Privacy Policy
Date of last amendment: 01.09.2018
1. Copyright
AmRest Coffee S.R.L., based in Grigore Cobălcescu Str. 46, 2nd floor, Room 11, Sector 1, Bucharest, having unique registration code 20119287, registered at the Trade Register under No. J40/21510/2006, as author, owner, administrator of the site www.starbucksromania.ro (hereinafter referred to as “the Site”) collects and processes personal data, according to the legal provisions regarding the processing of personal data and free circulation of these data.
This policy aims at informing you about the information we collect about you as a Site user (hereinafter referred to as the "User"), the way we use (process) it, and your choices with reference to such data.
This policy applies to all devices used for the purpose of accessing the www.starbucksromania.ro website, such as and without limitation to, smartphones, and tablet devices, laptops, smartwatches, and any other device with an internet connection that allows remote access to the Site. AmRest Coffee S.R.L. holds all copyrights to all content which the Company places on the website, people accessing the Site having no right over the content, including, without limitation, the reproduction, copying, distribution, modification, etc.
If you do not agree to the terms and conditions related to their use (shown in this document from the point of view of the protection of personal data but also in the rest of the documents on the website from the point of view of confidential information, etc.), please do not use the www.starbucksromania.ro website.
2. Amendments to this policy
This policy entered into force at Company level on the date indicated at the top of this web page. To the extent we consider it necessary this policy can be amended from time to time. When we make changes, the updated policy will be published on this page, indicating the date it has entered into force. In such a case, it will be up to the Company to notify Users of these changes and the manner it will be done (email, pop-up, slide bar, announcement, etc.). We encourage you to check for updates and changes to this statement by checking this date when accessing our websites and mobile apps. When it will be possible, we will notify you of any changes to this statement that could significantly affect how we use or disclose your personal information before the change becomes effective through a message on this site.
3. Links to other sites
Links are presented on the Site to websites over which the Company has no control, and the links concerned are not a sign of interdependence / connectivity with the respective entities. Should a User visit one of these websites, he/she should acquaint him/herself with the rules of using the website and with security standards. The Company is not liable for the expressions and procedures of the operators of such websites; the User is solely responsible for transmitting personal data on such sites.
4. User conduct
When using this Website, the User undertakes to observe the valid legal regulations of Romania, to invariably act in accordance with good morals and with the said rules and not to damage in any way the repute and rights of the Company or of other Users.
5. Liability
Any risks arising for the User from using this Site are entirely the responsibility of the User and the Company is not liable for these. All disputes arising in connection with the use of the Site shall be settled by the court having local and subject-matter jurisdiction over the Company in Romania.
6. Information about personal data processing. To whom applies the Privacy policy?
Observance of legal regulations regarding personal data protection
In the course of its activity, the Company processes certain personal data relating to its customers, Users, and its employees and assumes the role of personal data controller in relation to processing such personal data.
When processing personal data, the Company proceeds strictly in accordance with legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “General Data Protection Regulation” or “GDPR”).
In accordance with the above-mentioned provisions for the protection of individuals with regard to the processing of personal data and the free circulation of such data, the processing of personal data and the protection of private life, the Company has the obligation to administrate and process the personal data provided to it for the purposes listed below, implementing technical, organizational and security solutions in line with legal regulations.
During the use of the Site, the Company shall make all reasonable efforts to maintain the confidentiality of personal data transmitted both directly and indirectly by Users through the Site.
The rules describe how the Company and its affiliates collect and use the personal data of Users / employees so as to provide the products and services offered. Examples of operations that fall here include but are not limited to the following:
▪ Customer support, which involves requesting information or making claims, post-sales activities, including customer service services, informing users/customers regarding the evaluation of the services offered (feedback);
▪ Information about, services, accounts, programs, contests and sweepstakes;
▪ Submission of special offers, personalized promotions, advertising messages, promotion of products and events, loyalty programs or other marketing purposes;
▪ Maintaining, improving and analyzing our web sites products and services we offer;
▪ Maintaining appropriate records for internal administrative purposes, maintaining the functionality of our web sites and as well as maintaining their relevance for customer needs;
▪ Providing important information on product safety;
▪ For activities specific to the Human Resources department, in the situation where you are interested to be part of the team and have sent a CV to the Human Resources department via the Site;
▪ For specific activities to promote the Company, if you are already part of our team.
