Privacy Policy
1. Introduction
Shaya Kahve Sanayi ve Ticaret Anonim Şirketi (“Alshaya”, “Company”, “we”, “us”, “our”) respects your privacy and is committed to protect and process your personal data fairly and transparently, in accordance with the provisions of Law of Georgia on Personal Data Protection (“PDP Law”).
Since visiting www.starbucks.ge and/or accessing our mobile application (“Mobile Application”) implies collection and processing of your personal data, we have developed and hereby make available to you our Privacy Policy (“Privacy Policy” or “Policy”) in order for you to fully understand what data do we collect and when, how and why we use it, to whom do we disclose personal data and how we keep it secure alongside other relevant information. Within this Privacy Policy you can also find information on your rights as data subject and how can you exercise them.
Before accessing, browsing or otherwise using this Website/Mobile Application, please read carefully this Privacy Policy. Our Website/Mobile Application may contain links to third party websites and services. Please remember that when you use a link to go from our Website to another website or when you request a service from a third party, this Privacy Policy no longer applies, and you shall be subject to the third party’s privacy policy. If anything is unclear to you or should you require more information on any section of this Privacy Policy, please feel free to contact us using the details below.
In order for you to browse this Privacy Policy more easily, please find below a glossary of the relevant legal terms/notions and their definitions/explanations:
Legal Term
Definition / Explanation
Personal data
any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Special categories of personal data
data connected to a natural person’s racial or ethnic origin, political views, religious or philosophical beliefs, membership of professional organizations, state of health, sexual life, criminal history, administrative detention, putting a person under restraint, plea bargains, abatement, recognition as a victim of crime or as a person affected, also biometric and genetic data that allow to identify a natural person by the above features.
Data subject
any natural person whose personal data is processed.
Processing
any operation performed in relation to the data by automated, semi-automatic or non-automatic means, in particular collection, recording, photographing, audio recording, video recording, organization, storage, alteration, restoration, request for access to, use or disclosure by way of data transmission, dissemination or otherwise making them available, grouping or combination, locking, deletion, or destruction.
Controller
the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data and who, directly or through a data processor, processes personal data.
Processor
a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient
a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, except for a Personal Data Protection Service.
Consent
Freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Online identifiers
internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags provided by data subject devices, applications, tools and protocols. These may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of natural persons and identify them.
Profiling
any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s preferences.
2. Who Are We and How to Contact Us?
The controller of your personal data is Shaya Kahve Sanayi ve Ticaret Anonim Şirketi, a company registered and functioning under the laws of Türkiye, with headquarters in Yamanevler Mah. Site Yolu Cad. Anel İş Merkezi No:5 Ümraniye, İstanbul, Türkiye, duly registered under identification No. 495157-0
If you have any questions about this Privacy Policy, including about your rights as the data subject, or want to exercise any of your rights set out in this Policy, please contact us using the following contact details:
· E-mail address: starbucks-ge-app@alshaya.com
3. What Personal Data Do We Collect & When We Collect It?
Depending upon your interaction with our Website and on the services you choose to use, we can collect the following personal data about you:
(a) Categories of personal data we obtain directly from you:
When you interact with us through our Website or mobile application, we may collect the following categories of your personal data:
· Name and surname;
· Age and gender (optional);
· Contact information (email, phone number);
· Account password and login details, account ID;
· Customer transaction information (transaction confirmation, purchase/order history, store information, product information, location (not retained), number of loyalty points, membership-related information);
· Your interactions with the Mobile Application/Website (any written or phone (audio) requests, complaints, preferences, push settings, etc.).
