SHAYA KAHVE SANAYİ VE TİCARET A.Ş.
STARBUCKS CUSTOMER PRIVACY POLICY
Data Controller: Shaya Kahve Sanayi ve Ticaret Anonim Şirketi ("Shaya Kahve" or the "Company") test
As Shaya Kahve, we attach great importance to the processing and protection of your personal data. This Privacy Policy has been prepared in accordance with Law No. 6698 on the Protection of Personal Data ("KVKK") and related legislation and legal regulations, in order to ensure that you are informed about the personal data processed and transferred during the provision and development of various services.
In addition, you can access detailed information on the processing of your personal data obtained automatically through the cookies used on the Starbucks website, the types of cookies used, and your preference management regarding these cookies from the Cookie Privacy Notice.
You can shop at Starbucks stores by registering as a member on Shaya Kahve's website https://www.starbucks.com.tr/ or our mobile application.
Your identity (name, surname, date of birth), contact (mobile phone number, billing and delivery address, e-mail address), customer transaction (personalized campaign information, collected points information, star invitation code), and audiovisual records (visual data) data will be processed;
● limited to the purposes of conducting customer relationship management processes, conducting activities for customer satisfaction, conducting contract processes, following up requests/complaints, conducting communication activities, conducting after-sales support services for goods/services, conducting sales processes for goods/services, in accordance with the legal basis stated in subparagraph (c) of paragraph 2 of Article 5 of the Law "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract".
Your personal data is transferred abroad due to our use of technological infrastructure suppliers located abroad, only to the extent necessary for the realization of the relevant purpose, by complying with the rules in Article 9 of the KVKK titled “Transfer of Personal Data Abroad” and by taking the necessary technical and administrative measures; and in accordance with the legal basis of “signing a standard contract”.
In case of receiving support regarding the goods and services offered by Starbucks, your identity (name, surname), contact (phone number, e-mail address), customer transaction (shopping information, store information, number of stars), audiovisual recording (call center voice recordings) data will be processed;
● limited to the purposes of conducting customer relationship management processes, conducting activities for customer satisfaction, tracking requests / complaints, conducting communication activities, receiving and evaluating suggestions for the improvement of business processes, in accordance with the legal bases stated in the subparagraph (c) of paragraph 2 of Article 5 of the Law "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and subparagraph (f) "It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject".
In the event that you submit your complaints and requests to Starbucks, your personal data processed in accordance with the rules in Article 8 of the KVKK titled "Transfer of Personal Data" and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;
● in order to fulfill our legal obligations within the scope of the contracts between us for the purposes listed above, it can be transferred to authorized persons and official institutions in accordance with legal regulations and legislation; and
● your data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
If you request to create a gift card from Starbucks website or mobile application, your identity (name, surname) and contact (mobile phone number, e-mail address) data will be collected and processed through the gift card creation form. Your personal data in question will be processed;
● limited to the purposes of conducting goods / service sales processes, conducting contract processes, conducting goods / service production and operation processes, conducting communication activities, in accordance with the legal basis stated in subparagraph (c) of paragraph 2 of Article 5 of the Law "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract".
By complying with the rules in Article 9 of the KVKK titled "Transfer of Personal Data Abroad" and taking the necessary technical and administrative measures, only to the extent necessary for the realization of the relevant purpose; In accordance with the legal basis of "signing a standard contract", it is transferred abroad by saving it in our programs and / or systems provided / made available to our use by our technological infrastructure suppliers located abroad.
In order to provide you with a better customer experience, your identity (name, surname, date of birth), contact (mobile phone number, e-mail address), and customer transaction (order information, membership-related information) data collected through membership pages on our website, online web forms, information systems, and electronic devices will be processed;
● limited to the purposes of conducting marketing analysis studies, carrying out production and operation processes of goods/services, carrying out/auditing business activities, and carrying out sales processes of goods/services, in accordance with the legal basis stated in subparagraph (c) of paragraph 2 of Article 5 of the KVKK, “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” and subparagraph (f) “Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”.
In case you contact Starbucks through the contact information on the Starbucks website and the mobile application and submit your requests / complaints; your identity (name, surname), contact (mobile phone number, e-mail address) and customer transaction (request information) data that you have shared with us via phone calls, e-mail or written means will be processed;
● limited to the purposes of receiving and evaluating suggestions for the improvement of business processes, carrying out after-sales support services for goods/services, carrying out customer relationship management processes, carrying out activities for customer satisfaction and following up requests/complaints, based on the legal basis stated in subparagraph (c) of paragraph 2 of Article 5 of the KVKK "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract".
If you submit your requests/complaints through Starbucks communication channels, your personal data will be processed for the abovementioned legal basis by complying with the rules in Article 8 of the KVKK titled "Transfer of Personal Data" and taking the necessary technical and administrative measures;
● your personal data may be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
Your identity (name, surname), contact (mobile phone number, e-mail address, billing and delivery addresses) and customer transaction (billing information, order information, product information, shipping information) data will be processed;
● limited to the purposes of conducting activities in accordance with the legislation, conducting communication activities, conducting financial and accounting affairs, conducting contract processes, conducting / auditing business activities, conducting goods / service sales processes and providing information to authorized persons, institutions and organizations based on the legal bases stated in subparagraph (c) of paragraph 2 of Article 5 of the KVKK "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and subparagraph (ç) "It is mandatory for the data controller to fulfill its legal obligation".
