Privacy Policy

This Privacy Policy explains how Cabralos Commodities (Pty) Ltd, trading as Liquor City Orkney (“we”, “us”, “our”), collects, uses, shares, and protects your personal information when you use our mobile application (the “App”) or place orders with us. We process your information in accordance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”).

1. Who we are

The responsible party for the processing of your personal information is:

1.1 Information Officer

Our Information Officer is Sergio Cabral, reachable at orkneyhyper@gmail.com. You may contact the Information Officer about any matter relating to this Policy or the exercise of your rights under POPIA.

2. Information we collect

We collect the following categories of personal information:

• Identity & contact: full name, mobile phone number, email address.
• Age confirmation: a record that you confirmed you are 18 or older at sign-up.
• Address & location: delivery addresses you save, GPS coordinates of those addresses, and (with your permission) your device’s approximate location to confirm you fall within our delivery area.
• Order & transaction: orders you place, items purchased, prices paid, payment method, payment status, delivery status, order notes, and time-stamps.
• Loyalty programme: your loyalty card number, lifetime savings, eligibility for personalised deals.
• Saved card metadata: card brand, last four digits, expiry month and year. We never store your full card number, CVV, or PIN — those are handled directly by our PCI-compliant payment processor (see Section 4).
• Device & technical: device type, operating system version, app version, push-notification token, crash diagnostics, and authentication identifiers from Apple Sign In or Google Sign In if you choose to use them.
• Communications: messages you send us and our responses.

3. How we use your information & lawful basis

We process your personal information for the following purposes:

• To provide the service (place, prepare, and deliver your orders) — performance of contract.
• To process payments and prevent fraud — performance of contract and legitimate interest.
• To verify you are of legal drinking age — compliance with the Liquor Act.
• To send order updates and delivery notifications — performance of contract.
• To send promotional notifications and personalised deals — with your consent (you may disable push notifications at any time in your device settings).
• To run the loyalty programme and apply discounts — performance of contract.
• To keep accounting, tax, and liquor-trade records — compliance with the Income Tax Act, the VAT Act, and the Liquor Act.
• To improve the App and resolve technical issues — legitimate interest.

4. Who we share your information with

We share your personal information only with the following operators and recipients, and only to the extent necessary:

• Peach Payments — our PCI DSS Level 1 payment processor handles all card data. We never see or store your card number, CVV, or expiry digits.
• Supabase — our cloud database and authentication provider. Your data is stored in Supabase’s data centres and protected by row-level security policies.
• Apple Inc. and Google LLC — only if you choose to sign in using Sign in with Apple or Google. We receive only the limited identifier they share with us (and an email if you allow it).
• Expo Application Services — for delivering push notifications to your device.
• Our delivery driver — the driver assigned to your order receives your name, phone, address, and order contents so the delivery can be completed.
• SARS, the Information Regulator, the South African Police Service, and other regulators — where we are required by law to disclose information.

We do not sell your personal information to anyone, ever.

5. International transfers

Some of our service providers (Peach Payments, Supabase, Apple, Google, Expo) may process your information outside South Africa. Where this happens, we rely on those providers’ contractual safeguards and on Section 72 of POPIA, which permits cross-border transfer where the recipient is bound by laws or binding rules that provide a level of protection substantially similar to POPIA.

6. How long we keep your information

• Order, invoice, and payment records: retained for at least 5 years after the transaction date, in compliance with the Tax Administration Act and the Liquor Act.
• Account profile, addresses, saved card metadata, loyalty data, push tokens: retained while your account is active. Removed or anonymised within a reasonable period after you delete your account from within the App.
• Communications: retained for as long as needed to resolve the matter and to defend any legal claim arising from it.

When you delete your account from the App, we anonymise your profile and remove your contact details, addresses, saved cards, push tokens, and personalised deals. Your historical order records are retained in anonymised form to satisfy our tax and liquor-trade record-keeping obligations.

7. Your rights under POPIA

You have the right to:

• Request access to the personal information we hold about you.
• Request correction or deletion of your personal information.
• Object to the processing of your personal information for direct marketing.
• Withdraw any consent you have previously given.
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za if you believe we have not handled your information lawfully.

You can exercise most of these rights directly within the App (update your profile, manage your saved card, delete your account). For anything else, contact our Information Officer at the details above.

8. Security

We protect your personal information using industry-standard measures, including HTTPS encryption in transit, encryption at rest, role-based access controls inside our database (row-level security), and PCI DSS Level 1 compliance for card payments via Peach Payments. No system is perfectly secure, but we take reasonable steps to detect and mitigate unauthorised access. If a security breach affects your information we will notify you and the Information Regulator as required by Section 22 of POPIA.

9. Children

Our service is for adults only. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with their personal information, please contact us immediately so we can delete it.

10. Cookies and tracking

The App is a native mobile application and does not use browser cookies. We use a single device identifier (a push notification token) only to send you order updates and, with your consent, promotional notifications. We do not use third-party advertising or analytics SDKs that track you across other apps or websites.

11. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or in the law. The “Last updated” date at the top of this page will always show when the most recent change was made. If a change materially affects how we use your information, we will notify you in the App.

12. Contact us

If you have any questions, requests, or complaints about this Policy or about how we handle your personal information, please contact our Information Officer: