Privacy Statement
This privacy statement (“Privacy Statement”) applies to partner data collected via the AP Forum & RBC (“App”).
In this Privacy Statement, the terms “Starbucks”, “we,” and “us” refer to Starbucks Coffee Asia Pacific Limited, a wholly owned subsidiary of Starbucks Corporation (d/b/a Starbucks Coffee Company).
This Privacy Statement sets out how we collect, use, disclose and otherwise process your personal data, including (where applicable) if we need to transfer and store your personal data outside of Hong Kong or the jurisdiction in which you live. If you do not live in Hong Kong, please also refer to the jurisdiction-specific terms set out in the Annex to this Privacy Statement.
Personal Data We Collect
As you use the App, we may collect certain personal data about you. We do this with your consent where required by applicable law.
The personal data we collect falls into two different categories: (1) personal data you give us and (2) personal data we collect from you automatically when you use the App.
Personal Data You Give Us
We collect certain personal data that you give us when you visit our App, create a user profile, upload photos, information, comments to the App, participate in our challenge activities, workshops, and questionnaire and/or other survey and/or otherwise visit or use the App.
The personal data that you give us may include:
- your first and/or last name, mobile number and your email address; and
- any other information you choose to give us via the App.
We will indicate where it is mandatory for us to collect certain personal data. If you do not provide such mandatory data, we may not be able to provide you with access to the App or certain services or information, or otherwise correspond with you or serve your needs. If you give us anyone else's personal data, you must first give them a copy of this Privacy Statement and ensure they consent to our processing of their personal data as described in this Privacy Statement.
Personal Data We Collect When You Use the App
When you use the App, we may collect information about the functionalities you use on the App and how you use them. We do this with your consent where required by applicable law. Specifically, when you use a computer, tablet, smart phone or other device to access the App, we may collect information about the device and how you use it. This information may include the type of device, your operating system, your browser (for example, whether you used Internet Explorer, Firefox, Safari, Chrome or another browser), your internet service provider, your domain name, your internet protocol (IP) address, your device identifier (or UDID), the date and time that you accessed our service, the site that referred you to our App, the web pages you requested, and the date and time of those requests.
To collect this information, we use cookies and similar technologies (see "Cookies" below).
How We Use Your Personal Data
We may use your personal data (with your consent, where required by applicable law) as follows:
- to process and administer your registration and account with us on the App;
- to provide the App and relevant services, including creating a user profile and sharing it with other users, using or providing certain AI services/tools via the App;
- to communicate with you, and to respond to your inquiries and requests for information;
- to conduct user-related statistical evaluation and record keeping;
- to perform aggregated analytics to improve the user and partner experience;
- to maintain and improve the App;
- to detect, prevent, or investigate security breaches or fraud;
- to maintain appropriate records for internal administrative purposes;
- to administer the redemption of coffee coupons dedicated to the event;
- to update, monitor and verify the attendance status of registered attendees;
- to organize and manage forums, workshops, competitions, and related event activities;
- to document event activities and maintain records for archiving and reference purposes;
- to distribute assigned schedules for attendees participating in workshops, forums, and competitions;
- to provide a social platform or community channel for communications and engagement among attendees during the event;
- to establish or exercise legal claims for, or handle, defend or resolve requests, complaints, investigations, claims or disputes against or involving, Starbucks or our affiliates or licensees, and to protect the rights, property, or safety of Starbucks or our customers or partners or other users of the App; and
- to otherwise manage our business.
How We Share Your Personal Data
We may share your personal data (with your consent, where required by applicable law) in the following circumstances:
- When We Work Together – We may share personal data with our affiliates and licensees and their respective affiliates for proper management, analysis and decision making.
- When We Work with Service Providers – We may share personal data with service providers that provide us with support services including but not limited to providers of IT and AI services and tools such as those providing applicant management, skills and background analysis; employment administration; and to communicate with you. We put in place reasonable contractual safeguards OR technical and organisational measures with these service providers to protect your personal data.
- When We Work on Business Transactions – If we become involved with a merger, acquisition or another situation involving the transfer of some or all of our business assets, we may share your personal data with potential acquirers or other business entities or people involved in the negotiation or transfer.
- When Sharing Helps Us Protect Lawful Interests – We may disclose your personal data if required by applicable laws or regulations or orders or requests of courts, regulators or government authorities (in any relevant jurisdiction) or to establish or exercise legal claims for, or handle, defend or resolve requests, complaints, investigations, claims or disputes against or involving, Starbucks or our affiliates or licensees, or to enforce our agreements or policies, or to protect the rights, property, or safety of Starbucks or our customers or partners or other users of the App.