In the event that corporate sales are realized with Starbucks, your personal data processed in accordance with the rules in Article 8 of the KVKK titled "Transfer of Personal Data" and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;
● to authorized persons and official institutions in accordance with legal regulations and legislation in order to fulfill our legal obligation limited to the purposes listed above, and
● your data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
Your identity (name, surname) and customer transaction (billing information, order information, product information, QR code information, number of stars information) data will be processed;
● limited to the purposes of conducting activities in accordance with the legislation, conducting financial and accounting affairs, conducting / auditing business activities, conducting goods / service sales processes and providing information to authorized persons, institutions and organizations, in accordance with the legal bases of subparagraph (c) of paragraph 2 of Article 5 of the Law "Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract" and subparagraph (ç) "It is mandatory for the data controller to fulfill its legal obligation".
If you purchase products from Starbucks stores, your personal data processed in accordance with the rules in Article 8 of the KVKK titled "Transfer of Personal Data" and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;
● to authorized persons and official institutions in accordance with legal regulations and legislation in order to fulfill our legal obligation limited to the purposes listed above, and
● your data can be recorded in our programs and/or systems provided by our infrastructure suppliers in the field of technology / made available for our use.
Your identity (name, surname), contact (mobile phone number, e-mail address, billing and delivery addresses) and customer transaction (shopping information, number of stars information, order information) data within the scope of tracking orders received through online ordering applications and preparing reports on online sales will be processed;
● limited for the purposes of execution of goods/service production and operation processes, execution of goods/service sales processes, execution of advertising/campaign/promotion processes and execution/audit of business activities with the legal bases stated in subparagraph (c) of paragraph 2 of Article 5 of the KVKK "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and subparagraph (f) "It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject".
Your identity (name, surname), contact (social media username) and customer transaction (request information) data will be processed;
● limited for the purposes of carrying out customer relationship management processes, carrying out activities for customer satisfaction, following up requests / complaints, receiving and evaluating suggestions for the improvement of business processes in accordance with the legal basis stated in subparagraph (f) of paragraph 2 of Article 5 of the KVKK "It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject".
In case you submit your requests/complaints via Starbucks social media accounts, your personal data processed will be processed in accordance with the rules in Article 8 of the KVKK titled "Transfer of Personal Data" and by taking the necessary technical and administrative measures, for the legal basis listed above;
● your personal data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
Your identity (name, surname), contact (mobile phone number, e-mail address) and visual and audio recordings (visual data) data will be processed;
● limited for the purposes of organization and event management, execution of advertising / campaign / promotion processes, execution of activities for customer satisfaction, execution of company / product / service loyalty processes, in accordance with the legal bases stated in paragraph 1 of Article 5 of the KVKK "Explicit consent of the data subject" and subparagraph (f) of paragraph 2 of Article 5 of the KVKK "Provided that it does not harm the fundamental rights and freedoms of the data subject, data processing is mandatory for the legitimate interests of the data controller".
If you participate in the special events organized by Starbucks, your personal data will be processed by complying with the rules in Article 8 of the KVKK titled "Transfer of Personal Data" and taking the necessary technical and administrative measures, for the legal bases listed above;
● your personal data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
In addition, your audiovisual data processed within the scope of the events organized may be publicly shared on Starbucks' social media accounts for the purposes of organization and event management for the activities of the Starbucks brand, execution of advertising / campaign / promotion processes, execution of activities for customer satisfaction, execution of company / product / service loyalty processes, based on the legal basis "Explicit consent of the data subject".
Your identity (name, surname), contact (e-mail address, phone number) and customer transaction (commercial message confirmation information) data you have shared with Starbucks will be processed;
● limited to the purposes of conducting marketing analysis studies, conducting advertising / campaign / promotion processes, conducting activities in accordance with the legislation and conducting marketing processes of products / services, based on the legal basis stated in paragraph 1 of Article 5 of the KVKK "explicit consent of the data subject".
In addition; if you give commercial message consent, your identity (name, surname) and contact (e-mail address, phone number) data will be processed based on the commercial electronic message consent requirement pursuant to Article 6 of the Law No. 6563 and the explicit consent legal basis pursuant to paragraph 1 of Article 5 of the KVKK, limited to the activity of sending electronic commercial messages for the purpose of sending electronic commercial messages through the channels you have given consent, including instant/text message, telephone, e-mail, to be used by Starbucks for marketing communication. For detailed information on the electronic commercial messages, you can review the Commercial Electronic Message Privacy Notice.
