SHAYA KAHVE SANAYİ VE TİCARET A.Ş.

STARBUCKS CUSTOMER PRIVACY POLICY

Data Controller (Owner of personal data): Shaya Kahve Sanayi ve Ticaret Anonim Şirketi ("Shaya Kahve" or the "Company")

As Shaya Kahve, we attach great importance to the processing and protection of your personal data. This Privacy Policy has been prepared in accordance with Law No. 6698 on the Protection of Personal Data ("KVKK"), the Law of the Republic of Azerbaijan on Personal Data, dated 11 May 2010 (“PDL”), and related legislation and legal regulations, in order to ensure that you are informed about the personal data processed and transferred during the provision and development of various services.

In addition, you can access detailed information on the processing of your personal data obtained automatically through the cookies used on the Starbucks website, the types of cookies used, and your preference management regarding these cookies from the Cookie Privacy Notice.

Purpose of Processing, Legal Basis, and Collection Methods of Your Personal Data

You can shop at Starbucks stores by registering as a member on Shaya Kahve's website https://www.starbucks.az or our mobile application.

1- During the membership processes on the Starbucks mobile application or website;

Your identity (name, surname, date of birth), contact (mobile phone number, billing and delivery address, e-mail address), customer transaction (personalized campaign information, collected points information, star invitation code), and audiovisual records (visual data) data will be collected and processed (with obtaining your prior consent);

● limited to the purposes of conducting customer relationship management processes, conducting activities for customer satisfaction, conducting contract processes, following up requests/complaints, conducting communication activities, conducting after-sales support services for goods/services, conducting sales processes for goods/services, in accordance with the legal basis "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract".

Your personal data is transferred abroad due to our use of technological infrastructure suppliers located abroad, only to the extent necessary for the realization of the relevant purpose, by complying with the rules of the KVKK and PDL and by taking the necessary technical and administrative measures; and in accordance with the legal basis of “signing a standard contract”.

2- During the submission of complaints and requests to Starbucks;

In case of receiving support regarding the goods and services offered by Starbucks, your identity (name, surname), contact (phone number, e-mail address), customer transaction (shopping information, store information, number of stars), audiovisual recording (call center voice recordings) data will be collected and processed (with obtaining your prior consent);

● limited to the purposes of conducting customer relationship management processes, conducting activities for customer satisfaction, tracking requests / complaints, conducting communication activities, receiving and evaluating suggestions for the improvement of business processes, in accordance with the legal bases "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and "It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject".

In the event that you submit your complaints and requests to Starbucks, your personal data processed in accordance with the KVKK and PDL and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;

● in order to fulfill our legal obligations within the scope of the contracts between us for the purposes listed above, it can be transferred to authorized persons and official institutions in accordance with legal regulations and legislation; and

● your data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.

3- During Gift Card creation processes;

If you request to create a gift card from Starbucks website or mobile application, your identity (name, surname) and contact (mobile phone number, e-mail address) data will be collected and processed through the gift card creation form. Your personal data in question will be processed (with obtaining your prior consent);

● limited to the purposes of conducting goods / service sales processes, conducting contract processes, conducting goods / service production and operation processes, conducting communication activities, in accordance with the legal basis "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract".

By complying with the rules in the KVKK and PDLand taking the necessary technical and administrative measures, only to the extent necessary for the realization of the relevant purpose; In accordance with the legal basis of "signing a standard contract", it is transferred abroad by saving it in our programs and / or systems provided / made available to our use by our technological infrastructure suppliers located abroad.

4- During the activities carried out by Starbucks to improve the customer experience;

In order to provide you with a better customer experience, your identity (name, surname, date of birth), contact (mobile phone number, e-mail address), and customer transaction (order information, membership-related information) data      collected through membership pages on our website, online web forms, information systems, and electronic devices will be processed (with obtaining your prior consent);

● limited to the purposes of conducting marketing analysis studies, carrying out production and operation processes of goods/services, carrying out/auditing business activities, and carrying out sales processes of goods/services, in accordance with the legal basis “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” and “Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”.