(b) Categories of personal data we may collect automatically when you interact with our Website and our services, depending on your browser settings:
Online identifiers and other data such as:
· IP Address - when visiting our Website/Mobile Application we can collect an automatically populated IP address assigned to your device. An IP address is a unique number which allows a computer, group of computers or another internet connected device (such as your mobile phone or tablet) to browse the internet;
· Device information (device type, operating system, software versions, configuration settings, internet connection details), including location data (upon your confirmation);
· Website usage and browsing history - we can also record the time and date of your visit, the pages that were requested, the referring website (if provided) and your internet browser version;
· Cookie information
(c) We do not purposely collect:
· Special categories of data - Alshaya does not request you to provide information on your health, racial or ethnic origin, personal beliefs or sexual orientation or any other special categories of data defined under the PDP Law. However, in case you may deliberately provide us with such details while communicating with us, soliciting our assistance or while submitting a complaint, we shall process such special category data in order to reply, assist you or otherwise settle your complaint.
(d) When does Alshaya collect your personal data?
In general, we collect your personal data when you choose to interact with us through our website or otherwise online. This may include the following scenarios:
· Visiting our Website/Mobile Application.
· Registering a user account.
· Subscribing to our newsletter and/or marketing communications and interacting with our e-mail newsletters / marketing communications.
· Contacting us via telephone, email, or through the "Contact Us" section of our Website for any reason.
· Completing surveys we send to you for research purposes (participation is entirely voluntary).
4. Main Principles of Personal Data Processing
In the Company’s daily operations, we strictly adhere to the following data processing principles as per the PDP Law, under which, personal data processed by us is:
ü lawfulness, fairness, and transparency - processed lawfully, fairly and in a transparent manner in relation to the data subject.
ü specific purposes - collected for specific, explicit and legitimate purposes and not further processed in a manner that is incompatible with those initial purposes.
ü data minimization - adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
ü accuracy - accurate and, where necessary, kept up to date;
ü storage limitation - kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in public interest, scientific or historical research purposes or statistical purposes.
ü integrity and confidentiality - processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures.
5. Purposes of Data Processing
Your personal data obtained through our Mobile Application/Website is processed only for specified, explicit and legitimate purposes. In particular, depending on your interaction with us, we may process your personal data for the following purposes:
to provide you with our products and services – for example, creating and managing your user account, processing your orders, handling payments, delivering products and providing after-sales support;
to manage customer relationships and communications – for example, responding to your requests and complaints, providing customer support and maintaining ongoing communication with you through various channels;
to conduct sales and operational activities – for example, managing in-store purchases, online orders, gift card services and corporate sales processes;
to improve our products, services and customer experience – for example, analyzing customer behavior, conducting surveys, improving service quality and optimizing website and application performance;
to carry out marketing and promotional activities (where permitted by law) – for example, sending newsletters, personalized offers, campaigns and invitations to events;
to manage loyalty and reward programs – for example, administering membership benefits, points, campaigns and customer engagement activities;
to comply with legal and regulatory obligations – for example, maintaining records, fulfilling statutory requirements and providing information to competent authorities;
to ensure security and prevent fraud – for example, protecting our IT systems, ensuring secure use of our Website and Mobile Application and preventing misuse.
6. Grounds for Data Processing
Your personal data obtained through our Website/Mobile Application may be processed where at least one of the following legal grounds applies under the PDP Law:
Processing is necessary to take steps at your request prior to entering into a contract or for the performance of a contract to which you are a party.
Examples:
creating and managing your user account;
providing gift cards and loyalty program services;
responding to your requests submitted through customer support channels.
Processing is necessary for compliance with legal or regulatory requirements applicable to Alshaya.
Examples:
maintaining accounting and tax records;
providing information to supervisory authorities during inspections;
complying with consumer protection and other regulatory obligations.
You have given us your freely given, specific, informed and unambiguous consent for the particular processing activity. You have the right to withdraw your consent at any time.
Examples:
· subscribing to newsletters and marketing communications;
· receiving promotional offers and campaigns.
