Privacy Policy

Date of last modification: 15.05.2018

Copyright
AmRest Coffee S.R.L., based in Grigore Cobalcescu Str. 46, 2nd floor, Room 11, Sector 1, Bucharest, having unique registration code 20119287, registered at the Trade Register under No. J40/21510/2006, as author, owner, administrator of the site www.starbucksromania.ro collects and processes personal data, according to the legal provisions regarding the processing of personal data and free Circulation of these data (hereinafter referred to as the “Company”). This policy applies to all devices used for the purpose of accessing the www.starbucksromania.ro website (hereinafter referred to as the “Website”)., smartphones, and tablet devices. AmRest Coffee S.R.L. holds all copyrights to all content which the Company places on the website.
 If you do not agree to the terms and conditions related to their use (shown in this document from the point of view of the protection of personal data but also in the rest of the documents on the website from the point of view of Confidential information, etc.), please do not use the www.starbucksromania.ro website.
This policy entered into force on the date indicated at the top of this web page. This policy can be amended from time to time. If we make material changes, we will post the updated statement on this page and change the date at the top of this web page. We encourage you to check for updates and changes to this statement by checking this date when accessing our websites and mobile apps. We will notify you of any changes to this statement that could significantly affect how we use or disclose your personal information before the change becomes effective through a message.
Links to other sites 
Links are presented on the Website to websites over which the Company has no control. Should a User visit one of these websites, he/she should acquaint him/herself with the rules of using the website and with security standards. The Company is not liable for the expressions and procedures of the operators of such websites.
User conduct
The User undertakes, when using this Website, to respect the valid legal regulations of Romania, to invariably act in accordance with good morals and with these Rules and not to damage in any way the repute and rights of the Company or of other Users.
Liability 
Any risks arising for the User from using this Website are entirely the responsibility of the User and the Company is not liable for these. All disputes arising in connection with the use of the Website shall be resolved by the court having local and subject-matter jurisdiction over the Company in Romania.
 
 
 
Information about personal data processing
Adherence to legal regulations regarding personal data protection
In the course of its activity, the Company processes certain personal data relating to its customers, Users, and its employees and assumes the role of personal data controller in relation to processing such personal data. 
When processing personal data, the Company proceeds strictly in accordance with legal regulations, in particular REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “General Data Protection Regulation”).In accordance with the above-mentioned provisions for the protection of individuals with regard to the processing of personal data and the free circulation of such data, the processing of personal data and the protection of private life, the company has the obligation to administrate the personal data provided to it in safety and process it only for the purposes listed below.
AmRest Coffee S.R.L. undertakes to keep the confidentiality of personal data provided through the www.starbucksromania.ro website.
The rules apply to the processing of personal data by electronic means and in systematically accessible paper recording systems. Examples of operations that fall here include but are not limited to the following: 
 Customer support, which involves requesting information or making claims, post-sales activities, including customer service services, informing users/customers regarding the evaluation of the services offered 
 Information about, services, accounts, programs, contests and sweepstakes;
 Submission of special offers, personalized promotions, advertising messages, promotion of products and events, loyalty programs or other marketing purposes
 Maintaining, improving and analyzing our web sites, products and services we offer;
 Maintaining appropriate records for internal administrative purposes, maintaining the functionality of our web sites and as well as maintaining their relevance for customer needs
 Providing important information on product safety
 For activities specific to the Human resources department, in the situation where you are interested to be part of the team and have sent a CV to the Human resources department via the website.
Personal data will be kept as long as necessary for the purposes mentioned above.  
Information We Collect
As you use website, we collect information about you and the services you use. The information we collect falls into three different categories: (1) information you give us; (2) information we collect from you automatically; and (3) information we collect from other sources. Some examples of when we collect this information include when you browse create a Starbucks account; use our website to reload Starbucks Card.
Information You Give Us 
Customers - Some information we collect is provided when you use our services. This may include your first and last name, username, password, email address, postal address, phone number,birthday and any other information you give us. Any information provided by you will be considered and will constitute your express consent that your personal data may be used by the Company for the purposes stated below.