Personal data will be kept as long as necessary for the purposes mentioned above.
7. Data controller. Who we are.
As you have seen or are about to see, we ask you for some personal data depending on your status on the Starbucks Rewards / Site platform. Because we decide what kind of information we need from you, we are, according to the Personal Data Protection Regulation, a data Controller.
Find below our identification data:
Name
AmRest Coffee SRL
Registered office
46 Grigore Cobălcescu str., 2nd floor, room 11, Sector 1, Bucharest, Romania
Telephone:
0040 31 433 5336
DPO Contact:
If you have any concerns, comments or complaints about us or the personal data we process for you, you can always send us an email at the above-mentioned address.
8. Information We Collect
As you use our Site, we collect information about you and the services you use. The information we collect falls into three different categories:
(1) information you give us;
(2) information we collect from you automatically; and
(3) information we collect from other sources. Some examples of this information include when you browse/create a Starbucks account; use our Site to reload a Starbucks Card.
8.1. Information You Give Us
Customers - Some information we collect is provided when you use our services. This may include your first and last name, username, password, email address, postal address, phone number, birthday and any other information you give us / we ask from you. Any information provided by you will be considered and will constitute your express consent that your personal data may be used by the Company for the purposes stated below.
The personal data of customers is processed only in cases in which the customer decides
• to use one of the Company’s loyalty programmes;
• to participate in one of the Company’s consumer competitions;
• or for surveying customer satisfaction (www.experientastarbucks.ro).
In such cases the following examples of personal data shall be considered:
• customer’s first name and surname,
• place of residence,
• e-mail address,
• date of birth,
• telephone number,
• payment details, and
• where appropriate, information about his/her order and the places purchases are made at
In such a case, customer’s personal data is processed with the customer’s consent the latter provides voluntarily in accordance with the rules of the relevant loyalty programme or consumer competition the customer joined at the time of entering the loyalty program / participating in the contest. If you choose not to provide the requested information, your account will not be created and you will not be able to access the pages for members registered in the system.
The personal data of customers is processed within the bounds of loyalty programmes for the following purposes:
• to make it easier to handle the orders of the relevant customer,
• for marketing (for example, as part of the marketing campaigns of the Company, to provide information about new products, for the delivery of the Company’s commercial communications or to provide notification of prizes won and other benefits pertaining to the customer);
• for surveying customer satisfaction.
In the case of consumer competitions, personal data is processed for the purpose of awarding the winners. Personal data can be used to send you information about products, services, events, etc. we offer and host, provided that you ticked the box corresponding to this option in the Loyalty Program registration form, or you submitted such data for one of the purposes mentioned above.
Employees - The Company processes employees’ personal data to the extent required for the fulfilment of their statutory obligations (for example, the obligation to deduct or levy tax, to keep records for the purposes of health insurance and social security, etc.). The employee is obliged to provide the Company with this data; failure to provide such data would constitute breach of legal regulations by the employee and/or the Company and would lead to the possibility of sanctions being imposed by the competent state bodies.
The Company processes the employees’ personal data beyond the scope of that required by law only with their consent and as part of asserting the legitimate interests of the Company or performing the contract entered into by and between the Company and the employee, in particular for the purpose of processing personal data in the CVs of applicants for employment at the Company, the preparation of publicity materials, managing Company profiles on social networks, keeping records of the use of company cars at the Company, providing information about Company events, protecting the property of the Company (primarily using camera systems) or when ensuring access for authorised persons to Company premises.
8.2. Information We Collect Automatically
Some information is collected by us automatically, including when you access our websites, or otherwise use our services. This information includes:
Purchasing Information – We may collect information about your transactions in our stores, on our websites including what products you purchase, how frequently you purchase them, any rewards or promotions associated with a purchase.
Device and Usage Information – We may collect information about your browser or device. This information may include the type of device you are using, your operating system, your browser, your internet service provider, your domain name, your internet protocol (IP) address, your device and mobile ad identifiers, the website that referred you to our Site, the web pages you view (including the date and time you viewed them), the services or functionality you access or use (including the date and time of your access or use), and the subject of the ads you click or scroll over. To collect this information, we use cookies, web beacons and similar technologies. The purpose of processing this data is used by the Company to compile statistics by means of using aggregate data, which analyse the use of the Site and to personalise advertising, to the extent that they have agreed to this.