- When You Give Consent – We may share your personal data with other organisations if you give us permission or direct us to share the information.
We may also share certain anonymized or aggregated information we collect via the App and our services (i.e. not personal data) in certain circumstances.
International Personal Data Transfers
In order to provide the App and related services, your personal data may be accessed, transferred, stored and/or otherwise processed at locations outside of Hong Kong or the jurisdiction in which you live, including without limitation, Singapore and the United States of America.
There may not be in place data protection laws which provide a comparable level of protection to that under the data protection law of Hong Kong or the jurisdiction in which you live. In such circumstances, we take reasonable steps to put in place appropriate measures (such as contractual safeguards) to protect your personal data.
Security of Your Personal Data
Please keep your user name and password secure.
We take reasonable steps to protect your personal data in accordance with applicable data protection law and this Privacy Statement.
We do this by using reasonable and appropriate technical and organisational measures to reduce the risk of loss, misuse, unauthorized access, disclosure or modification of your personal data.
Nonetheless, no system or network can be guaranteed to be 100% secure.
Use by Minors
We do not intend for the App or our related services to be used by anyone under the age of 18 (a “minor”). If you believe we may have collected information about a minor, please contact us as described in the “Contact Us” section below.
Cookies and Similar Technologies
We may use a variety of technologies to collect information about your device and use of the App and related services. Some of this information may constitute your personal data. To do this, we may deploy cookies.
Cookies are small data files that are sent from a App’s server and are stored on your device’s hard drive either for only the duration of your visit (“session cookies") or for a fixed period of time (“persistent cookies"). Cookies contain information that can later be read by a web server.
We mainly use cookies for the following purposes:
- WebApp Functionality – Some cookies (considered "strictly necessary") are required to allow you to access and use the App. Without these cookies, the App will not work properly.
- Performance Monitoring – Some cookies (considered "performance" cookies) help us analyze and estimate traffic on the App. They show us how visitors interact with the App, whether there are any errors, which pages are not used often, which pages take a long time to load, which pages users tend to visit and in what order. These cookies do not collect any information that could identify you and are only used to help us improve how the App works and understand user interests.
- User Convenience – Some cookies (considered "functionality" cookies) remember information to save you the trouble of entering information every time you visit or use a particular App. For example, a cookie may remember your username to save you time when you log in to your account on the App.
Most web browsers automatically accept cookies, but you can change your browser settings to give you the choice to accept a cookie or reject cookies altogether. For more information about changing your browser settings, please see the section of this Privacy Statement titled, "Your Choices.”
Your Choices
You can make choices about certain personal data we may collect about you:
- Location Information – When you use a smart phone or other mobile device to access the App, we may collect information about your physical location only if (a) “location services" for the mobile application is enabled; or (b) the permissions in the mobile device allow communication of this information. If you do not want us to collect your location information, you can opt out of sharing this information by changing the relevant preferences and permissions in your mobile device.
- Cookies – If you want to reject cookies, you must take action to select the appropriate settings in your browser. Each browser’s cookie control is a little different, but the most common browsers (Internet Explorer, Chrome, Firefox, and Safari) have a preference or option you can select so the browser notifies you if the App wants to set a cookie, and typically provides an option to accept or reject the cookie before the cookie is set. However, if you choose to remove or reject cookies, it may affect many features or services on the App. If you want to learn more about how to modify your cookie settings, please use the Help menu in your browser. For additional information about cookies, including how to refuse cookies, you can also visit: www.allaboutcookies.org.
- "Do Not Track" Technology – Some newer web browsers have a “Do Not Track" preference that transmits a “Do Not Track" header to the Apps you visit with information indicating that you do not want your activity to be tracked. We currently do not respond to browser “Do Not Track" signals.
Your Rights
You may have certain rights as regards your personal data, subject to applicable data protection law. These will vary depending on applicable data protection law, but may include:
- Accessing Your Personal Data – You may have the right to request access to your personal data and/or information about how we have processed your personal data.
- Correcting Your Personal Data – You may have the right to request us to correct your personal data.
- Withdrawing Your Consent – Where we have relied on your consent to process your personal data, you may have the right to withdraw your consent to our processing of your personal data (and this would be with no effect on the lawfulness of such processing before the withdrawal).