The personal data of customers is processed only in cases in which the customer decides to use one of the Company’s loyalty programmes, to participate in one of the Company’s consumer competitions or in the purpose of surveying customer satisfaction (www.experientastarbucks.ro). In such case the personal data of customers (the processed personal data might include, depending on the specific case, the customer’s first name and surname, place of residence, e-mail address, date of birth, telephone number, payment details and, where appropriate, information about his/her order and the places at which purchases are made) is only processed with the consent of the customer, which the customer provides voluntarily in accordance with the rules of the relevant loyalty programme or consumer competition.  If you choose not to provide the requested information, your account will not be created and you will not be able to access the pages for members registered in the system. 
The personal data of customers is processed within the bounds of loyalty programmes for the purpose of making it easier to handle the orders of the relevant customer, marketing (for example, as part of the marketing campaigns of the Company, to provide information about new products, for the delivery of the Company’s commercial communications or to provide notification of prizes won and other benefits pertaining to the customer) and for the purpose of surveying customer satisfaction. Personal data is processed in the case of consumer competitions for the purpose of handing over prizes to the winners of a competition. Personal data can be used to send you information about products, services, events, etc. we offer and host, provided that you ticked the box corresponding to this option in the Loyalty Program registration form, or you submitted such data for one of the purposes mentioned above. 
Employees - The Company processes the personal data of employees to the extent required for the fulfilment of their statutory obligations (for example, the obligation to deduct or levy tax, to keep records for the purposes of health insurance and social security, etc.). The employee is obliged to provide the Company with this data; failure to provide such data would constitute breach of legal regulations by the employee and/or the Company and would lead to the possibility of sanctions being imposed by the competent state bodies.
The Company processes the personal data of employees beyond the scope of that required by law only with their consent and as part of asserting the legitimate interests of the Company or performing the contract entered into by and between the Company and the employee, in particular for the purpose of processing personal data in the CVs of applicants for employment at the Company, the preparation of publicity materials, managing Company profiles on social networks, keeping records of the use of company cars at the Company, providing information about Company events, protecting the property of the Company (primarily using camera systems) or when ensuring access for authorised persons to Company premises. 
Information We Collect Automatically 
Some information is collected by us automatically, including when you access our websites, or otherwise use our services. This information includes: 
Purchasing Information – We may collect information about your transactions in our stores, on our websites including what products you purchase, how frequently you purchase them, any rewards or promotions associated with a purchase. 
Device and Usage Information – We may collect information about your browser or device. This information may include the type of device you are using, your operating system, your browser, your internet service provider, your domain name, your internet protocol (IP) address, your device and mobile ad identifiers, the website that referred you to our website, the web pages you view (including the date and time you viewed them), the services or functionality you access or use (including the date and time of your access or use), and the subject of the ads you click or scroll over. To collect this information, we use cookies, web beacons and similar technologies. The purpose of processing this data is used by the Company to compile statistics which analyse the use of the Website and to personalise advertising.
Using cookies - The Company uses cookies on its Website. Cookies (the term includes "Cookie Internet", "cookie browser", "HTTP cookie" or simply "cookie") are files or information that can be stored on your computer or on mobile devices with Internet access (smartphone or tablet) when you access the Internet. The cookie is installed via the request issued by a webserver to a browser (e.g. Internet Explorer, Chrome) and cannot access information from the user's computer. Please note that this technology does not contain software, viruses or spyware.
We use cookies to make the Site easier to use and to better tailor it to our interests and needs through our offers. Cookies are also used to increase the speed of your future activities and experiences on our Site. These refer to your preference for online privacy or relevant advertising. We also use cookies to compile anonymous aggregated statistics that allow us to understand how people use the Site and to help us improve its structure and contents, excluding the user's personal identification.
The Company uses two types of cookies – session cookies and persistent cookies. Session cookies are used temporarily and remain stored in the User’s device until such time as he/she signs out of the Website or closes the application (web browser). By contrast, persistent cookies remain in the User’s device either for the period of time defined in the parameters of the relevant cookie or until the User him/herself deletes them.
The information obtained through the use of cookies may only be collected for the purpose of mediating and performing certain user functions. This data is encrypted in a way which disables access to unauthorised persons.
The personal data of Users is processed subject to their consent, which is voluntary and is provided by the User either when accessing the Website or is expected in connection with the use of the Website.