5- During the utilization of interactive support services offered by Starbucks;

In case you contact Starbucks through the contact information on the Starbucks website and the mobile application and submit your requests / complaints; your identity (name, surname), contact (mobile phone number, e-mail address) and customer transaction (request information) data that you have shared with us via phone calls, e-mail or written means will be processed (with obtaining your prior consent);

● limited to the purposes of receiving and evaluating suggestions for the improvement of business processes, carrying out after-sales support services for goods/services, carrying out customer relationship management processes, carrying out activities for customer satisfaction and following up requests/complaints, based on the legal basis "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract".

If you submit your requests/complaints through Starbucks communication channels, your personal data will be processed for the abovementioned legal basis by complying with the rules in KVKK and PDL and taking the necessary technical and administrative measures;

● your personal data may be recorded in our programs and/or systems provided by our technological infrastructure suppliers.

6- During the corporate sales procedures conducted by Starbucks;

Your identity (name, surname), contact (mobile phone number, e-mail address, billing and delivery addresses) and customer transaction (billing information, order information, product information, shipping information) data will be processed (with obtaining your prior consent);

● limited to the purposes of conducting activities in accordance with the legislation, conducting communication activities, conducting financial and accounting affairs, conducting contract processes, conducting / auditing business activities, conducting goods / service sales processes and providing information to authorized persons, institutions and organizations based on the legal bases "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and "It is mandatory for the data controller to fulfill its legal obligation".

In the event that corporate sales are realized with Starbucks, your personal data processed in accordance with the rules in the KVKK and PDL and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;

● to authorized persons and official institutions in accordance with legal regulations and legislation in order to fulfill our legal obligation limited to the purposes listed above, and

● your data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.

7- During the purchase of products from Starbucks stores;

Your identity (name, surname) and customer transaction (billing information, order information, product information, QR code information, number of stars information) data will be processed (with obtaining your prior consent);

● limited to the purposes of conducting activities in accordance with the legislation, conducting financial and accounting affairs, conducting / auditing business activities, conducting goods / service sales processes and providing information to authorized persons, institutions and organizations, in accordance with the legal bases "Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract" and "It is mandatory for the data controller to fulfill its legal obligation".

If you purchase products from Starbucks stores, your personal data processed in accordance with the rules in the KVKK and PDL and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;

● to authorized persons and official institutions in accordance with legal regulations and legislation in order to fulfill our legal obligation limited to the purposes listed above, and

● your data can be recorded in our programs and/or systems provided by our infrastructure suppliers in the field of technology / made available for our use.

8- During the processes regarding the orders received by Starbucks through online ordering applications;

Your identity (name, surname), contact (mobile phone number, e-mail address, billing and delivery addresses) and customer transaction (shopping information, number of stars information, order information) data within the scope of tracking orders received through online ordering applications and preparing reports on online sales will be processed (with obtaining your prior consent);

● limited for the purposes of execution of goods/service production and operation processes, execution of goods/service sales processes, execution of advertising/campaign/promotion processes and execution/audit of business activities with the legal bases "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and "It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject".

9- During the fulfillment of customer requests by Starbucks through social media accounts;

Your identity (name, surname), contact (social media username) and customer transaction (request information) data will be processed (with obtaining your prior consent);

● limited for the purposes of carrying out customer relationship management processes, carrying out activities for customer satisfaction, following up requests / complaints, receiving and evaluating suggestions for the improvement of business processes in accordance with the legal basis "It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject".

In case you submit your requests/complaints via Starbucks social media accounts, your personal data will be processed in accordance with the rules in the KVKK and PDL and by taking the necessary technical and administrative measures, for the legal basis listed above;

● your personal data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.

10- During the organization of special events for loyalty cardholders by Starbucks;

Your identity (name, surname), contact (mobile phone number, e-mail address) and visual and audio recordings (visual data) data will be processed (with obtaining your prior consent);

● limited for the purposes of organization and event management, execution of advertising / campaign / promotion processes, execution of activities for customer satisfaction, execution of company / product / service loyalty processes, in accordance with the legal bases "Provided that it does not harm the fundamental rights and freedoms of the data subject, data processing is mandatory for the legitimate interests of the data controller".

