OHMI COFFEE CO · DOCUMENT 07 OF 16

Privacy Notice

OHMI Coffee Co (Pty) Ltd · Registration number 2024/665206/07

Under the Protection of Personal Information Act, 4 of 2013

Version 1.3 · 15 October 2026 · Effective 16 October 2026, published at https://ohmicoffee.co.za/legal

1. Responsible party

1.1 OHMI Coffee Co (Pty) Ltd, registration number 2024/665206/07, of Unit 42 Wesley Road, Galloway Centre, Strand, Western Cape, 7200, is the responsible party. Our Information Officer is Thomas Brandon Marriott, contactable at sales@ohmicoffee.co.za marked “Privacy” or at that address. Registration of the Information Officer with the Information Regulator is in progress. There is no Deputy Information Officer.

2. What we collect and why

2.1 To run your account: your name, email address, phone number, date of birth, the Member who introduced you, and your login credentials. Purpose: to identify you, to communicate with you, and to credit the Member who introduced you for your orders.

2.2 To sell and deliver coffee: your delivery address, your orders, and your payment reference. Purpose: to fulfil and record your orders and to match your payment. We do not collect or store card details. If you pay by card, you enter them on the secure page of our payment provider, iKhokha, which tells us only whether the payment succeeded, with a reference and the amount.

2.3 To pay you, if you are an Affiliate: your identity number, a copy of your identity document, a bank confirmation letter or statement, proof of address if you choose to give it, and your bank account details. If you change your bank or identity details after verification, we verify them again before we pay you. Purpose: to verify that we pay the right person, as the law and our bank require. These are stored in a private area, accessible only to authorised staff, and never shown to any other Member.

2.4 If you use the travel feature: your searches, claims, receipts and booking details. Purpose: to assess and pay a claim.

2.5 If you contact support: what you write to us. Purpose: to answer you. We use an automated service to draft a first reply from the text of your message; a person reviews it before anything binding is said.

2.6 Automatically: an authentication session so you stay signed in; a push subscription, only if you enable notifications; and a record of which pages and features you use, held against your member record for our own analysis. There are no advertising pixels and no third-party tracking.

2.7 If you buy through an Affiliate’s link, code or shop: your name, email address, phone number and delivery address, and which Affiliate’s link or code you used. Purpose: to fulfil and deliver your order and to credit the Affiliate for the sale. If you buy through an Affiliate’s personal shop without an account, once your first order is paid we register you as a customer member introduced by that Affiliate, so that your orders are kept together.

2.8 If an Affiliate introduces your business for trade supply: the business name, the contact person’s name, phone number and email, the business address, who supplies it now and at what price, and photographs of the coffee it uses. Purpose: to taste, quote and supply.

2.9 When we ship your order: your name, phone number and delivery address go to our courier. A tracking page can be opened by anybody holding the tracking number; it shows the parcel’s progress and its destination town, and nothing else.

2.10 If you ask us to book travel: the full name and South African ID number of each traveller you list, their dates of birth as shown by those numbers, your contact details, and the flight, hotel or cruise and dates you chose. Purpose: to make the booking. We share them only with our travel agent and the airline, hotel or cruise line concerned, and you must have each traveller’s permission before you give us their details.

3. Who sees it

3.1 Our authorised staff, for their function only.

3.2 An Affiliate can see, for each Member they introduced: their name, member number, the date they joined and whether their account is active; and, for each order that earned the Affiliate commission, the order number and date, the customer’s name, the products and quantities, the order value and what the Affiliate earned. The Member who introduced an Affiliate sees the same details for sales on which they earned. Neither can see any Member’s address, contact details, identity document or bank details through this.

3.3 An Affiliate with a personal shop can see the orders placed through it, including the customer’s name, contact details and delivery address, so that they can look after that customer. They may use those details only for that purpose, as the Marketing and Communications Policy requires.

3.4 The operators we use, each only for its function and each under its own published data protection terms as the safeguard under section 72 of the Act: Supabase (database, authentication and file storage; United Kingdom); Vercel (hosting; United States and global edge locations); MapTiler (map tiles; Switzerland); Meta (WhatsApp messages to members who have opted in; Ireland and United States); Google (encrypted backups; United States); Anthropic (drafting of support replies; United States); SerpApi and Kayak (travel searches, where you use them; United States); the push service of your device’s operator (Google, Apple or Mozilla), if you enable push; Courier IT, through the Shiplogic platform (delivery, within South Africa); iKhokha (card payments, within South Africa); and our bank (payments, within South Africa).

3.5 Anybody the law requires us to disclose to, on a lawful demand.

4. How long we keep it

4.1 Account and order records: five years after the last transaction, or longer where tax or company law requires. Identity and bank verification records: five years after the last payment to you, as the law requires. Support messages: two years. Backups: rolling, and deleted on the same schedule as the records they contain.

5. Your rights

5.1 You may ask what we hold about you, ask us to correct it, ask us to delete it where we are not required to keep it, object to processing, and withdraw any consent you gave. Write to sales@ohmicoffee.co.za marked “Privacy”. We respond within thirty days. These rights survive the closure of your account.

5.2 You may complain to the Information Regulator at enquiries@inforegulator.org.za or 010 023 5200. Our internal review does not remove that right.

6. Security

6.1 We protect personal information with access controls, encryption in transit and at rest, private storage for identity documents, and audit logging of every change to financial records. If a breach occurs that is likely to harm you, we will tell you and the Regulator as the law requires.

7. Children

7.1 The service is for adults. We do not knowingly collect information from a person under eighteen. If we learn we have, we delete it.

General provisions

Entire agreement. This document, together with the other OHMI documents it refers to, records the whole of the agreement between you and us on its subject. No representation, undertaking or term not recorded in these documents binds us.

Variation. We may amend this document. We will give you at least fourteen days’ notice of an amendment by notice in the app or by message to the contact details you have given us. An amendment does not alter the price, calculation or entitlement of any order placed or benefit earned before it takes effect. Continued use of the service after the effective date of an amendment is acceptance of it.

Severability. If any provision of this document is found to be unenforceable, it is severed and the remainder continues in force.

No waiver. Our failure or delay to enforce any provision is not a waiver of it.

Assignment. You may not cede, assign or transfer any right or obligation under this document. We may cede or assign to a successor in business on notice to you.

Force majeure. We are not liable for any failure or delay caused by an event beyond our reasonable control, including supplier failure, courier failure, power or network outage, strike, fire, flood, epidemic or act of government.

Notices. Notices to us go to sales@ohmicoffee.co.za or to Unit 42 Wesley Road, Galloway Centre, Strand, Western Cape, 7200, our address for service. Notices to you go to the email address, phone number or in-app inbox on your account. A notice sent by email or in-app message is deemed received on the business day after it is sent.

Governing law and jurisdiction. This document is governed by the law of the Republic of South Africa. You consent to the jurisdiction of the Magistrates’ Courts, without prejudice to our right to approach the High Court, and without prejudice to any right you have to approach a consumer body under the Consumer Protection Act, 68 of 2008.

Interpretation. Headings are for convenience only. “Including” means including without limitation. The singular includes the plural. A reference to a statute is to that statute as amended.

Precedence. Where this document conflicts with the Terms of Use and Sale, the Terms of Use and Sale prevail. Where this document conflicts with mandatory law, the law prevails and this document is read down to the extent necessary.