SHAYA KAHVE SANAYİ VE TİCARET A.Ş.
STARBUCKS CUSTOMER PRIVACY POLICY – GEORGIA
Data Controller (Owner of personal data): Shaya Kahve Sanayi ve Ticaret Anonim Şirketi (“Shaya Kahve” or the “Company”)
As Shaya Kahve, we attach great importance to the processing and protection of your personal data. This Privacy Policy has been prepared in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”), the Law of Georgia on Personal Data Protection dated 14 June 2023, which entered into force on 1 March 2024 (“GPDL”), and related legislation and legal regulations, in order to ensure that you are informed about the personal data processed and transferred during the provision and development of various services.
In addition, you can access detailed information on the processing of your personal data obtained automatically through the cookies used on the Starbucks website, the types of cookies used, and your preference management regarding these cookies from the Cookie Privacy Notice.
You can shop at Starbucks stores by registering as a member on Shaya Kahve’s website https://www.starbucks.ge or our mobile application.
Your identity (name, surname, date of birth), contact (mobile phone number, billing and delivery address, e-mail address), customer transaction (personalized campaign information, collected points information, star invitation code), and audiovisual records (visual data) data will be collected and processed (with obtaining your prior consent);
● limited to the purposes of conducting customer relationship management processes, conducting activities for customer satisfaction, conducting contract processes, following up requests/complaints, conducting communication activities, conducting after-sales support services for goods/services, conducting sales processes for goods/services, in accordance with the legal basis “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract”.
Your personal data is transferred abroad due to our use of technological infrastructure suppliers located abroad, only to the extent necessary for the realization of the relevant purpose, by complying with the rules of the KVKK and the GPDL and by taking the necessary technical and administrative measures, on the basis of appropriate data protection guarantees provided under an agreement concluded between the Company and the data recipient, as required by the GPDL.
In case of receiving support regarding the goods and services offered by Starbucks, your identity (name, surname), contact (phone number, e-mail address), customer transaction (shopping information, store information, number of stars), and audiovisual recording (call center voice recordings) data will be collected and processed (with obtaining your prior consent);
● limited to the purposes of conducting customer relationship management processes, conducting activities for customer satisfaction, tracking requests/complaints, conducting communication activities, receiving and evaluating suggestions for the improvement of business processes, in accordance with the legal bases “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” and “Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”.
In the event that you submit your complaints and requests to Starbucks, your personal data processed in accordance with the KVKK and the GPDL and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;
● in order to fulfill our legal obligations within the scope of the contracts between us for the purposes listed above, to authorized persons and official institutions in accordance with legal regulations and legislation; and
● your data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
If you request to create a gift card from the Starbucks website or mobile application, your identity (name, surname) and contact (mobile phone number, e-mail address) data will be collected and processed through the gift card creation form. Your personal data in question will be processed (with obtaining your prior consent);
● limited to the purposes of conducting goods/service sales processes, conducting contract processes, conducting goods/service production and operation processes, conducting communication activities, in accordance with the legal basis “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract”.
By complying with the rules in the KVKK and the GPDL and taking the necessary technical and administrative measures, only to the extent necessary for the realization of the relevant purpose, your data is transferred abroad by being saved in our programs and/or systems provided / made available for our use by our technological infrastructure suppliers located abroad, on the basis of appropriate data protection guarantees provided under an agreement concluded with the data recipient, as required by the GPDL.
In order to provide you with a better customer experience, your identity (name, surname, date of birth), contact (mobile phone number, e-mail address), and customer transaction (order information, membership-related information) data collected through membership pages on our website, online web forms, information systems, and electronic devices will be processed (with obtaining your prior consent);
● limited to the purposes of conducting marketing analysis studies, carrying out production and operation processes of goods/services, carrying out/auditing business activities, and carrying out sales processes of goods/services, in accordance with the legal bases “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” and “Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”.