If you participate in the special events organized by Starbucks, your personal data will be processed by complying with the rules in the KVKK and PDL and taking the necessary technical and administrative measures, for the legal bases listed above;

● your personal data can be recorded in our programs and/or systems provided by our technological infrastructure suppliers.

In addition, your audiovisual data processed within the scope of the events organized may be publicly shared on Starbucks' social media accounts for the purposes of organization and event management for the activities of the Starbucks brand, execution of advertising / campaign / promotion processes, execution of activities for customer satisfaction, execution of company / product / service loyalty processes, based on the above indicated legal bases.

11- When contacting you regarding the products/services you have received from Starbucks and the campaigns offered by Starbucks;

Your identity (name, surname), contact (e-mail address, phone number) and customer transaction (commercial message confirmation information) data you have shared with Starbucks will be processed (with obtaining your prior consent);

● limited to the purposes of conducting marketing analysis studies, conducting advertising / campaign / promotion processes, conducting activities in accordance with the legislation and conducting marketing processes of products / services, based on the above indicated legal bases.

.    

12- During the processing of location data within the scope of improving customer experiences;

Your location data you have shared with Starbucks will be processed (with obtaining your prior consent);

●         limited for the purposes of carrying out customer relationship management processes, carrying out activities for customer satisfaction, based on the above indicated legal bases.

Your personal data is transferred to our suppliers in accordance with the prior consent of the data subject, within the scope of the purposes listed above.

13     - During the execution of legal processes and information security processes;

Your identity (name, surname, ID number), contact (mobile phone number, billing and delivery addresses, e-mail address), customer transaction (billing information, order information, product information, shipping information), transaction security (IP address information, website login and exit information, username information, password information, traffic data (connection time / duration, etc.) and legal transaction (information in the case of dispute, information in the case file, dunning notices, information in correspondence with judicial and administrative authorities) data will be processed (with obtaining your prior consent);

● limited to the purposes of execution of information security processes, execution of activities in accordance with the legislation, follow-up and execution of legal affairs, execution / supervision of business activities and providing information to authorized persons, institutions and organizations, in accordance with the legal bases "It is clearly stipulated in the laws", "It is mandatory for the data controller to fulfill its legal obligation", and "Data processing is mandatory for the establishment, use or protection of a right".

If you purchase products from Starbucks, your personal data processed in accordance with the rules in the KVKK and PDL and by taking the necessary technical and administrative measures, for the legal bases listed above may be transferred;

● to authorized persons and official institutions and our suppliers from whom we receive legal consultancy support in accordance with legal regulations and legislation in order to fulfill our legal obligations, and

● your data may be recorded in our programs and/or systems provided by our technological infrastructure suppliers.

In addition, by complying with the rules in the KVKK and PDL and taking the necessary technical and administrative measures, only to the extent necessary for the realization of the relevant purpose; In accordance with the legal basis of "signing a standard contract", it is transferred abroad by saving it in our programs and / or systems provided / made available to our use by our infrastructure suppliers located abroad in the field of technology.

Storage of Personal Data, Your Rights, and Data Subject Requests

Storage and Disposal

Our Company has established a Storage and Destruction Policy for the storage and deletion of personal data. Storage and destruction procedures regarding your personal data are carried out within the scope of this policy. Accordingly, if a period of time is specified for the storage of data in the relevant laws and other relevant legislation, the data in question must be kept for at least this period.

Considering the possibilities such as the late receipt of a possible court request or the request of an administrative authority authorized by law regarding the relevant data or the occurrence of a dispute to which we may be a party, the retention period of the data is determined by adding a period of 6 months to 1 year to the periods stipulated in the legislation for the storage of your data, and at the end of the specified period, the data in question are deleted, destroyed or anonymized.