Processing is necessary for the purposes of the legitimate interests pursued by Alshaya, provided that such interests are not overridden by your fundamental rights and freedoms. In particular, our legitimate interests include:
Enhancing customer experience – understanding customer satisfaction in order to improve our products, services, Website performance and support processes;
Maintaining competitive advantage – analysing customer preferences and expectations to tailor offerings and improve quality of products and services;
Strengthening brand reputation and trust – monitoring customer experience to maintain high standards and foster customer loyalty;
Understanding customer needs – analysing interests expressed through our Website and platforms to offer relevant products and services;
Monitoring employee performance and service standards – ensuring that employees provide services in accordance with established quality standards.
Examples:
conducting analytics and reporting;
improving customer support processes;
managing customer relationships and communications;
ensuring IT security and preventing fraud.
7. Processing of Voice Data via Our Call Center
When you contact our call center, your call will be recorded and your voice data processed by Alshaya for the purposes of enhancing your customer experience, providing adequate support, ensuring quality assurance, and training our staff. You will be notified at the beginning of the call that the conversation is being recorded, and by continuing the call, you acknowledge this notice. The legal basis for this processing is your consent, providing service to you and our legitimate interest in delivering high-quality customer service.
The data collected includes the voice recording, your phone number, the date and time of the call, and any personal information you share during the conversation. Voice recordings are accessible only to authorized personnel, after which they are securely destroyed in line with Storage and Destruction Policy. In case of any questions regarding your data processing, including audio monitoring, you can use your rights as defined in section 14 of this Privacy Policy.
8. Profiling
We do not make any decisions about you using automated decision-making processes (i.e., decisions made solely by automated means without human involvement) that produce legal or similarly significant effects on you.
However, we do engage in profiling, which is carried out manually by our staff, in order to enhance your experience and provide you with relevant communications. Specifically, we use profiling to:
Deliver personalized offers tailored to your preferences;
Include you in exclusive marketing lists; and
Conduct loyalty targeting based on your engagement with our brand.
To conduct manual profiling, we process the following data: your purchase history, preferences, age (optional), gender (optional), and app usage. This allows us to share offers that match your interests while avoiding promotions for products unavailable in your region.
You may choose to opt out of profiling at any time by adjusting your marketing cookie preferences (if you have previously consented) or by contacting us directly with your request.
9. How Long Do We Keep Your Personal Data?
Our Company has established a Storage and Destruction Policy for the storage and deletion of personal data. Storage and destruction procedures regarding your personal data are carried out within the scope of this policy. Accordingly, if a period of time is specified for the storage of data in the relevant laws of Georgia, the data in question must be kept for at least this period.
Considering the possibilities such as the late receipt of a possible court request or the request of an administrative authority authorized by law regarding the relevant data or the occurrence of a dispute to which we may be a party, the retention period of the data is determined by adding a period of 6 months to 1 year to the periods stipulated in the legislation for the storage of your data, and at the end of the specified period, the data in question are deleted, destroyed or anonymized.
If the legislation does not stipulate a period of time for the storage period of the data we process, your data will be deleted, destroyed or anonymized without any need for your request after the expiration of the 10 years from the termination of our legal relationship, taking into account possible disputes as required by the relationship between us.
If all the conditions for processing personal data have disappeared or the retention period declared by us or determined within the scope of the legislation has expired, your data will be deleted, destroyed or anonymized ex officio on the first periodic destruction date or within 6 months at the latest. If you request the deletion of your data for a valid reason, your data will be deleted within the timeframe established by PDP law or any other applicable law.
10. Use of Cookies or Similar Devices
We use cookies on our Website. This helps us to provide you with a better experience when you browse our website and also allows us to make improvements to our site.
For further information about our use of cookies and on how to avoid them, please consult our cookie policy, available at our Cookie Policy page.[PwC3]
11. Data Confidentiality and Security
The Company is committed to keeping the personal data secure and takes adequate measures to protect such data from loss, misuse, or unauthorized alteration or any other form of unauthorized processing. Alshaya has implemented personal data security procedures and technical measures to protect personal data against threats, including unauthorized access, improper use or disclosure, unauthorized modification, unlawful destruction or accidental loss. Those measures, amongst others, include the following:
· Confidentiality obligation - employees who handle personal data on behalf of Alshaya are bound by strict confidentiality obligation and are reminded regularly of their responsibility to maintain data confidentiality.
