Effective date: 14 July 2026
Last updated: 14 July 2026

1. Introduction

Naughty Bean Consulting (Pty) Ltd, trading through naughtybean.coffee, respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, disclose and protect your personal information when you:

• Visit or use the naughtybean.coffee website;

• Create an account;

• Place an order;

• Subscribe to marketing communications;

• Contact us;

• Participate in a promotion, competition or survey; or

• Otherwise interact with us.

For purposes of the Protection of Personal Information Act 4 of 2013, commonly known as POPIA, Naughty Bean Consulting (Pty) Ltd is the responsible party for the personal information described in this Privacy Policy.

2. Our details

Responsible party: Naughty Bean Consulting (Pty) Ltd
Website: naughtybean.coffee
Email: hello@naughtybean.coffee
Physical address: Shop 14, The Kruin Centre, 528 Banket Drive, Helderkruin, South Africa

References in this Privacy Policy to “Naughty Bean”, “we”, “us” or “our” mean Naughty Bean Consulting (Pty) Ltd.

3. Personal information we collect

Depending on how you interact with us, we may collect the following categories of personal information.

3.1 Identity information

This may include your:

• Full name;

• Username or customer account identifier;

• Date of birth, where reasonably required;

• Company name; and

• VAT or business registration information, where relevant.

3.2 Contact information

This may include your:

• Email address;

• Telephone or mobile number;

• Billing address;

• Delivery address; and

• Other contact information you provide to us.

3.3 Order and transaction information

This may include:

• Products purchased or added to your cart;

• Order history;

• Order values;

• Discount codes or promotions used;

• Delivery instructions;

• Returns, refunds or exchanges;

• Invoices and receipts; and

• Communications relating to your order.

3.4 Payment information

Payments may be processed through third-party payment service providers.

Depending on the payment method used, we may receive limited payment-related information, such as:

• Payment status;

• Payment method;

• Transaction reference;

• The last digits of a payment card; and

• Billing information.

We generally do not receive or store your complete payment card number, card verification value or online banking credentials where payment is handled directly by a payment service provider.

Your payment service provider will process your payment information in accordance with its own privacy policy and security requirements.

3.5 Account information

Where customer accounts are available, we may collect:

• Your login details;

• An encrypted or hashed version of your password;

• Saved addresses;

• Communication preferences;

• Account settings; and

• Account activity.

You are responsible for keeping your account credentials confidential.

3.6 Technical and usage information

When you use our website, we may automatically collect:

• Your Internet Protocol address;

• Browser type and version;

• Device type;

• Operating system;

• Approximate location based on your IP address;

• Referring website;

• Pages viewed;

• Products viewed;

• Links clicked;

• Dates and times of visits;

• Session information;

• Website errors; and

• Other information about how you use our website.

3.7 Marketing and communication information

This may include:

• Your marketing preferences;

• Whether you have opened or interacted with an email;

• Your responses to promotions or surveys;

• Messages sent to us;

• Customer service enquiries; and

• Reviews or feedback submitted by you.

3.8 Information from third parties

We may receive information from third parties that assist us with:

• Payment processing;

• Deliveries and courier services;

• Website hosting;

• Analytics;

• Advertising;

• Social media;

• Fraud prevention;

• Customer support; and

• Business administration.

We will only use information received from third parties where we have a lawful reason to do so.

4. How we collect personal information

We may collect your personal information:

• Directly from you when you place an order, create an account, contact us or complete a form;

• Automatically through cookies and similar technologies;

• From payment processors, couriers and other service providers;

• From social media platforms when you interact with our pages or advertisements;

• From publicly available sources; or

• From another person acting on your behalf, such as someone placing an order for delivery to you.

Where someone provides us with another person’s personal information, that person must have authority or an appropriate lawful basis to provide it to us.

5. Why we process your personal information

We may process your personal information for the following purposes:

5.1 Processing and delivering orders

We use personal information to:

• Confirm and process your order;

• Accept or verify payment;

• Deliver products;

• Provide order updates;

• Issue invoices and receipts;

• Manage returns, refunds and exchanges; and

• Contact you about your order.

5.2 Managing customer accounts

We may use your information to:

• Create and manage your account;

• Authenticate your identity;

• Save your preferences;

• Maintain your order history; and

• Provide account-related support.

5.3 Customer service

We may process personal information to:

• Respond to questions or complaints;

• Resolve delivery or payment issues;

• Provide product information;

• Manage warranties or returns; and

• Maintain records of our communications.

5.4 Website operation and improvement

We may use information to:

• Operate and maintain our website;

• Understand how visitors use the website;

• Improve website performance;

• Develop new products or functionality;

• Diagnose technical problems; and

• Personalise your shopping experience.

