Hoscat Pty Ltd ABN 63 603 953 000
Trading as Jorge & Co

Effective date: 20 February 2026

1. About this policy

Hoscat Pty Ltd, trading as Jorge & Co, respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information in connection with:

• our Jorge & Co cafés;
• our website and online services;
• online coffee and catering orders;
• loyalty programs and promotions;
• customer enquiries and feedback;
• CCTV at our premises;
• recruitment and job applications; and
• our employees and workplace administration.
  
  

This policy applies to our operations at:

• Box Hill Hospital;
• Wantirna Hospital;
• Peter James Centre; and
• any other Jorge & Co location operated by Hoscat Pty Ltd from time to time.
  
  

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable Australian laws.

2. What personal information we collect

The personal information we collect depends on how you interact with us.

Customers and website users

We may collect:

• your name;
• email address;
• telephone number;
• delivery, billing or business address;
• order and transaction details;
• catering details, including event information, cost centres and delivery instructions;
• loyalty program details;
• marketing preferences;
• enquiries, feedback and complaint information;
• records of communications with us;
• device information, IP address and browser information;
• website activity, cookie data and analytics information; and
• CCTV images recorded at our premises.
  
  

You may generally purchase food or drinks in-store without providing your name or joining a loyalty or online ordering system. Some information will be required when you place an online order, request delivery, open a catering account or use another service that cannot be provided anonymously.

Sensitive information

We may collect limited health-related or sensitive information where it is reasonably necessary to provide our services, such as:

• food allergies;
• dietary requirements; and
• other health-related dietary needs that you voluntarily provide.
  
  

We will only collect this information with your consent or where otherwise permitted or required by law. This information is used to assist with your order or request.

While we take reasonable care when handling dietary and allergy information, customers with serious allergies should speak directly with our staff before ordering. Providing allergy information does not guarantee that a product will be completely free from allergens or cross-contact.

Job applicants and employees

We may collect employment-related information including:

• contact details;
• résumés and employment history;
• qualifications, licences and training records;
• reference information;
• identification and right-to-work documents;
• employment contracts and workplace records;
• tax file number and taxation information;
• bank account and superannuation details;
• payroll, attendance, leave and rostering information;
• emergency contact details;
• performance, training and disciplinary information;
• workplace incident, injury and workers compensation information; and
• health information that is relevant to workplace safety or a person’s ability to perform their role.
  
  

We do not use fingerprint scanning, facial recognition or other biometric systems for employee attendance.

3. How we collect information

We generally collect personal information directly from you when you:

• visit one of our cafés;
• place an in-store, online coffee or catering order;
• create or use an account;
• join a loyalty or marketing program;
• contact us by telephone, email, website form or in person;
• provide feedback or make a complaint;
• apply for employment;
• complete employment, payroll, superannuation, safety or onboarding forms; or
• otherwise deal with us.

Certain technical information may be collected automatically when you use our website or online services.

We may also generate business records from your interactions with us, such as transaction records, order history, workplace records and CCTV footage.

4. Why we collect and use personal information

We may collect, hold and use personal information to:

• process and fulfil food, drink and catering orders;
• manage customer and catering accounts;
• process payments and refunds;
• arrange delivery or collection;
• communicate about an order, account or enquiry;
• manage loyalty programs, promotions and customer preferences;
• send marketing communications where consent has been provided;
• improve our products, services and customer experience;
• operate and improve our website and online ordering systems;
• understand website usage and performance;
• respond to feedback, enquiries and complaints;
• maintain the safety and security of our customers, staff and premises;
• investigate accidents, incidents, suspected theft or misconduct;
• recruit, onboard, pay and manage employees;
• comply with workplace, taxation, superannuation, health and safety and other legal obligations;
• manage insurance claims, disputes and legal matters;
• prevent fraud and protect our legal rights; and
• carry out ordinary business administration, accounting, auditing and record keeping.
  
  

We do not access Eastern Health patient files or medical records. We only collect health or dietary information that a customer, applicant or employee voluntarily provides to us or that we are legally required to collect.

5. Payments

Payments may be processed through third-party payment providers, including:

• Westpac EFTPOS terminals; and
• Fat Zebra for catering payments.
  
  

We do not store customers’ complete payment card numbers or security codes. Payment providers process payment information through their own systems and handle that information under their own privacy policies and security arrangements.

We may retain transaction details such as the date, amount, payment status, receipt details and limited card information where this is provided to us by the payment provider.

6. Website, cookies and analytics

Our website and online ordering services may use cookies and similar technologies.

These technologies may collect information including:

• IP address;
• device and browser type;
• pages visited;
• date and time of access;
• referring website;
• website interactions; and
• general usage and performance information.
  
  

We may use this information to operate our website, remember user preferences, understand how our services are used, improve performance and detect security issues.

You may be able to limit or block cookies through your browser settings. Disabling cookies may affect the operation of some website or ordering functions.

Our website, analytics and online coffee-ordering providers may change from time to time. Their handling of information may also be governed by their own privacy policies.

7. Customer Wi-Fi

Customer Wi-Fi available at Eastern Health locations is provided and managed by Eastern Health, not Hoscat Pty Ltd.

Information collected through that Wi-Fi service is subject to Eastern Health’s applicable terms, security arrangements and privacy policies. Hoscat Pty Ltd does not control the operation of the Eastern Health Wi-Fi network.

8. Marketing communications

We may send promotional emails or SMS messages about Jorge & Co products, services, offers, loyalty benefits or events where you have consented to receive them or where otherwise permitted by law.