In case you contact Starbucks through the contact information on the Starbucks website and the mobile application and submit your requests/complaints, your identity (name, surname), contact (mobile phone number, e-mail address), and customer transaction (request information) data that you have shared with us via phone calls, e-mail or written means will be processed (with obtaining your prior consent);
● limited to the purposes of receiving and evaluating suggestions for the improvement of business processes, carrying out after-sales support services for goods/services, carrying out customer relationship management processes, carrying out activities for customer satisfaction and following up requests/complaints, based on the legal basis “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract”.
If you submit your requests/complaints through Starbucks communication channels, your personal data will be processed for the abovementioned legal basis by complying with the rules in the KVKK and the GPDL and taking the necessary technical and administrative measures;
● your personal data may be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
Your identity (name, surname), contact (mobile phone number, e-mail address, billing and delivery addresses), and customer transaction (billing information, order information, product information, shipping information) data will be processed (with obtaining your prior consent);
● limited to the purposes of conducting activities in accordance with the legislation, conducting communication activities, conducting financial and accounting affairs, conducting contract processes, conducting/auditing business activities, conducting goods/service sales processes and providing information to authorized persons, institutions and organizations, based on the legal bases “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” and “It is mandatory for the data controller to fulfill its legal obligation”.
In the event that corporate sales are realized with Starbucks, your personal data processed in accordance with the rules in the KVKK and the GPDL and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;
● to authorized persons and official institutions in accordance with legal regulations and legislation in order to fulfill our legal obligation limited to the purposes listed above, and
● your data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
Your identity (name, surname) and customer transaction (billing information, order information, product information, QR code information, number of stars information) data will be processed (with obtaining your prior consent);
● limited to the purposes of conducting activities in accordance with the legislation, conducting financial and accounting affairs, conducting/auditing business activities, conducting goods/service sales processes and providing information to authorized persons, institutions and organizations, in accordance with the legal bases “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” and “It is mandatory for the data controller to fulfill its legal obligation”.
If you purchase products from Starbucks stores, your personal data processed in accordance with the rules in the KVKK and the GPDL and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;
● to authorized persons and official institutions in accordance with legal regulations and legislation in order to fulfill our legal obligation limited to the purposes listed above, and
● your data can be recorded in our programs and/or systems provided by our infrastructure suppliers in the field of technology / made available for our use.
Your identity (name, surname), contact (mobile phone number, e-mail address, billing and delivery addresses), and customer transaction (shopping information, number of stars information, order information) data within the scope of tracking orders received through online ordering applications and preparing reports on online sales will be processed (with obtaining your prior consent);
● limited to the purposes of execution of goods/service production and operation processes, execution of goods/service sales processes, execution of advertising/campaign/promotion processes and execution/audit of business activities, with the legal bases “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” and “Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”.
Your identity (name, surname), contact (social media username), and customer transaction (request information) data will be processed (with obtaining your prior consent);
● limited to the purposes of carrying out customer relationship management processes, carrying out activities for customer satisfaction, following up requests/complaints, receiving and evaluating suggestions for the improvement of business processes, in accordance with the legal basis “Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”.
In case you submit your requests/complaints via Starbucks social media accounts, your personal data will be processed in accordance with the rules in the KVKK and the GPDL and by taking the necessary technical and administrative measures, for the legal basis listed above;
● your personal data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
Your identity (name, surname), contact (mobile phone number, e-mail address), and visual and audio recordings (visual data) data will be processed (with obtaining your prior consent);
● limited to the purposes of organization and event management, execution of advertising/campaign/promotion processes, execution of activities for customer satisfaction, execution of company/product/service loyalty processes, in accordance with the legal basis “Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”.
If you participate in the special events organized by Starbucks, your personal data will be processed by complying with the rules in the KVKK and the GPDL and taking the necessary technical and administrative measures, for the legal bases listed above;
● your personal data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
In addition, your audiovisual data processed within the scope of the events organized may be publicly shared on Starbucks’ social media accounts for the purposes of organization and event management for the activities of the Starbucks brand, execution of advertising/campaign/promotion processes, execution of activities for customer satisfaction, execution of company/product/service loyalty processes, based on the above indicated legal bases.
