounts and subscriptions
- secure the platform
- comply with legal obligations
You may request access to, correction of, or deletion of your personal information, subject to applicable law, by contacting hello@clickcollect.coffee.
If you believe your personal information has been processed unlawfully, you may also have the right to lodge a complaint with the Information Regulator of South Africa.
24. Australian Privacy Act Notice
If the Australian Privacy Act 1988 applies, we aim to handle personal information in a manner consistent with the Australian Privacy Principles.
Australian users may request:
- access to personal information we hold about them
- correction of inaccurate, incomplete, or outdated personal information
If you have a privacy complaint, please contact us first at hello@clickcollect.coffee so we can try to resolve it. If you are not satisfied, you may be able to complain to the Office of the Australian Information Commissioner, subject to applicable requirements.
25. New Zealand Privacy Act Notice
If the New Zealand Privacy Act 2020 applies, we aim to process personal information consistently with the privacy principles under that Act.
You may request:
- confirmation of whether we hold personal information about you
- access to your personal information
- correction of your personal information
If you have concerns about our handling of your information, please contact us at hello@clickcollect.coffee. If needed, you may also have the right to contact the Office of the Privacy Commissioner in New Zealand.
26. Third-Party Services and Their Policies
Our services may integrate with or rely on third-party providers. Their privacy practices are governed by their own policies and terms. Relevant third-party policies may include:
Other providers referenced in this policy may include Google, Mailchimp, Twilio, Sentry, and Meta/Facebook. We encourage you to review their privacy documentation directly.
27. Merchant / Tenant Data Processing
ClickCollect is a multi-tenant SaaS platform. That means individual coffee shops or merchants may use our platform to operate their own branded storefronts and manage customer orders.
When a merchant uses ClickCollect:
- the merchant may be the primary controller or responsible party for customer order information collected through its storefront
- we may process that information on the merchant's behalf to provide hosting, order management, notifications, payments support, analytics, and related operational services
- privacy requests relating to a particular merchant storefront may need to be directed to that merchant as well as to us
28. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our business, our services, or our data practices. When we do, we will update the "Last updated" date at the top of this page. If changes are material, we may also provide additional notice where appropriate.
If you have questions, requests, or concerns about this Privacy Policy or our privacy practices, you can contact us:
By email: hello@clickcollect.coffee
By visiting: https://clickcollect.coffee/privacy-policy/
By post:
Naughty Bean Consulting (Pty) LTD
Shop 14 The Kruin Centre
528 Banket Road
Helderkruin
Johannesburg
1724
South Africa