- Transmitting your Personal Data – You may have the right, where legally entitled to do so, to request us to transmit your personal data to another organisation in a commonly used machine-readable format.
To exercise your rights, please refer to the “Contact Us” section below. We may be entitled to charge a fee to process your request in accordance with applicable law.
Changes to This Privacy Statement
This Privacy Statement went into effect on the date noted at the top of this webpage. We may update this Privacy Statement from time to time, and we will post the updated Privacy Statement on this page and change the date at the top of this webpage. We encourage you to look for updates and changes to this Privacy Statement by regularly visiting this webpage and checking this date at the top of this webpage. We will notify you of any modifications to this Privacy Statement that might materially affect the way we use or disclose your personal data prior to the change becoming effective by means of a message on this webApp where required by law or where we consider it appropriate, and will obtain your consent to such changes where required to do so by applicable law.
Contact Us
We welcome your questions and comments about personal data protection. You can contact us through APForum@starbucks.com.
ANNEX: JURISDICTION-SPECIFIC PROVISIONS
These provisions supplement and/or modify (as applicable) the general provisions set out in the main body of this Privacy Statement. To the extent a conflict exists, the provisions prevail over the conflicting provision(s) of this Privacy Statement.
Japan
If you are located in Japan, the Act on the Protection of Personal Information (the “APPI”) will apply in all circumstances, and the sharing of your personal data with our affiliates and licensees and their respective affiliates is subject to the following joint use notice: We may jointly use your personal data with our affiliates and licenses in accordance with the joint use provision set forth in Article 27 Paragraph 5 Item 3 of the APPI, for the purpose described in the "How We Use Your Personal Data" section. The data to be shared with our affiliates and licensees is as specified in the "Personal Data We Collect" section. Starbucks Coffee Asia Pacific Limited (12th Floor. BEA Tower, Millennium City 5, 418 Kwun Tong Road, Kwun Tong, Kowloon, Hong Kong) will be responsible for managing your personal data.
Malaysia
If you reside in Malaysia, the following provisions apply:
International Personal Data Transfers
In order to provide the App and related services, your personal data may be accessed, transferred, stored and/or otherwise processed at locations outside of Hong Kong or the jurisdiction in which you live, including without limitation Singapore and the United States of America. Such transfers may be made to the following classes of third parties, to the extent necessary for the purposes described above: group companies; and service providers including Pico International (HK) Limited. You understand and consent to the international transfer of your Personal Data as described herein.
Retention
The Company processes your personal data only for as long as necessary to fulfil the purposes stated above, and thereafter for as long as we are required to do so under the relevant statutory limitation periods, applicable laws and regulations, as well as our internal policies. Where the personal data is no longer required for purposes stated above or relevant legal requirements, we will delete the personal data.
Australia
If you reside in Australia, the following provisions apply:
International Personal Data Transfers
In order to provide the App and related services, your personal data may be accessed, transferred, stored and/or otherwise processed at locations outside of Australia, including Hong Kong, Singapore, the United States of America.
Security of Your Personal Data
We store most information about you in computer systems and databases operated by us or our external services providers. Some information about you is recorded in paper files that we store securely.
Your Rights and Complaints
The rights of access and correction are available to individuals in Australia, as detailed in the main body of this Privacy Statement. In addition, if you have a complaint about the way in which we have handled any privacy issue, including the exercise of any of your data subject rights, you should contact us. We will consider your complaint and determine whether it requires further investigation. We will notify you of the outcome of this investigation and any subsequent internal investigation. You may also approach an independent advisor or contact the data protection authority in your jurisdictions for guidance on alternative courses of action which may be available.
To exercise your rights, please refer to the ‘Contact Us” section above. Other than in respect of personal data correction requests, we may be entitled to charge a reasonable fee to process your request in accordance with applicable law.
Taiwan
If you reside in Taiwan, the following provisions apply:
Under the Taiwan Personal Data Protection Act (the "PDPA"), you have the following rights:
- to make an inquiry of and to review your personal data;
- to request a copy of your personal data;
- to supplement or correct your personal data;
- to demand the cessation of the collection, processing, or use of your personal data; and
- to delete your personal data.
To exercise your rights above, please contact us by sending a request using the contact information specified in this Privacy Statement.