Most Internet browsers are initially set to automatically accept cookies. You can change settings to block cookies or be notified when cookies are sent to your computer or mobile device (smartphone, tablet).If you cancel the cookies we use, you no longer receive personalized information when you visit www.starbucksromania.ro.If you use multiple devices to view and access the Site (e.g., your computer, smartphone, tablet, etc.), you need to make sure that each browser on each device is set to match your cookie preferences.By accessing the existing cookie settings in your browsers, you will find indications explaining how you can change the cookie settings. These settings are usually found in the Browser's "Options" or "Preferences" menu. For further information, you can also use your browser's "Help" option.
Using statistical data and anonymous data – The Company may use the statistical data or the anonymous data resulting from the processing for the following purposes:
 preparing reports / analyzes;
 gathering information for own purposes;
publishing, promoting, offering the services provided by AmRest Coffee SRLRights of data subjects 
In accordance with the provisions of Law persons registered as persons concerned shall have the following rights and should benefit from the following information:
• the right to information 
• the purpose of processing
• the right of access to personal data, i.e. the right to receive from the Company confirmation of whether personal data which concerns him/her is or is not processed and if so, he/she has the right to access such personal data and information about;
• the recipients or categories of recipients to which personal data has been or shall be made available; 
• the planned period of storage of personal data or the criteria used to determine the length of this period;the sources of personal data, if such data is not obtained from the applicant;
• the right of intervention on personal data - the existence of the right to demand that the Company correct or delete personal data or restrict the processing of personal data and/or to lodge an objection against the processing of personal data;
• the right of opposition;
• the right not to be subject of an individual decision – the the execution of automated decision-making, including profiling, and about information to concern the procedure used and the meaning and expected consequences for the applicant 
• the transfer of personal data to countries outside the European Union (so-called third countries) or to international organisations and about adequate guarantees regarding the processing of personal data provided in connection with the transfer of such data.
• The customer or the Company, the employee or the User of the Website also has the right to obtain a copy of the processed personal data. However, the rights and freedoms of other persons may not be negatively affected by this right.
• the right to the correction of personal data, if his/her personal data is inaccurate;
• the right to the deletion of personal data (“the right to be forgotten”), if one of the following reasons exists:
 personal data is no longer required for the purposes for which it was collected or otherwise processed;
 withdrawal of consent to the processing of personal data and the non-existence of any further legal grounds for processing;
 justified objections are brought to the processing of personal data;
 personal data has been processed unlawfully;
 personal data must be deleted in order for the legal obligations which bind the Company to be fulfilled;
 personal data has been collected in connection with the offer of services of the information society to a child.
• the right to restrict processing in the following cases: 
 the accuracy of personal data is contested, for the period of time required for the Company to verify the accuracy of personal data; 
 the processing of personal data is unlawful, but the restriction of use of such personal data is demanded instead of its deletion;
 the Company no longer requires the personal data for the purposes of processing, but the applicant requires it for the specification, execution or defence of legal claims; 
 an objection has been lodged against processing in the case of processing personal data for the purposes of the legitimate interests of the Company, until such time as it has been verified whether or not the legitimate grounds of the Company prevail over the legitimate grounds of the person lodging the objection.
• the right to data portability, i.e. the right to obtain personal data to concern him/her in a structured, commonly-used and machine-readable format and the right to transfer such data to another controller (or to request the transfer of data from the Company to another controller) in the case that personal data processing is based on consent or on a contract and is conducted automatically;
• the right to lodge an objection, i.e. the right to lodge a complaint against the processing of personal data for the purposes of the legitimate interests of the Company; and
• the right to lodge a complaint with the Office for Personal Data Protection or with the supervisory authority or, where appropriate, with the competent office of another European Union State.
The customer or Company employee or User of the Website may exercise its rights by contacting the Company. The contact details of the Company are presented below.
The provision of data to other subjects
AmRest Coffee SRL may disclose your personal data to third parties. The Company only provides personal data which it has already processed to partners at which technical and organisational measures for the protection of data and fulfilment of the other obligations arising from the General Data Protection Regulation have been established. Company partners have access to personal data only to the extent required for the performance of their tasks. 
Under no circumstances does the Company provide personal data to other parties in exchange for payment.