5.5 Security and fraud prevention

We may process information to:

• Verify transactions;

• Detect or prevent fraud;

• Prevent unauthorised account access;

• Protect our website and systems;

• Investigate suspicious activity; and

• Enforce our terms and policies.

5.6 Legal and regulatory compliance

We may process and retain information to:

• Comply with tax, accounting, consumer protection and other legal obligations;

• Respond to lawful requests from regulators, courts or public authorities;

• Establish, exercise or defend legal claims; and

• Maintain records required by law.

5.7 Marketing

Where permitted by law, we may use your contact information to send you:

• Product updates;

• Special offers;

• Promotional messages;

• Newsletters;

• Abandoned-cart reminders; and

• Information about Naughty Bean products and services.

You may unsubscribe from electronic marketing at any time by using the unsubscribe option included in the communication or by contacting us at hello@naughtybean.coffee.

Unsubscribing from marketing will not prevent us from sending transactional communications relating to an order, payment, delivery, account, security matter or customer service enquiry.

6. Lawful grounds for processing

We will only process personal information where permitted by applicable law.

Depending on the circumstances, we may process your information because:

• The processing is necessary to enter into or perform a contract with you;

• You have consented to the processing;

• The processing is required by law;

• The processing protects your legitimate interests;

• The processing protects the legitimate interests of another person;

• The processing is necessary for us to pursue our legitimate business interests, provided that your rights and interests are appropriately protected; or

• The information has deliberately been made public by you.

Where we rely on consent, you may withdraw that consent at any time. Withdrawing consent will not affect processing that occurred lawfully before the withdrawal.

7. When providing information is mandatory

Certain information is necessary for us to process an order, receive payment or deliver products.

Where required information is not provided, we may be unable to:

• Create your account;

• Accept or fulfil your order;

• Process your payment;

• Deliver your products;

• Issue an invoice; or

• Respond effectively to your request.

Fields that are optional will generally be identified as such.

8. Cookies and similar technologies

Our website may use cookies, pixels, local storage and similar technologies.

Cookies are small data files stored on your browser or device. We may use them to:

• Keep the website operational;

• Maintain your shopping cart;

• Keep you signed in;

• Remember your preferences;

• Process orders;

• Prevent fraud;

• Measure website traffic;

• Understand how visitors use the website;

• Improve website performance; and

• Deliver or measure advertising.

8.1 Types of cookies

Our website may use:

Essential cookies: Required for core website functions such as account authentication, security, checkout and shopping-cart functionality.

Preference cookies: Used to remember settings such as language, region or display preferences.

Analytics cookies: Used to understand website usage and performance.

Advertising cookies: Used to measure marketing campaigns and display relevant advertising, where applicable.

You can manage or block cookies through your browser settings. Blocking certain cookies may cause some website features, including checkout or account functionality, to operate incorrectly.

Where required, we will request consent before placing non-essential cookies on your device.

9. Sharing your personal information

We may disclose personal information to carefully selected third parties where reasonably necessary for the purposes described in this Privacy Policy.

These parties may include:

• Payment gateways and financial institutions;

• Couriers, delivery providers and logistics partners;

• Website hosting and cloud service providers;

• Email, messaging and customer support providers;

• Accountants, auditors, insurers and professional advisers;

• Analytics and advertising providers;

• Fraud prevention and cybersecurity providers;

• IT support and software providers;

• Government departments, regulators, courts or law-enforcement authorities; and

• A purchaser, investor or adviser involved in a proposed sale, merger, restructuring or transfer of our business.

We require service providers that process personal information on our behalf to protect that information and process it only for authorised purposes.

We do not sell your personal information.

10. International transfers

Some of our service providers or their systems may be located outside South Africa.

Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer is lawful and that the recipient is subject to:

• A law, binding corporate rule or agreement providing an adequate level of protection;

• Contractual obligations requiring appropriate protection;

• Your consent, where consent is an appropriate basis; or

• Another lawful basis permitted under POPIA.

11. Retaining your information

We retain personal information only for as long as reasonably necessary to:

• Fulfil the purposes for which it was collected;

• Complete transactions;

• Maintain customer accounts;

• Comply with legal, tax, accounting and regulatory obligations;

• Resolve disputes;

• Prevent fraud; and

• Establish, exercise or defend legal claims.

Retention periods may differ depending on the type of information and the reason it was collected.

When personal information is no longer required, we will delete, destroy, de-identify or anonymise it where reasonably practicable, subject to any applicable legal retention requirements.

Anonymous or de-identified information that can no longer reasonably be linked to you may be retained for statistical, analytical or business purposes.

12. Information security

We take reasonable and appropriate technical and organisational measures to protect personal information against:

• Loss;

• Unauthorised access;

• Unauthorised disclosure;

• Misuse;

• Alteration;

• Destruction; and

• Unlawful processing.

