Privacy Policy

FirstCaffé is a Kampala-based restaurant and bakery. This Privacy Policy applies when you browse our website, create an account, place or receive an order, buy or use a gift card, join rewards, contact support, send feedback, or use a FirstCaffé mobile experience.

For the purposes of Uganda’s Data Protection and Privacy Act, 2019 (now Chapter 97), FirstCaffé determines why and how the personal data described in this policy is processed. This policy should be read together with our Terms & Conditions and Return & Refund Policy.

The information we collect depends on how you use our services. We receive most of it directly from you, from the device you use, or from service providers that help us authenticate accounts and process transactions.

• Account and contact details, including your name, email address, phone number, date of birth, profile image, sign-in identifiers, and communication preferences.
• Order and fulfilment details, including cart items, customisations, dietary or allergy notes you choose to provide, pickup or delivery selection, delivery address, order history, and customer instructions.
• Payment and value-account details, including payment method, payer phone number, transaction references and status, gift-card purchase or redemption records, and refund status. Complete payment credentials are handled by the relevant payment provider rather than stored by FirstCaffé.
• Rewards and engagement details, including points, tier, redemptions, referral activity, favourites, reviews, ratings, feedback, promotions, and marketing choices.
• Support communications, including chat messages, attachments you choose to send, issue details, and records of how a request was handled.
• Device and technical information, such as IP address, browser or device type, operating system, app version, push-notification token, timestamps, diagnostics, and security logs.
• Approximate or precise location only when you provide it or permit access so we can support delivery or location-based features.

We use personal data only for clear service, safety, communication, and business purposes.

• Create and secure your account, verify your identity, and keep your profile details in sync.
• Prepare, confirm, deliver, or make available your orders and gift-card purchases.
• Initiate payments, confirm transaction outcomes, process approved refunds, and keep accurate financial and operational records.
• Operate rewards, favourites, referrals, gift cards, reviews, feedback, support chat, and order-status notifications.
• Respond to questions, investigate complaints, prevent fraud or misuse, and protect customers, staff, and our systems.
• Understand service performance, troubleshoot technical issues, and improve our menu, products, and customer experience.
• Send offers or marketing messages where you have opted in. You may opt out of direct marketing at any time.
• Meet legal, tax, accounting, regulatory, and dispute-resolution obligations.

Depending on the activity, we process personal data with your consent, because it is needed to provide a service or complete a transaction you requested, because the law requires it, or because it is reasonably necessary to protect and operate our services without overriding your rights.

Where we rely on consent, such as for optional marketing, device permissions, or information you choose to add, you may withdraw that consent. Withdrawal does not make earlier lawful processing invalid and may mean that an optional feature can no longer work for you.

We do not sell personal data. We share only what is reasonably necessary with people and organisations that help us provide the service or meet a legal obligation.

• Kitchen, counter, support, and delivery team members who need the information to prepare, hand over, deliver, or resolve an issue with your order.
• Payment providers such as MTN MoMo, for payment initiation, confirmation, reconciliation, and refunds.
• Technology providers, including Firebase services used for authentication, chat, realtime updates, and notifications, as well as hosting, email, analytics, security, and communications providers.
• Professional advisers, insurers, auditors, regulators, courts, law-enforcement bodies, or public authorities where disclosure is lawful and necessary.
• A successor or potential successor if our business is reorganised, merged, or transferred, subject to appropriate confidentiality and data-protection safeguards.

Some cloud and technology providers may process or store information outside Uganda. Where this happens, we take reasonable steps to use providers and arrangements that protect personal data to a standard consistent with applicable Ugandan law, and we seek consent where the law requires it.

We keep personal data only for as long as it is needed for the purposes described here. Account information is generally kept while the account remains active. Orders, payments, refunds, gift cards, rewards, and related records may be retained longer where they are needed for accounting, fraud prevention, customer support, legal claims, or regulatory obligations.

When information is no longer required, we take reasonable steps to delete it, de-identify it, or securely restrict further use. Backup copies may remain for a limited period before they are overwritten.

We use reasonable organisational and technical safeguards, including access controls, authenticated customer and staff areas, encryption in transit, restricted service credentials, logging, and operational procedures designed to prevent unauthorised access, alteration, loss, or disclosure.

No internet service is completely risk-free. Keep your device and sign-in methods secure, do not share verification codes, and contact us promptly if you believe your account or an order has been misused.

Subject to applicable law and reasonable identity checks, you may ask us to explain whether we hold your personal data and how it is used.

• Request access to personal data we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Request blocking, erasure, destruction, or restriction where the legal requirements are met.
• Object to direct marketing or withdraw an optional marketing consent.
• Raise a concern about automated decision-making where applicable.
• Make a complaint to FirstCaffé or to Uganda’s Personal Data Protection Office.

Our account and ordering services are intended for adults. A person under 18 should use them only with the involvement and consent of a parent or guardian. We do not knowingly seek personal data from children without appropriate authority. If you believe a child has provided personal data improperly, please contact us so we can review and address it.

Our website and apps may use cookies, browser or app storage, device permissions, and similar technologies to keep you signed in, preserve a cart or checkout draft, remember preferences, protect the service, measure reliability, and diagnose errors.

You can manage browser storage, location access, and push notifications through your browser or device settings. Disabling an essential permission or storage feature may prevent part of the service from working correctly.

We may update this policy when our services, providers, or legal obligations change. The date at the top of the page shows the latest revision. Material changes may also be highlighted in the website or app where appropriate.

For a privacy question, access or correction request, deletion request, or complaint, use Contact Us or Chat with Support on the FirstCaffé website or app. Please include enough information for us to verify your identity and locate the relevant account or order. You may also contact Uganda’s Personal Data Protection Office if you believe your rights have not been respected.