Your identity (name, surname), contact (e-mail address, phone number), and customer transaction (commercial message confirmation information) data you have shared with Starbucks will be processed (with obtaining your prior consent);
● limited to the purposes of conducting marketing analysis studies, conducting advertising/campaign/promotion processes, conducting activities in accordance with the legislation and conducting marketing processes of products/services, based on the above indicated legal bases. Direct marketing communications will be carried out in accordance with the rules on direct marketing set out in the GPDL, and you may withdraw your consent to direct marketing at any time, free of charge, through a mechanism as simple as the one through which the consent was given. Your request will be fulfilled within 7 working days at the latest.
Your location data you have shared with Starbucks will be processed (with obtaining your prior consent);
● limited to the purposes of carrying out customer relationship management processes and carrying out activities for customer satisfaction, based on the above indicated legal bases.
Your personal data is transferred to our suppliers in accordance with the prior consent of the data subject, within the scope of the purposes listed above.
Your identity (name, surname, ID number), contact (mobile phone number, billing and delivery addresses, e-mail address), customer transaction (billing information, order information, product information, shipping information), transaction security (IP address information, website login and exit information, username information, password information, traffic data (connection time/duration, etc.)), and legal transaction (information in the case of dispute, information in the case file, dunning notices, information in correspondence with judicial and administrative authorities) data will be processed (with obtaining your prior consent);
● limited to the purposes of execution of information security processes, execution of activities in accordance with the legislation, follow-up and execution of legal affairs, execution/supervision of business activities and providing information to authorized persons, institutions and organizations, in accordance with the legal bases “It is clearly stipulated in the laws”, “It is mandatory for the data controller to fulfill its legal obligation”, and “Data processing is mandatory for the establishment, use or protection of a right”.
If you purchase products from Starbucks, your personal data processed in accordance with the rules in the KVKK and the GPDL and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;
● to authorized persons and official institutions and our suppliers from whom we receive legal consultancy support in accordance with legal regulations and legislation in order to fulfill our legal obligations, and
● your data may be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
In addition, by complying with the rules in the KVKK and the GPDL and taking the necessary technical and administrative measures, only to the extent necessary for the realization of the relevant purpose, your data is transferred abroad by being saved in our programs and/or systems provided / made available for our use by our infrastructure suppliers located abroad in the field of technology, on the basis of appropriate data protection guarantees provided under an agreement concluded with the data recipient, as required by the GPDL.
Under the GPDL, personal data may be transferred to another country or international organization where appropriate guarantees for the protection of personal data are provided in that country or by that organization, where the transfer is carried out on the basis of an agreement containing appropriate data protection guarantees, or where another ground for transfer set out in the GPDL applies (including your consent after being informed about the possible risks of the transfer). The Personal Data Protection Service of Georgia determines the list of countries with appropriate data protection guarantees. The Company takes the necessary technical and organizational measures for all such transfers.
Our Company has established a Storage and Destruction Policy for the storage and deletion of personal data. Storage and destruction procedures regarding your personal data are carried out within the scope of this policy. Accordingly, if a period of time is specified for the storage of data in the relevant laws and other relevant legislation, the data in question must be kept for at least this period. In accordance with the GPDL, your personal data is kept in a form allowing your identification for no longer than is necessary for the purpose for which it is processed.
Considering the possibilities such as the late receipt of a possible court request or the request of an administrative authority authorized by law regarding the relevant data, or the occurrence of a dispute to which we may be a party, the retention period of the data is determined by adding a period of 6 months to 1 year to the periods stipulated in the legislation for the storage of your data, and at the end of the specified period, the data in question is deleted, destroyed or anonymized (depersonalized).
If the legislation does not stipulate a period of time for the storage period of the data we process, your data will be deleted, destroyed or anonymized (depersonalized) without any need for your request after the expiration of the general statute of limitations applicable to our legal relationship under the relevant legislation, taking into account possible disputes as required by the relationship between us.