8.3. Communication data
Using cookies - The Company uses cookies on its Site. Cookies (the term includes "Cookie Internet", "cookie browser", "HTTP cookie" or simply "cookie") are files or information that can be stored on your computer or on mobile devices with Internet access (smartphone or tablet, or other devices that allow you to connect to the Internet and access a web instance) when you access the Internet. The cookie is installed via the request issued by a webserver to a browser (e.g. Internet Explorer, Chrome) and cannot access information from the user's computer. Please note that this technology does not contain software, viruses or spyware.
We use cookies to make the Site easier to use and to better tailor it to our interests and needs through our offers. Cookies are also used to increase the speed of your future activities and experiences on our Site. These refer to your preference for online privacy or relevant advertising. We also use cookies to compile anonymous aggregated statistics that allow us to understand how people use the Site and to help us improve its structure and contents, excluding the user's personal identification.
The Company uses two types of cookies: (a) – session cookies and (b) persistent cookies. Session cookies are used temporarily and remain stored in the User’s device until such time as he/she signs out of the Website or closes the application (web browser). Persistent cookies remain in the User’s device either for the period of time defined in the parameters of the relevant cookie or until the User him/herself deletes them. Generally, we store cookies for up to 1 year.
The cookies we use are included in one or more of the following categories:
a) Strictly necessary cookies: These types of cookies are essential to providing the services specifically requested by websites visitors. If they are not available, webpages cannot function and cannot provide the requested services.
A detailed presentation of the strictly necessary cookies of our website is shown below:
Name (Cookie ID): PHPSESSID
Domain placing the cookie: starbucksromania.ro
Cookie’s goal: Used when accessing the site.
Lifetime: session
b) Performance cookies: These cookies collect information about how visitors use a web page, such as: which pages are most popular, which method of linking the pages is most effective, and whether users receive error messages from the web pages. These cookies allow us to provide our Users with a high quality user experience and they also allow us to measure the web page audience. The information gathered by these cookies does not identify users but only serves to help improve the way our web page works, by providing information that allows us to provide a personalized experience in the future.
Information obtained through the use of cookies can be collected only for the purpose of mediating and performing certain user functions. These data are encrypted in a way that disables unauthorized access.
Our web page uses Google Analytics, a web analytics service provided by Google, Inc. (hereinafter referred to as "Google"). Google Analytics uses cookies to help the website analyze how users are using the page concerned. Cookie-generated information on your use of the Web page (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information to evaluate your use of the web page, compile reports on the web page activity of website operators, and provide other services related to the activity of the web page and the use of the Internet. Google may also transfer this information to third parties should the law so require or if third parties process the information on Google's behalf. Google will not associate your IP address with any other data owned by Google. You can refuse cookies by selecting the appropriate settings on your browser. In the event you choose to do so, you may not be able to use the full functionality of the web page.
To turn off Google Analytics, you can access the following link:
http://tools.google.com/dlpage/gaoptout
User's personal data is processed subject to their consent, which is voluntary and is provided by the User when they access the Site.
Most Internet browsers are initially set to automatically accept cookies. You can change settings to block cookies or to be notified when cookies are sent to your computer or mobile device (smartphone, tablet). If you cancel the cookies we use, you no longer receive personalized information when you visit www.starbucksromania.ro. If you use multiple devices to view and access the Site (e.g., your computer, smartphone, tablet, etc.), you need to make sure that each browser on each device is set to match your cookie preferences. By accessing the existing cookie settings in your browsers, you will find indications explaining how you can change the cookie settings. These settings are usually found in the Browser's "Options" or "Preferences" menu. For further information, you can also use your browser's "Help" option.
The browser can allow you to delete all cookies after it is closed. However, this option removes permanent cookies that can store your preferences and custom settings on the web pages you regularly visit.
However, you can keep the cookies you want because your browser can allow you to specify which websites always have or never have permission to use cookies.
You can find more details on how to delete cookies or how to manage cookies on different browsers by accessing the links below:
Using statistical data and anonymous data – The Company may use the statistical data or the anonymous data resulting from the processing for the following purposes:
➢ preparing reports / analyzes;
➢ gathering information for own purposes;
➢ publishing, promoting, offering the services provided by AmRest Coffee SRL
9. How we use the obtained information
The company collects this information in order to be able to offer the products and benefits under the loyalty program, to improve service delivery, as well as to develop new technologies to come to your aid.