Indonesia
If you reside in the Republic of Indonesia or if your Personal Information is processed in Indonesia (e.g. when you use our services or interact with our affiliated companies in Indonesia), the following provisions apply:
Your Rights
Under the Indonesia personal data protection law, in addition to those rights detailed in the "Your Rights" section of the main body of this Privacy Statement, you may also have the following rights:
- right to be informed;
- right to erasure;
- right to object/lodge a complaint against automated decision making;
- restriction of processing; and
- right to file a claim and receive indemnity.
International Personal Data Transfer
When your personal data is transferred to a country that may not be considered by Indonesia’s relevant authority to provide adequate protection to personal data, we will apply appropriate safeguards to provide adequate level of binding personal data protection, or if applicable, obtain your consent before such a transfer.
Storing And Holding Your Personal Data
As a general rule, we will keep and process your personal data for as long as is strictly necessary to fulfil the purposes stated above, except if otherwise provided under the prevailing laws and regulations, for instance where we are required to do so in accordance with legal, tax and accounting requirements, or if required to do so by a legal process, legal authority, or other governmental entity having authority to make the request, for so long as required.
Language
When this Privacy Statement is translated into, or appear in a language other than English (as may be required to be prepared and executed to be in compliance with applicable local language laws which a partner/party may be subjected to), the English language version shall control.
Laos
If you reside in Laos, the following provisions apply:
Your Rights
In addition to the rights set out in the "Your Rights" section of the main body of this Privacy Statement, you may also have the following rights under the Law on Electronic Data Protection No. 25/NA:
- right to erasure; and
- right to stop the data transfer.
Vietnam
If you reside in Vietnam, the following provisions apply:
Processing of Sensitive Personal Data
The personal data we collect and process as described in the “Personal Data We Collect” section may include your sensitive personal data, including but not limited to information about the functionalities you use on the App and how you use them.
Your Additional Rights and Obligations
In addition to the rights set out in the “Your Rights” section, as a data subject, you have the following rights, unless otherwise provided by Vietnamese law from time to time:
- be informed of the processing of your personal data;
- consent or not consent to the processing of your personal data;
- request provision, erasure, restriction of the processing of personal data; submit requests to object to the processing of your personal data;
- make complaints, denunciations, initiate lawsuits, and request compensation for damages in accordance with the applicable law; and
- request competent authorities or agencies, organizations, and individuals related to the processing of personal data to implement measures and solutions to protect your personal data in accordance with the applicable law.
You also have the obligation to:
- protect your own personal data;
- honor and protect the personal data of others;
- provide adequate and accurate personal data according to applicable laws and regulations, contracts, or consent given to the processing of their own personal data; and
- comply with the law on personal data protection and participate in preventing and combating personal data infringement.
Thailand
If you reside in Thailand, the following provisions apply:
Retention of Personal Data
We retain your personal data for as long as necessary for the purposes of processing, unless otherwise required or permitted by applicable law.
Use by Minors
We do not intend for the App or our related services to be used by anyone under the age of 20 (a “minor”). If you believe we may have collected information about a minor, please contact us as described in the “Contact Us” section.
Your Rights
In addition to the general provisions, you also have the following rights with respect to your personal data:
- Obtaining Copy of Your Personal Data – You may have the right to obtain a copy of your personal data which is under our responsibility, and to request to disclose the source(s) of your personal data which has been obtained without your consent.
- Deleting Your Personal Data – In certain circumstances, you may request to delete, destroy or de-identify your personal data.
- Objection to the Processing of Your Personal Data – In certain circumstances, you may request to object the processing of your personal data.
- Restriction to the Processing of Your Personal Data – In certain circumstances, you may request us to restrict the use of your personal data.
In addition to the rights above, you also have the right to file a complaint in relation to our processing of your personal data with the Personal Data Protection Committee, in accordance with the procedures set out in the Personal Data Protection Act B.E. 2562 (2019) (PDPA). However, we kindly request that you reach out to us first in case of any concerns so that we can effectively address your issue in a timely manner.
We reserve the right not to comply with your request if this is appropriate, and as permitted by applicable laws.
Philippines
If you reside in the Philippines, the following provisions apply:
Your Rights
In addition to the rights enumerated above, you also have the following rights under the Data Privacy Act of 2012 (Republic Act No. 10175):
- Being Informed of the Processing of Your Personal Data – You have the right to be informed whether your personal data shall be, are being, or have been processed, including the existence of automated decision-making and profiling.
- Objecting to the Processing of Your Personal Data – You have the right to object to the processing of your personal data.
- Erasing Your Personal Data – You have the right to request us to delete your personal data.
- Right to Damages – You have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data.