These measures may include:

• Access controls;

• Password protection;

• Encryption where appropriate;

• Secure hosting;

• System monitoring;

• Software updates;

• Backups;

• Staff access restrictions; and

• Service-provider security requirements.

No internet transmission or electronic storage system is completely secure. Although we take reasonable precautions, we cannot guarantee absolute security.

You should use a unique and secure password for your account and notify us immediately if you suspect unauthorised access.

13. Security compromises

Where there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will investigate the incident and take appropriate steps in accordance with applicable law.

Where legally required, we will notify the Information Regulator and affected individuals as soon as reasonably possible, taking into account the needs of any legitimate investigation.

A notification may include:

• A description of the possible consequences;

• The measures we have taken or intend to take;

• Recommendations on steps you can take to protect yourself; and

• Information identifying the unauthorised person, where known and lawful to disclose.

14. Your rights

Subject to applicable law and any relevant limitations, you may have the right to:

• Ask whether we hold personal information about you;

• Request access to your personal information;

• Request that inaccurate, incomplete, outdated, misleading or unlawfully obtained information be corrected or deleted;

• Object to certain processing of your personal information;

• Withdraw consent where processing is based on consent;

• Request the deletion or destruction of personal information where legally permitted;

• Object to direct marketing;

• Request information about third parties that have received your personal information;

• Lodge a complaint with the Information Regulator; and

• Institute civil proceedings where permitted by law.

We may need to verify your identity before responding to a request.

Certain requests may be refused or limited where permitted or required by law, including where retaining information is necessary to comply with a legal obligation, protect another person’s rights or establish, exercise or defend a legal claim.

15. Exercising your rights

Requests concerning your personal information may be sent to:

Email: hello@naughtybean.coffee
Address: Shop 14, The Kruin Centre, 528 Banket Drive, Helderkruin, South Africa

Please include sufficient information for us to:

• Identify you;

• Locate the relevant records; and

• Understand the nature of your request.

We may request proof of identity to prevent personal information from being disclosed to an unauthorised person.

We will respond within the period required by applicable law.

16. Direct marketing

We may send electronic marketing communications where:

• You have consented to receive them;

• You are an existing customer and the communication relates to similar products or services, where permitted by law; or

• Another lawful basis applies.

Every electronic marketing communication will provide a reasonable method for opting out.

You may also object to direct marketing by emailing hello@naughtybean.coffee.

We may retain limited information about your opt-out request to ensure that we continue to respect your preference.

17. Social media and third-party websites

Our website may contain links to social media platforms, payment services, delivery services or other third-party websites.

Those third parties operate independently and may collect or process your personal information under their own privacy policies.

We are not responsible for the privacy, security or content practices of third-party websites or services. You should review the relevant third party’s privacy policy before providing personal information.

18. Reviews and public content

Where you submit a product review, testimonial, social-media comment or other content intended for publication, your name, username, review and any information you choose to include may be visible to the public.

You should not include sensitive, confidential or unnecessary personal information in publicly visible content.

We may moderate or remove content in accordance with our website terms and applicable law.

19. Personal information relating to children

Our online store is not specifically directed at children.

A parent or legal guardian should place orders on behalf of a child where appropriate.

We will not knowingly process a child’s personal information without the consent of a competent person or another lawful basis permitted under POPIA.

Where we become aware that personal information relating to a child has been collected unlawfully, we will take reasonable steps to delete or otherwise appropriately handle that information.

20. Automated processing

We may use automated systems to assist with:

• Fraud detection;

• Transaction verification;

• Website security;

• Product recommendations;

• Marketing personalisation; and

• Website analytics.

We will not subject you to a decision based solely on automated processing that has a substantial legal or similarly significant effect on you unless the processing is permitted by law and appropriate safeguards are in place.

21. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect:

• Changes to our business;

• Changes to the website;

• New products or services;

• Changes to service providers;

• Legal or regulatory developments; or

• Improvements to our privacy practices.

The updated policy will be published on naughtybean.coffee with a revised “Last updated” date.

Material changes may also be communicated through the website, by email or through another appropriate method.

22. Complaints

We encourage you to contact us first so that we can try to resolve your concern.

Email: hello@naughtybean.coffee

You also have the right to lodge a complaint with the South African Information Regulator.

At the date of this policy, the Information Regulator’s contact details include:

Information Regulator South Africa
Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg, 2191
South Africa

Telephone: 010 023 5200
Toll-free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za

The Information Regulator’s current complaint forms and submission procedures are available through its official website and eServices platform.

23. Contact us

Questions, requests or complaints about this Privacy Policy or our processing of personal information may be directed to:

Naughty Bean Consulting (Pty) Ltd
Shop 14, The Kruin Centre
528 Banket Drive
Helderkruin
South Africa

Email: hello@naughtybean.coffee
Website: naughtybean.coffee