Categories of recipients’ personal data can be shared with are:
• AmRest Coffee SRL’s contractual partners (such as the companies AmRest Coffee SRL has a partnership with, but only pursuant to a confidentiality commitment on the latter’s part to ensure that the said data are kept secure and that the provision of such personal information is according to the legislation in force)
• service providers which provide the Company with services relating to the placement of personal data on the common servers of the AmRest Group, the management of applications for loyalty programmes, the assurance of payments for purchases from the Company and the assessment of marketing surveys (e.g. marketing, payment / banking services or other services, including entities assisting the Company in data processing as empowered agents, etc.); The personal data of Company employees is provided to the external accounting firm which compiles accounting, tax and payroll records for the Company;
• public authorities (prosecution bodies, police, courts of law, and other competent bodies of the state), pursuant to and within the limits of the legal provisions and as a result of expressly formulated requests, 
• other companies in the same group as AmRest Coffee SRL, its subsidiaries, and affiliated companies for management and assessment purposes, decision-making, and other business purposes. For example, we can share your information with affiliates and affiliated companies to manage our loyalty programs, orders, and process requests, and to expand and promote our product and service offerings,
• in isolated cases, to companies which provide the Company, and other companies in the AmRest Group, with services which allow Company employees to report cases of violation of legal regulations or cases in which the Company, its partners or other employees adopt(s) an unethical approach.
• and you as a person concerned in the context of exercising your right of access.    
The transfer of personal data abroad
The Company may transfer personal data to other countries within the European Union and, in certain cases, to other countries (USA) whether or not, in the case of such other countries, the European Commission has already decided on the level of protection of personal data equalling the level in existence in the European Union. Personal data is transferred to other companies in the AmRest Group, if required in a specific case, based on a contract, pursuant to which the recipient of personal data undertakes to uphold a high standard of personal data protection (the transfer of personal data is based on “standard clauses” on the protection of personal data according to Article 46(2)(c) of the General Data Protection Regulation) and/or subject to the consent of the person whose personal data is transferred. 
Should AmRest Coffee SRL be required to provide personal data or is not allowed to do so, only the data necessary to fulfill the strict purpose of the request will be disclosed.
Data storage
The Company stores personal data only for the period of time required to achieve the purpose of its processing and does so according to the rules specified hereunder:
• in the case of loyalty programmes, personal data is stored only for the period of duration of the customer’s participation in the loyalty programme; 
• the personal data of Users is stored for a maximum of two years following their last Website visit;
• in the case of employees, personal data is stored for the archiving time limits laid down by law; 
• footage from security cameras is stored for a maximum period of thirty days.
Special provisions relating to minors 
In its data processing activities, AmRest Coffee SRL does not pursue the processing of personal data of minors. Particular attention is paid to ensuring that any processing of personal data pertaining to minors is carried out in accordance with legal requirements and in strictly limited cases.
AmRest Coffee SRL does not carry out promotional direct marketing activities towards minors.  Minors under the age of 18 are not allowed to request services, as well as any communications on the starbucksromania.ro website or to participate in AmRest Coffee SRL competitions or campaigns unless this is done on behalf of the minor by the legal representative or guardian of the minor concerned, according to the law.  
Minors under the age of 18 may purchase products or services and request and receive communications from AmRest Coffee SRL only if they have the consent of their legal representative or guardian, according to the law.
Also, any person who provides us with personal data through the Site or other applications or devices covered by this Policy warrants they are major and have full exercise capacity.
Any collection or processing of minors’ personal data shall be carried out only under the law and in view of the above.
Withdrawing consent to the processing of personal data 
If you want your personal data to be accessed, updated, rectified, deleted under certain circumstances (e.g. when personal data are no longer required for the purposes mentioned above), if you wish to request the data processing restriction under certain circumstances (e.g. when you challenge the accuracy of the data - for a period that would allow us to verify the accuracy of the data concerned); if you wish to file a complaint with us, if you wish to oppose your data processing and wish, at any time, to withdraw your consent for the processing of your personal data that you have previously consented to, you may notify us at any time by means of a written application, dated and signed, to the following address: str. Grigore Cobalcescu no. 46, et. 2, room 11, Sector 1, Bucharest, Romania or to the email address starbucksro_info@amrest.eu
For the exercise of these rights, as well as for any additional questions regarding this notice or relating to AmRest Coffee SRL’s use of personal data, please contact us by choosing any of the communication ways described above, specifying, at the same time, your name, your postal or email address (subject to your communication preference), your phone number, and the purpose of your request. 
You can also contact the Data Protection Officer for the Company, dporomania@amrest.eu  in connection with the processing of personal data at the Company.