Specifically, we use the information:
• to improve the safety and security of our users and services;
• for users support;
• for research and development;
• to allow communications to or between users;
• in connection with legal proceedings.
| AmRest Coffee SRL does not sell or distribute your personal information to third parties for the purpose of direct third party marketing. |
10. Provision of services and functions assurance
AmRest Coffee SRL uses the information gathered with a view to provide, personalize, maintain and improve its products and services. This includes the use of information for:
• creating and updating your Starbucks Rewards account;
• confirming your identity;
• allowing access to your account and viewing status as well as transactions made, and viewing rewards;
• processing or facilitating payments for such services;
• performing the internal operations necessary to provide our services, including debugging of software and operational errors, performing data analyzes, testing, studying, monitoring and analyzing usage and activity trends;
• activities specific to the Human Resources department, should you be interested in being part of our team and have submitted a resume to the Human Resources department through the Site;
• specific activities to promote the company, if you are part of our team.
11. Safety and security
We believe that our users’ safety and security should be placed first. We will take appropriate steps to ensure that your personal data is processed, secured and transferred in accordance with legal requirements. We will therefore use the information you provide for:
• our identity verification functions when accessing Starbucks Rewards, which ensure that only the identified user has access to the account assigned to that user, thus protecting the user information and ensuring that data is not accessed by strangers;
• using customer reviews provided by Customer Voice and for using the services and products offered in our locations. This assessment can be made by accessing the Customer Voice platform pursuant to the vouchers issued at the cash registers and the customer information can be used only if they request to be contacted by a representative of the company.
• contacting you if you have submitted a resume, you want to apply for a vacancy or want the termination of the employment contract.
12. Customer support
The Company uses the information you provide (such as application history, payment methods, product purchase location, personal data, etc.) to improve user support such as:
• investigate and solve your problems;
• monitor and improve customer support responses;
13. Research & development
The company is undergoing continuous improvement for the services and products offered to customers through continuous research and development, so as to constantly provide quality services and products.
That's why your data is very important to us and we can use it for product testing, research, analysis and development. This enables us to improve the safety and security of our services, develop new functions and products, and facilitate the delivery and expansion of our services.
14. Messages
The company may use the information you use so as to send you account status messages, Starbucks Rewards updates, newly introduced events, services, products, and more when we believe you are interested.
15. Legal proceedings
We will be able to use the information you provide us with to investigate or settle disputes, complaints, or any existing problems related to the use of the products or for any other purpose allowed by the applicable law. The Company will also be able to transmit the information provided in accordance with the requests from jurisdictional bodies competent to access such information, such as criminal investigations, court cases or pre-trial proceedings, etc.
16. Transfer of information
We will not disclose your personal data except for the purposes and to third parties described below.
Personal data may be distributed to any other member company of our group, including the parent company based in PLAC GRUNWALDZKI 25-27, 50-365, WROCLAW, Poland, if we believe this is in our legitimate interest for internal administrative purposes (e.g. data storage) or for auditing and monitoring our internal processes.
We will be able to share personal data with and / or to companies in our group should they provide us with products and services, such as IT systems.
16.1. Personal data transfer abroad
We work with a number of partners and service providers that we carefully select to ensure that your data is secure. We consider it important for you to be informed about where the data you are providing is transferred.
The company can transfer personal data to other countries in the European Union and, in some cases, to other third countries - non-EU (USA), irrespective of whether, in the case of such other countries, the European Commission has already decided on the level of protection of personal data, equaling to the level existing in the European Union. Personal data is transferred to other companies in the AmRest group if required in a particular case, pursuant to a contract under which the recipient of personal data undertakes to comply with a high standard of data protection (the personal data transfer is based on the "standard provisions" on the protection of personal data, in accordance with Article 46 (2) (c) of the General Data Protection Regulation) and / or subject to the consent of the person whose personal data is transferred.
If AmRest Coffee SRL will be required to provide personal data or is not allowed to do so, only the data necessary to fulfill the strict purpose of the request will be disclosed.
16.2 Data provision to third parties
AmRest Coffee SRL may disclose your personal data to third parties. The Company only provides personal data which it has already processed to partners at which technical and organisational measures for the protection of data and fulfilment of the other obligations arising from the General Data Protection Regulation have been established. Company partners have access to personal data only to the extent required for the performance of their tasks.