Your identity (name, surname, Republic of Türkiye ID number), contact (mobile phone number, billing and delivery addresses, e-mail address), customer transaction (billing information, order information, product information, shipping information), transaction security (IP address information, website login and exit information, username information, password information, traffic data (connection time / duration, etc.) and legal transaction (information in the case of dispute, information in the case file, dunning notices, information in correspondence with judicial and administrative authorities) data will be processed;
● limited to the purposes of execution of information security processes, execution of activities in accordance with the legislation, follow-up and execution of legal affairs, execution / supervision of business activities and providing information to authorized persons, institutions and organizations, in accordance with the legal bases of subparagraph (a) of paragraph 2 of Article 5 of the Law "It is clearly stipulated in the laws", subparagraph (ç) "It is mandatory for the data controller to fulfill its legal obligation", and subparagraph (e) "Data processing is mandatory for the establishment, use or protection of a right".
If you purchase products from Starbucks, your personal data processed in accordance with the rules in Article 8 of the KVKK titled "Transfer of Personal Data" and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;
● to authorized persons and official institutions and our suppliers from whom we receive legal consultancy support in accordance with legal regulations and legislation in order to fulfill our legal obligations, and
● your data may be recorded in our programs and/or systems provided by our technological infrastructure suppliers.
In addition, by complying with the rules in Article 9 of the KVKK titled "Transfer of Personal Data Abroad" and taking the necessary technical and administrative measures, only to the extent necessary for the realization of the relevant purpose; In accordance with the legal basis of "signing a standard contract", it is transferred abroad by saving it in our programs and / or systems provided / made available to our use by our infrastructure suppliers located abroad in the field of technology.
Our Company has established a Storage and Destruction Policy for the storage and deletion of personal data. Storage and destruction procedures regarding your personal data are carried out within the scope of this policy. Accordingly, if a period of time is specified for the storage of data in the KVKK or in the relevant laws and other relevant legislation, the data in question must be kept for at least this period.
Considering the possibilities such as the late receipt of a possible court request or the request of an administrative authority authorized by law regarding the relevant data or the occurrence of a dispute to which we may be a party, the retention period of the data is determined by adding a period of 6 months to 1 year to the periods stipulated in the legislation for the storage of your data, and at the end of the specified period, the data in question are deleted, destroyed or anonymized.
If the legislation does not stipulate a period of time for the storage period of the data we process, your data will be deleted, destroyed or anonymized without any need for your request after the expiration of the 10-year statute of limitations from the termination of our legal relationship, taking into account possible disputes as required by the relationship between us.
If all the conditions for processing personal data have disappeared or the retention period declared by us or determined within the scope of the legislation has expired, your data will be deleted, destroyed or anonymized ex officio on the first periodic destruction date or within 6 months at the latest. If you request the deletion of your data for a valid reason, your data will be deleted within 30 days at the latest to the extent legally possible. If you request the deletion or destruction of your data, the retention period of which is determined in the legislation, before the prescribed periods, your request in question will not be realized.
Regarding your personal data within the scope of KVKK and relevant legislation you may request;
● Learning whether your personal data is being processed,
● Learning whether your personal data has been processed,
● To learn the purpose of processing personal data and whether they are used for their intended purpose,
● To know the third parties to whom your personal data is transferred domestically or abroad,
● To request correction of your personal data in case of incomplete or incorrect processing,
● To request the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK legislation,
● When you request the correction of incomplete or incorrect data and the deletion or destruction of your personal data, to request that this situation be notified to third parties to whom we transfer your personal data
● To object to the occurrence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems, and
● In case you suffer damage due to unlawful processing of personal data, to demand the compensation of this damage.
You can submit your applications and requests regarding your personal data by using the data subject application form;
● By sending it to "Saray Mah. Siteyolu Cad. No: 5/4 Ümraniye / Istanbul" address,
● By applying in person to Shaya Kahve Sanayi ve Ticaret Anonim Şirketi with a valid identity document,
● By sending it to our registered e-mail address shayakahve@hs02.kep.tr by using a registered electronic mail (KEP) address and secure electronic signature or mobile signature,
● By sending to our address info-tr@alshaya.com from the e-mail address previously notified to Shaya Kahve Sanayi ve Ticaret Anonim Şirketi by the Data Subject and registered in our system
You can forward it to Shaya Kahve Sanayi ve Ticaret Anonim Şirketi.
Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, the application of the Data Subject must include the name, surname, signature if the application is in writing, Republic of Türkiye identification number, (passport number if the applicant is a foreigner), residential or workplace address for notification, e-mail address for notification, telephone number and fax number, and information on the subject of the request.
The Data Subject must clearly and comprehensibly state the matter requested in the application, which will be made to exercise the rights mentioned above and includes explanations regarding the right he/she requests to exercise. Information and documents regarding the application must be attached to the application.
Although the subject of the request must be related to the applicant's person, if acting on behalf of someone else, the applicant must be authorized and this authorization must be documented (power of attorney). If the application is within the scope of sensitive data, the applicant must be specifically authorized in accordance with Article 10 of the Regulation on Personal Health Data. In addition, the application must include identity and address information and identity-verifying documents must be attached to the application.
Requests made by unauthorized third parties on behalf of someone else will not be evaluated.
Your requests regarding your personal data will be evaluated and answered within 30 days at the latest from the date it reaches the relevant department. In the event that your application is evaluated negatively, the reasons for the reasoned rejection will be communicated to you via e-mail or postal mail to the address you specified in the application, if possible, through the procedure in which the request was made.