· Access rights - access to personal data is strictly on a need-to-know basis. Access to personal data is granted solely to fulfill job responsibilities as specified in employment contract.
· Disciplinary measures - employees must process and use personal data strictly in accordance with this Policy and for job-related purposes only. Any breach of this Policy may result in disciplinary action, including termination of employment, if necessary.
· Employee training and awareness - to ensure employees are informed and up-to-date on data protection standards, the Company provides data processing training sessions and workshops for those involved in data processing activities.
· Third-party management - when engaging third parties for data processing, Alshaya selects data processors with robust technical and organizational standards for data protection. Furthermore, the Company ensures these third parties comply with their legal and contractual obligations by executing data processing agreements with each one.
· Transparency - Alshaya ensures that the data subjects are always duly informed about the data processing activities carried out by the Company and about their rights as the data subjects. Alshaya’s procedures ensure that data subjects can easily exercise these rights in compliance with applicable legal requirements.
· Technical safeguards - the security of the data processing activities is also ensured by the implementation of adequate technical safeguards such as encryption of personal data and regularly monitoring our servers and IT systems for possible vulnerabilities and attacks.
· Audits and compliance checks - internal audits are conducted to assess compliance with the implemented data protection policies, legislation and to identify areas for improvement. Results of these audits are used to refine the Company’s data protection measures and reinforce accountability within the organization.
12. To Whom Do We Disclose Your Data?
Personal data that is collected and processed by Alshaya can be disclosed to its business partners, suppliers, third parties that Alshaya receives services from or cooperates with, to legally authorized public agencies and natural persons whether in Georgia or abroad for the purposes set forth in this Policy. For instance, in the event of a dispute or administrative proceeding, the personal data of a third party may be transferred to a court or an administrative body; in order to conduct the customer satisfaction survey, your personal data will be shared to our service provider who assists us in conducting the survey; your personal data may also be shared to other companies that provide services for or on behalf of Alshaya, for the purposes of providing such services (for example, Alshaya may share your personal data with external providers of IT related services) etc.
All our partners have undertaken to ensure and to protect the confidentiality of your personal data. We always conclude written contracts and data processing agreements with our partners which provide assurances in relation to their adherence to Georgian data security standards and to the implementation of adequate technical and organizational measures designed to protect your personal data. We do not, and shall not, sell any of your personal data to any third party.
13. Data Processing in Turkey
We are an international business established in Turkey, therefore, your personal data is processed outside the territory of Georgia, specifically in Turkey. We hereby inform you that the State Audit Office of Georgia has yet to decide that Turkey ensures an adequate level of personal data protection. Accordingly, Turkey is not named by the State Audit Office in Georgia in the “whitelist” of countries with proper security guarantees for personal data protection. Please, however, note that Alshaya Group companies operate in accordance with the consistent data processing standards applicable within the group by taking adequate legal, organizational, technical and security measures.
You, as the data subject, hereby give an explicit consent to the data controller, Shaya Kahve Sanayi ve Ticaret Anonim Şirketi, a company with its headquarters in Turkey, for the processing of the personal data in accordance with this policy. In case you do not agree to the processing and/or reception of your personal data by Shaya Kahve Sanayi ve Ticaret Anonim Şirketi, a company with its headquarters in Turkey, please do not use our Website or Mobile Application. When justified or necessary, we will transfer your personal data to partners/entities established or owning servers in third countries in a manner consistent with legal requirements. In all cases, any transfer of your personal data will be compliant with applicable data protection laws and standards.
14. Special Representative
In accordance with the Article 34 of PDP law, Alshaya has appointed Alshaya Georgia LLC ( a company established under the laws of Georgia, with regsitered address at: Georgia, Tbilisi, Saburtalo district, Merab Aleksidze street, N 12, floor 7, block ''B'', office space N 38 , with identification number: 402109758) as a special representative (“Special Representative”). Accordingly, the Special Representative will be obliged to comply with a request and/or decision made by the Auditor General in the manner provided for by PDP Law.