Under no circumstances does the Company provide personal data to other parties in exchange for payment.
Categories of recipients’ personal data can be shared with are:
• AmRest Coffee SRL’s contractual partners (such as the companies AmRest Coffee SRL has a partnership with, but only pursuant to a confidentiality commitment on the latter’s part to ensure that the said data are kept secure and that the provision of such personal information is according to the legislation in force),
• service providers which provide the Company with services relating to the placement of personal data on the common servers of the AmRest Group, the management of applications for loyalty programmes, the assurance of payments for purchases from the Company and the assessment of marketing surveys (e.g. marketing, payment / banking services or other services, including entities assisting the Company in data processing as empowered agents, etc.); The personal data of Company employees is provided to the external accounting firm which compiles accounting, tax and payroll records for the Company,
• public authorities (prosecution bodies, police, courts of law, and other competent bodies of the state), pursuant to and within the limits of the legal provisions and as a result of expressly formulated requests,
• other companies in the same group as AmRest Coffee SRL, its subsidiaries, and affiliated companies for management and assessment purposes, decision-making, and other business purposes. For example, we can share your information with affiliates and affiliated companies to manage our loyalty programs, orders, and process requests, and to expand and promote our product and service offerings,
• in isolated cases, to companies which provide the Company, and other companies in the AmRest Group, with services which allow Company employees to report cases of violation of legal regulations or cases in which the Company, its partners or other employees adopt(s) an unethical approach,
• specialists, lawyers, accountants and other professional service providers.
We will also be able to transmit your personal data to third parties:
• If you ask us or give us permission to do so;
• To people who can demonstrate that they have the legal authority to act on your behalf;
• if it is our legitimate interest to do so in order to manage, expand or develop commercial activity;
• if we have an obligation to disclose your personal data to comply with a legal obligation, any legal request from governmental or executive authorities and as may be necessary to meet certain national or law enforcement requirements; or to prevent certain illegal activities;
• to respond to any claim, to protect our rights or those of a third party, to protect the safety of any person or to prevent any illegal activity; or
• to protect the rights, property or safety of Starbucks / AmRest Coffee S.R.L, its employees, its customers, suppliers, or other persons. Some of these recipients (including our affiliates) may use your data in countries outside of the European Economic Area.
17. Data retention
The Company retains personal data only for the period of time required to achieve the purpose of its processing and does so according to the rules specified hereunder:
• in the case of loyalty programmes, personal data is stored only for the period of duration of the customer’s participation in the loyalty programme; at the end of this period, in case of deletion of the account, the Company will be able to keep the data obtained, once it has been anonymized, to use it for statistical purposes, for research, development, expansion and improvement of the services provided;
• the personal data of Users is stored for a maximum of two years following their last Site visit; at the end of this period, in case of deletion of the account, the Company will be able to keep the data obtained, once it has been anonymized, to use it for statistical purposes, for research, development, expansion and improvement of the services provided;
• in the case of employees, personal data is retained for the archiving time limits laid down by law;
• in the case of social networking posts, events, conferences, indoor / outdoor / digital format / prints, footage or photo and video materials of employees or consumers will be retained until the express request of people who appear in such materials. However, in the event of a deletion request, the Company shall reserve the right not to respond to such a request if it considers that its interest overrides the interest of the consumer / data subject.
• footage from security cameras is retained for a maximum period of thirty days;
• retains information on transactions and usage statistics, as per regulations, tax and insurance requirements as well as other applicable requirements where they operate. After this period, the Company deletes or anonymizes the information in accordance with the applicable laws.
18. Storage of data provided
The personal data you provide us with and we process are processed within the EEA ("European Economic Area") and stored in PLAC GRUNWALDZKI 25-27, 50-365, WROCLAW, Poland (from Europe). However, these data may be processed by personnel outside the EEA working for us or for one of our business partners or service providers.
A complete list of sub-empowered third parties and details about their privacy policies you can find on our Site when they exist.
Some non-EEA countries cannot offer the same level of adequate protection of your rights and freedoms with regard to the processing of personal data; however, by using our services, you consent to your personal data being submitted by the Company to third parties.
Please contact us if you would like more details about the specific safeguards applied to the transfer of your personal information outside the EEA.
19. The data processing purpose
The Company uses the information you provide us with to give you access to:
• our current products and offers;
• information on the activity of the Company;
• job opportunities and the necessary steps for this purpose;
• concluding employment contracts / offering a job within the Company;
• marketing campaigns run by the Company.