If the legislation does not stipulate a period of time for the storage period of the data we process, your data will be deleted, destroyed or anonymized without any need for your request after the expiration of the 10-year statute of limitations from the termination of our legal relationship, taking into account possible disputes as required by the relationship between us.

If all the conditions for processing personal data have disappearedor the retention period declared by us or determined within the scope of the legislation has expired, your data will be deleted, destroyed or anonymized ex officio on the first periodic destruction date or within 6 months at the latest. If you request the deletion of your data for a valid reason, your data will be deleted within 30 days at the latest to the extent legally possible. If you request the deletion or destruction of your data, the retention period of which is determined in the legislation,  your request in question willbe realized after expiry of such statutorily established periods, however, processing of your personal data will be stopped immediately after reciept of your request.

Your Rights

Regarding your personal data within the scope of the relevant legislation, you may request, among others,;

● Learning whether your personal data is being processed and learning about the existence of your personal data,

● Learning whether your personal data has been processed,

● To learn the content of your collected personal data,

● To learn the purpose and legal justification of the collection, processing, and transfer of your personal data to third parties and whether they are used for their intended purpose,

● To learn about duration and methods of the collection and processing of your personal data, as well as the persons authorized to access your personal data, including the information systems with which data exchange is envisaged,

● To know the third parties to whom your personal data is transferred domestically or abroad,

● To request correction of your personal data in case of incomplete or incorrect processing,

● Unless stipulated otherwise by the legislation, to request the deletion or destruction of your personal data,

● Request the protection of your collected and processed personal data,

● Request information on the sources of obtaining of personal data collected and processed about you in the information system, and to request proof of the lawfulness of such data,

● Obtain information on the legal consequences for you that arise from the collection, processing, and transfer of your personal data to third parties,

● When you request the correction of incomplete or incorrect data and the deletion or destruction of your personal data, to request that this situation be notified to third parties to whom we transfer your personal data

● To object to the occurrence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems, and

● In case you suffer damage due to unlawful processing of personal data, to demand the compensation of this damage.

Data Subject Request

You can submit your applications and requests regarding your personal data by using the data subject application form;

● By sending it to " Yamanevler mah. Site Yolu Cd.  Anel İş Merkezi No:5 Ümraniye İstanbul" or[1] [2] [KG3] “Resul Rza 11 sok, daire 28 Sebail Baku” address,

● By applying in person to Shaya Kahve Sanayi ve Ticaret Anonim Şirketi with a valid identity document,

● By sending it to our registered e-mail address shayakahve@hs02.kep.tr by using a registered electronic mail (KEP) address and secure electronic signature or mobile signature,

● By sending to our address starbucks-az-app@alshaya.com       from the e-mail address previously notified to Shaya Kahve Sanayi ve Ticaret Anonim Şirketi by the Data Subject and registered in our system

You can forward it to Shaya Kahve Sanayi ve Ticaret Anonim Şirketi.

The application of the Data Subject must include the name, surname, signature if the application is in writing, identification number, (passport number if the applicant is a foreigner), residential or workplace address for notification, e-mail address for notification, telephone number and fax number, and information on the subject of the request.

The Data Subject must clearly and comprehensibly state the matter requested in the application, which will be made to exercise the rights mentioned above and includes explanations regarding the right he/she requests to exercise. Information and documents regarding the application must be attached to the application.

Although the subject of the request must be related to the applicant's person, if acting on behalf of someone else, the applicant must be authorized and this authorization must be documented (power of attorney). If the application is within the scope of sensitive data, the applicant must be specifically authorized in accordance with the law. In addition, the application must include identity and address information and identity-verifying documents must be attached to the application.

Requests made by unauthorized third parties on behalf of someone else will not be evaluated.

Your requests regarding your personal data will be evaluated and answered within 7 business days at the latest from the date it reaches the relevant department. If it becomes necessary to contact a third party in relation to your request, the response period will be extended by an additional 7 business days. In the event that your application is evaluated negatively, the reasons for the reasoned rejection will be communicated to you via e-mail or postal mail to the address you specified in the application, if possible, through the procedure in which the request was made and within 5 business days from the date of receipt of your request.