15. What Are Your Rights as Data Subject?
You as the data subject have the following rights specified under the Georgian legislation:
· Right to receive information on the processing of data – request confirmation of whether your data is being processed; ascertain the justification for such data processing, including information about the purpose and the grounds of the processing; request the information on the source of data collection, the period of data storage or the criteria to decide the storage periods if a specific period is impossible to assess; request the identity or category of data receiver and if the data is transferred to a third party, provide information on the grounds and purpose of the data transfer; upon request, receive all essential information regarding the processing of your personal data, free of charge;
· Right to access and to obtain a copy - access your processed personal data and receive copies free of charge, unless a fee is mandated by the legislation or determined by Alshaya, as long as it is reasonable and justified due to the resources required for providing copies in a format other than data storage, or due to the frequency of such requests;
· Right to the rectification, update and completion of data - request correction, update, and/or completion of false, inaccurate, and/or incomplete personal data;
· Right to the termination of the processing, ensure or destruction of data - request the termination of data processing, erasure and/or destruction of your personal data (except for cases stipulated by the PDP Law);
· Right to the blocking of data - request the restriction (blocking) of data in the following cases: a) the authenticity or accuracy of the data is contested by the data subject; b) the processing of the data is unlawful, although the data subject opposes the erasure of the data and requests their blocking; c) the data are no longer needed for the purposes of the processing, but they are required by the data subject to lodge a complaint/claim; d) the data subject requests the termination of the processing, erasure or destruction of the data and this request is being considered; e) there is a need to retain the data for use as evidence;
· Right to the transmission of data - to receive the data provided by you in a structured, publicly usable and machine-readable format, or request the transfer of such data to another data controller, if (a) data processing is carried out on the basis of your consent and/or if data processing is necessary to fulfill a contractual obligation with you, (b) is subject to automatic data processing and (c) it is technically possible to do so;
· Automated individual decision-making and related rights – you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or similarly significantly affects you, unless the decision based on profiling is made on the bases of the specific legal grounds indicated in the PDP Law;
· Right to withdraw consent - revoke the consent for the processing of your personal data (e.g. consent for receiving marketing communication, consent for profiling, consent for data transfer etc.) at any time without the need for explanation or justification (if a consent is obtained for data processing). Nonetheless, if there are other legitimate grounds for data processing, Alshaya may continue to process the personal data, even after the data subject’s consent has been withdrawn;
Right to appeal - in case of violation of the rights, you can apply to the State Audit Office of Georgia (address: Ketevan Dedopali ave. N96, Tbilisi, Georgia) or the court (Davit Aghmashenebeli Alley, N64, Tbilisi, Georgia).
16. How You Can Exercise Your Rights as Data Subject?
Submitting a request - for the exercise of your rights, you shall submit the request in writing, including via an email, using the contact details indicated in this Policy.
Identification of the applicant - to be able to properly address and manage the requests, Alshaya urges the data subjects to identify themselves as completely as possible. In case the Company has reasonable doubts as to the identity of the applicant, it will ask for further information to confirm the alleged identity.
Providing an answer - Alshaya will provide you with the response and any requested information in electronic format unless you request them to be provided in another format and such format do not requires inadequate effort or expenses.
In case of refusal - if we refuse to meet your request, we will inform you the reasons which led to this decision.
17. Other Provisions
This Privacy Policy have been last updated as of 30.06.2026 and are to be governed by the Georgian law.
This Policy represents the formalization of Alshaya’s compliance with Georgian legislation.
To ensure that we keep you updated on how we use your personal data and that we comply with all relevant and applicable data protection legislation and recommendations/opinions issued by competent authorities in the data protection field, we will update this Privacy Policy from time to time to reflect any changes we undertake. In case of significant changes, we shall notify you by e-mail (if such data is available to us). However, we recommend you to check this Policy periodically our Website to inform yourself of any changes.