• the information services you access through loyalty programs
For the best performance of such services, the Company will be able to use the information provided for other purposes such as billing, statistics, research & development, etc. To the extent the Company will consider that the information provided may be used for purposes other than those mentioned above, it will immediately inform users about this matter.
19.1. Data processing is required to provide the services you request
The company must collect and use certain information so as to provide services. These include:
• Loyalty program user profile information needed to create and maintain your account, including to verify your identity, and to make or receive payments;
• information about candidates and employees (CVs, documents needed by employees), documents necessary to verify the observance of legal conditions and the criminal records, necessary to enable the company to carry out the employment contract;
• Customer information (for promotional purposes) in case of participation in events organized by the Company, where one can take photos and videos with the participants / people who attend the event, regardless of their capacity. The Company reserves the right to use such data for the subsequent promotion of other events / in the Company's current promoting activity to show others the past events in order to increase interest in future events;
• information about transactions and cases entered on the platform that need to be generated and retained on the manner you use the loyalty program;
• information about the use of the Company's services required to maintain, optimize and improve the services.
19.2 Processing is necessary for the Company’s legitimate interests
The company collects and uses personal information to the extent necessary to fulfill its legitimate interests. This includes collecting and using information:
• to maintain and improve user safety and security;
• to prevent, detect and combat fraud that may be related to the use of our services;
• to provide customer support services;
• to optimize the service offered and to develop new services;
• for research, development and analysis purposes (we also include usage trends analysis so as to improve user experience and provision of new services);
• to set the marketing strategy
• to meet the terms and conditions of the loyalty program.
19.2 Processing is necessary for the Company’s legal interests
The Company is subject to the applicable law in the jurisdiction where it operates. For this purpose, there may be cases where the Company must submit your personal data to the competent authorities when asked for such data to settle or prevent disputes.
20. Processing grounds
In its data processing activities, AmRest Coffee SRL does not pursue the processing of personal data of minors. Particular attention is paid to ensuring that any processing of personal data pertaining to minors is carried out in accordance with legal requirements and in strictly limited cases.
AmRest Coffee SRL does not carry out promotional direct marketing activities towards minors. Minors are not allowed to request services, as well as any communications on the starbucksromania.ro website or to participate in AmRest Coffee SRL competitions or campaigns unless this is done on behalf of the minor by the legal representative or guardian of the minor concerned, according to the law.
Minors may purchase products or services and request and receive communications from AmRest Coffee SRL only if they have the consent of their legal representative or guardian, according to the law.
Also, any person who provides us with personal data through the Site or other applications or devices covered by this Policy warrants they are major and have full exercise capacity.
Any collection or processing of minors’ personal data shall be carried out only under the law and in view of the above.
You can withdraw your consent at any time. If you withdraw consent, you will no longer be able to use the services or functions that require the collection or use of the information we have obtained or used on your consent.
The Company also uses different data processing grounds to provide you with the services. These are:
| Data item | Processing ground |
| Name, first name, e-mail address, phone number, |
Article 6 para. (1) let. b GDPR – to carry out the contract you enter into with us remotely at the time of creating a platform account for the loyalty program and when you are registered as a candidate / employee |
| Name, first name, transaction, date, location | Article 6 para. (1) let. b GDPR – by virtue of the contract you have concluded with us, either remotely or locally, in order to collect feedback from you regarding your experience |
| Invoicing data | Article 6 para. (1) let. b GDPR – to fulfill a legal obligation under applicable law |
| Medical data (date of birth, sex, labor medicine-related tests) | Article 9 para. (2) let. a) GDPR - explicit consent - health data is part of a special category of data for which the consent of the data subject is required. Article 9 para. (2) let. j GDPR - scientific research or statistical purposes - To the extent that the patient is under 16, we will seek the consent of the parental authority to provide access to our services. |
| Promotional & Marketing Activities | Article 6 para. (1) let. a) GDPR – consent - for direct marketing, if you do not want to receive information and newsletters about our activity and the services offered, you can at any time withdraw your consent. Article 6 para. (1) let. f) GDPR – legitimate interest - to promote our services and products, you can at any time withdraw your consent. |
| Credit card data, information exchanges between users, etc. | Article 6 para. (1) let. f) GDPR – legitimate interest - we will be able to use such data and the like to improve the services offered, complete the trading process, to identify and solve user problems, etc. |