If all the conditions for processing personal data have disappeared, or the retention period declared by us or determined within the scope of the legislation has expired, your data will be deleted, destroyed or anonymized (depersonalized) ex officio on the first periodic destruction date or within 6 months at the latest. If you request the erasure or destruction of your data, your request will be fulfilled within 10 working days at the latest from receipt of the request, to the extent legally possible. If you request the deletion or destruction of your data, the retention period of which is determined in the legislation, your request in question will be realized after expiry of such statutorily established periods; however, processing of your personal data will be restricted immediately after receipt of your request.
Regarding your personal data within the scope of the GPDL and other relevant legislation, you have the right to, among others:
● Obtain confirmation as to whether or not your personal data is being processed by the Company,
● Receive information on the personal data processed about you, the purpose and legal basis of the processing, the data collection method, the categories of recipients to whom your data has been or may be disclosed, and the retention period of your data,
● Receive a copy of your personal data processed by the Company,
● Request the correction, updating or completion of your personal data if it is incomplete, inaccurate or not up to date,
● Request the erasure or destruction of your personal data, unless otherwise stipulated by the legislation,
● Request the restriction (blocking) of the processing of your personal data in the cases provided for by the GPDL,
● Request the termination of the processing of your personal data,
● Withdraw your consent at any time, without any justification, where the processing is based on your consent; withdrawal is free of charge and does not affect the lawfulness of processing carried out before the withdrawal,
● Object to direct marketing and request the termination of the use of your personal data for direct marketing purposes at any time,
● Request that the correction, erasure, destruction or restriction of your personal data be notified to the recipients to whom your data has been transferred,
● Not be subject to a decision based solely on automated processing, including profiling, which produces legal or other significant effects concerning you, except in the cases permitted by the GPDL,
● Lodge a complaint with the Personal Data Protection Service of Georgia or apply to the courts in case you believe your rights under the GPDL have been violated, and
● In case you suffer damage due to unlawful processing of personal data, demand compensation for this damage in accordance with the legislation.
You can submit your applications and requests regarding your personal data by using the data subject application form;
● By sending it to “Yamanevler Mah. Site Yolu Cd. Anel İş Merkezi No:5 Ümraniye, Istanbul, Türkiye” or “[Tbilisi office address to be inserted]”,
● By applying in person to Shaya Kahve Sanayi ve Ticaret Anonim Şirketi with a valid identity document,
● By sending it to our registered e-mail address shayakahve@hs02.kep.tr by using a registered electronic mail (KEP) address and secure electronic signature or mobile signature, or
● By sending it to our address starbucks-ge-app@alshaya.com from the e-mail address previously notified to Shaya Kahve Sanayi ve Ticaret Anonim Şirketi by the Data Subject and registered in our system.
The application of the Data Subject must include the name, surname, signature if the application is in writing, identification number (passport number if the applicant is a foreigner), residential or workplace address for notification, e-mail address for notification, telephone number, and information on the subject of the request.
The Data Subject must clearly and comprehensibly state the matter requested in the application, which will be made to exercise the rights mentioned above and includes explanations regarding the right he/she requests to exercise. Information and documents regarding the application must be attached to the application.
Although the subject of the request must be related to the applicant’s person, if acting on behalf of someone else, the applicant must be authorized and this authorization must be documented (power of attorney). If the application is within the scope of special category (sensitive) data, the applicant must be specifically authorized in accordance with the law. In addition, the application must include identity and address information, and identity-verifying documents must be attached to the application.
Requests made by unauthorized third parties on behalf of someone else will not be evaluated.
Your requests regarding your personal data will be evaluated and answered without undue delay and within 10 working days at the latest from the date the request reaches the Company, in accordance with the GPDL. Where necessary, taking into account the complexity and number of requests, this period may be extended by no more than 10 additional working days, in which case you will be informed of the extension and the reasons for it within the initial 10 working days. In the event that your application is rejected, the reasons for the reasoned rejection, as well as your right to lodge a complaint with the Personal Data Protection Service of Georgia and to apply to the courts, will be communicated to you through the procedure in which the request was made, within the same period.