Our marketing messages will identify us and include a clear way to unsubscribe or opt out.

You can withdraw your consent at any time by:

• using the unsubscribe link in an email;
• following the opt-out instructions in an SMS; or
• contacting our Privacy Officer.
  
  

We will not sell, rent or trade your personal information to another organisation for that organisation’s marketing purposes.

9. CCTV

We operate video-only CCTV at our premises for safety, security, incident management, theft prevention and the protection of customers, employees and property.

Signs are displayed to notify people that CCTV is in operation.

CCTV:

• records video only and does not record audio;
• may capture images of customers, visitors, contractors and staff;
• is accessible only to directors and authorised managers;
• is generally retained for approximately 14 days; and
• may be retained for longer where footage relates to an incident, investigation, insurance claim, legal requirement or dispute.
  
  

CCTV footage may be disclosed where reasonably necessary to police, emergency services, insurers, legal advisers, Eastern Health or other authorised parties in connection with an incident, investigation or legal obligation.

We do not use CCTV footage for facial recognition or biometric identification.

10. Who we may share information with

We only disclose personal information where reasonably necessary for our operations, to provide a requested service, with your consent or where permitted or required by law.

Recipients may include:

• Eastern Health, where necessary for site operations, access, security, safety or incident management;
• Westpac, Fat Zebra and other payment providers;
• website, hosting, ordering, loyalty, marketing and analytics providers;
• Xero for accounting, payroll and business administration;
• Deputy, if adopted for rostering, timekeeping or workforce management;
• accountants, auditors, bookkeepers and professional advisers;
• payroll, superannuation and employment-service providers;
• IT, cybersecurity, storage and software providers;
• insurers and insurance brokers;
• delivery providers and contractors;
• legal advisers and dispute-resolution providers;
• police, emergency services and regulatory authorities;
• taxation, superannuation, workplace and government agencies; and
• other service providers assisting us to operate our business.
  
  

We limit disclosures to the information reasonably required for the relevant purpose.

We may also disclose information where required or authorised by law, to respond to a court order or legal process, or where reasonably necessary to protect a person’s safety or our legal rights.

We do not sell, rent or trade personal information.

11. Overseas storage and processing

Some technology, cloud, website, ordering, accounting, workforce-management or payment providers may store or process information outside Australia.

The countries involved may vary depending on the provider, its systems and the services being used. It may not always be practicable for us to specify every country in which information is processed or stored.

Where required, we take reasonable steps to ensure that overseas handling of personal information is subject to appropriate privacy and security protections.

You may contact our Privacy Officer for information about the providers currently being used and the locations in which they may process information.

12. How we protect personal information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Our safeguards include:

• password-protected and encrypted laptops;
• access to electronic records being limited to directors and authorised users;
• multi-factor authentication where available;
• restricted access to business systems;
• locked office storage for paper records;
• limited access to CCTV footage;
• secure payment processing through third-party providers; and
• the secure disposal or deletion of information when it is no longer required.
  
  

No system is completely secure. Where a data breach occurs or is suspected, we will investigate and take appropriate steps to contain and respond to it. We will notify affected individuals and the Office of the Australian Information Commissioner where required by law.

13. How long we keep information

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected or as required by applicable laws, contractual obligations, insurance requirements or legal proceedings.

Retention periods may vary depending on the type of record. Employment, payroll, taxation, superannuation, workplace safety and transaction records may need to be retained for legally required periods.

CCTV footage is generally retained for approximately 14 days unless it is required for an incident, investigation, claim, dispute or legal obligation.

When personal information is no longer required, we will take reasonable steps to securely destroy it or permanently de-identify it.

14. Children

Our online services, loyalty programs and marketing activities are not directed at children under 16, and we do not knowingly collect personal information from children under 16.

Where a person under 16 purchases from one of our cafés, they can generally do so without providing identifying information.

Where we become aware that we have unintentionally collected a child’s personal information, we will take reasonable steps to delete it where lawful and appropriate.

15. Accessing or correcting your information

You may ask us to:

• confirm whether we hold personal information about you;
• provide access to personal information we hold about you; or
• correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.
  
  

Please contact our Privacy Officer using the details below.

We may need to verify your identity before providing access or making a correction. In limited circumstances, we may refuse access or correction where permitted by law. Where appropriate, we will explain the reason for the refusal and the available complaint options.

We will respond within a reasonable period and aim to respond within 30 days.

16. Privacy complaints

You may contact our Privacy Officer if you believe that we have mishandled your personal information or breached this policy or applicable privacy laws.

Please include:

• your name and contact details;
• a description of your concern;
• relevant dates or transactions; and
• the outcome you are seeking.
  
  

We will acknowledge and investigate the complaint and aim to provide a response within 30 days.

Where you are not satisfied with our response, or we do not respond within a reasonable period, you may make a complaint to the Office of the Australian Information Commissioner.

17. Changes to this policy

We may update this Privacy Policy when our services, systems, providers or legal obligations change.

The current version will be published on our website and will show its effective or last-updated date.

18. Contact us

Privacy enquiries, access or correction requests and complaints should be directed to:

Privacy Officer
Hoscat Pty Ltd trading as Jorge & Co
ABN 63 603 953 000

Level 1, Building B
8 Arnold Street
Box Hill VIC 3128
Jorge & Co Café

Email: info@jorgeandco.com.au
Phone: 0447 028 980