| Images: ambient photos and videos; close-up / portrait photos and videos | Article 6 para. (1) let. f) GDPR - legitimate interest - we will be able to use this data in order to conduct marketing and advertising activities on the digital channels for promoting the Starbucks brand on social networks and other online platforms |
21. Your rights
Pursuant to the GDPR provisions you have a number of rights related to your personal data:
| Right of access | You have the right to ask us for information about the personal data that we are processing and are concerning you. We will try, as far as possible, to give you information about your data in a clear, accessible, structured, machine readable manner. To do this, we will need to be sure that the data relates to your person, so we will identify you by providing a copy of your ID card. |
| Right to rectification | Your data should be kept up to date and complete at all times. While we make every effort to ensure that the data provided is always accurate, we will also need your help. If you find that your data is incorrect, changes have been made, or you want to add something, you can submit a request asking us to rectify such data, whether we are talking about an update, modification or completion. |
| Right to erasure / right "to be forgotten" |
You may ask us to delete your personal data in the following cases: • personal data are no longer required for the purposes for which they were collected or processed; • you withdraw the consent on the grounds of which processing takes place; • you object the processing when the processing of personal data is for direct marketing purposes; • personal data has been processed illegally; • personal data must be deleted for compliance with a legal obligation. • data was processed from a minor without the consent of the parents • as well as in the other cases provided by the applicable legislation on personal data protection Users can request the deletion of the account at any time. Upon such request, the Company will delete the information that is no longer to be retained and will restrict the access to or use of any information that is still to be retained as specified in the Data Retention section. |
| Right to restriction of processing |
You can ask us to restrict the processing of your personal data in the following cases: • you contest the accuracy of your personal data, but for a period that allows us to verify the accuracy of the data; • the processing is illegal and you do not agree with the deletion of personal data, but you ask us for restriction of processing thereof; • we no longer need your personal data, but you ask them from us with a view to find, exercise or defend a right in court; • you object the processing of your personal data when the processing of personal data is for direct marketing purposes, for the time frame necessary to verify whether our legitimate rights prevail over your rights. |
| Right to data portability |
You may ask us to send you the personal data which concern you and which you have provided to us in a structured, commonly used and readable form, and you are entitled to transmit this data to another data controller in the following cases: • processing is based on consent; • processing is carried out by automatic means. |
| Right to object |
You have the right to object processing when: (a) processing is necessary for the performance of a task that serves public interest; (b) processing is necessary for the purposes of legitimate interests pursued by us or a third party, including the profiling based on such provisions. In such a case, we no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. |
| Right not to be subject to an automated individual decision-making, including profiling |
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. These rights have certain limitations, namely: • automated decision is necessary for entering into, or performance of, a contract between you and us; • the decision is authorized according to the legal norms; • we have your explicit consent to this effect. In this case, you can send us a request for your personal data to undergo a manual processing process. |
22. Complaints
If you want your personal data to be accessed, updated, rectified, deleted under certain circumstances (e.g. when personal data are no longer required for the purposes mentioned above), if you wish to request the data processing restriction under certain circumstances (e.g. when you challenge the accuracy of the data - for a period that would allow us to verify the accuracy of the data concerned); if you wish to file a complaint with us, if you wish to oppose your data processing and wish, at any time, to withdraw your consent for the processing of your personal data that you have previously consented to, you may notify us at any time by means of a written application, dated and signed, to the following address: str. Grigore Cobălcescu no. 46, et. 2, room 11, Sector 1, Bucharest, Romania or to the email address [email protected], or you can contact the Data Protection Officer at Company level, [email protected], regarding the processing of personal data within the Company.
For the exercise of these rights, as well as for any additional questions regarding this notice or relating to AmRest Coffee SRL’s use of personal data, please contact us by choosing any of the communication ways described above, specifying, at the same time, your name, your postal or email address (subject to your communication preference), your phone number, and the purpose of your request.
We will do our best to resolve your request as soon as possible.
You can also file a complaint with the personal data supervisor. For Romania, contact details can be found below:
| Name | National Supervisory Authority for Personal Data Processing |
| Address | B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, postal code 010336, Bucharest, Romania |
| Telephone: | +40.318.059.211 or +40.318.059.212 |
| [email protected] |