- Right to File a Complaint – You have the right to lodge a complaint with the National Privacy Commission if you feel that your personal data have been misused, maliciously disclosed, or improperly disposed, or that any of your data privacy rights have been violated.
- Right to Data Portability – You have the right to obtain from us a copy of your personal data and / or have the same transmitted to another personal information controller.
Retention of Your Personal Data
We retain your personal data for as long as necessary for the purposes of processing, unless otherwise required or permitted by applicable law.
South Korea
If you reside in South Korea, the following provisions apply:
Personal Data We Collect
We collect your personal data for the purposes described in “How We Use Your Personal Data” in the Privacy Statement.
| Legal Basis |
Items of Personal Data to be Processed |
|---|---|
| Based on consent: we use this information pursuant to your consent, pursuant to Article 15(1)(1) of the PIPA. | First name, last name, mobile number, email address |
| For compliance with legal obligations: we use this information where necessary to comply with a legal obligation pursuant to Article 15(1)(2) of the PIPA. | N/A |
| For contractual necessity: we use this information where necessary to perform the contract with you to provide our Services, pursuant to Article 15(1)(4) of PIPA. | N/A |
Retention of Personal Data
We will retain your personal data until deletion of your account. However, where personal data is required to be retained pursuant to applicable laws and regulations, we will retain personal data for the relevant period.
Provided below are examples where we are required to retain your personal data pursuant to applicable laws and regulations:
-
Records on transactions, such as labeling and advertising, terms and
conditions of contracts and their performance pursuant to Article 6
(Preservation, etc. of Transaction Records) of the Act on the
Consumer Protection in Electronic Commerce, Etc.
- Records of cancellation of contract or offer, payment, supply of goods, etc.: Five (5) years
- Records on the settlement of consumer complaints or disputes: Three (3) years
- Records on labeling and advertising: Six (6) months
-
Article 85-3 of the Framework Act on National Tax (Record and
Preservation of Books, etc.)
- Books and evidentiary documents concerning all transactions prescribed by tax laws: Five (5) years
-
Article 22 of the Electronic Financial Transactions Act (Creation,
Preservation and Destruction of Electronic Financial Transaction
Records)
- Records on electronic financial transactions: Five (5) years
Destruction of Personal Data
We will select personal data whose retention period has expired and destroy such information in accordance with applicable laws and our policies. When deleting your personal data, we will take reasonable and technically feasible measures to ensure that personal data is irrecoverable. For example, electronic files which contain personal data will be deleted permanently using a technical method which makes the files irrecoverable and any other records, print-outs, documents or any other recording media will be shredded or incinerated.
Delegation of Personal Data Processing
We delegate your personal data processing as follows:
| Delegatee | Delegated Work |
|---|---|
| Pico International (HK) Limited | Mobile app development and support services |
Third-Party Provision of Personal Data
Pursuant to Article 17(1)1 of the PIPA, we provide your personal data to third parties as follows:
| Recipient | Items of Personal data to be provided | Purpose for which recipient will use Personal data | Period of retention and use by the recipient |
|---|---|---|---|
| Starbucks Coffee Asia Pacific Limited; Starbucks Corporation; Pico International (HK) Limited | First name, last name, mobile number, email address | Process and administer your registration and account; provide services through the app including user profile creation and sharing | Until deletion of your account |
Overseas Collection of Personal Data
We collect and process personal data from overseas.
- Regions where personal data is collected and processed: Hong Kong, Singapore, and the United States of America
Overseas Transfer of Personal Data
We transfer personal data to third parties overseas as follows. If you wish to refuse a transfer of your personal data overseas, please submit such request through the following contact information. Please note, however, that you may experience disadvantages in App’s registration as a result of such refusal.
| Recipient (Contact Information) | Region to which personal data is to be transferred | Date and Method of Transfer | Items of personal data | Purposes of Use by Recipients | Period of Retention of Use by Recipient | Legal Basis for Overseas Transfer |
|---|---|---|---|---|---|---|
| Starbucks Coffee Asia Pacific Limited; Starbucks Corporation; Pico International (HK) Limited | Hong Kong, Singapore, U.S. | Via online network upon collection | First name, last name, mobile, email address | Process and administer your registration and account; for provide services through the app including user profile creation and sharing | Until deletion of your account | Article 28-8(1)1 (Consent of Data Subject) of the PIPA |
Changes
We may update this South Korea Addendum from time to time at our discretion, but where required by applicable law or regulations, we will provide you with notice of such changes and seek your consent.