Employee Privacy Notice
Last updated 1 February 2022
The Starbucks name and reputation were built on a foundation of trust. This Starbucks privacy notice (“Notice”) describes how Coffee Concepts Retail Co., Ltd. and its parent and other affiliated companies (“Starbucks”, “we” or “us”) collect, use and disclose (“process”) your personal data when you apply for a position in our organization and during and after your employment with us or provision of services to us. The purpose of this Notice is to let you know which personal data we collect about you, the reasons why we process such data, how long we keep it and what your rights are and how you can exercise them. Starbucks may transmit your information outside of Thailand in the manner and for the purposes described in this Notice.
References in this Notice to “you” or “your” are references to individuals whose information is processed by us or on our behalf in connection with their application for a position in our organization, their employment with us, their provision of services to us including such person’s family member. Please see further information in section “Who Is Concerned by This Notice and From Whom Do We Collect Personal Data?” below.
What Types of Information Does Starbucks Process?
Personal data which identifies you, either directly or indirectly, as an individual (“Personal Data”) that may be processed by Starbucks may include:
- identity data –your first name, last name, nickname, specimen signature, date of birth, gender and information in your household registration, identification (ID) card or passport which contains citizen ID card or passport number, nationality and photograph;
- contact data – private or professional such as your address and e-mail address, phone number and social media account;
- family data – your marital status and details of any dependents, including their name(s), date of birth and gender, next of kin and emergency contact information;
- tax and financial data – your payroll records, tax ID, bank account details and other payment information;
- professional data – your job position, employer, salary, educational background and other information included in the resume or cover letter as part of application process and information in any right to work documentation including work permit and or visas;
- human resources data – record regarding your employment with Starbucks such as start and end date of employment, remuneration history, salary, bonus, performance information, absence information, pension and benefits information, provident fund, work history, working hours, work attendance records, training records, social security or national insurance number and location of workplace;
- CCTV data – closed-circuit television video (“CCTV”) footages that are installed at our head office and our physical stores;
- technical data – your internet protocol (IP) address, technical specifications and login credentials used to connect to Starbucks’ website and apps.
- criminal offence data – your criminal record on the criminal convictions and offences;
- health data – your physical and mental health status (e.g. a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state);
In addition to your Personal Data, you may also in some instances provide us with information about other people, such as name, phone number and email address of the emergency contact and beneficiary. Please see further information in section “Who Is Concerned by This Notice and From Whom Do We Collect Personal Data?” below.
We will not ask for any other sensitive personal data such as data related to your racial or ethnic origins, religious or philosophical beliefs, labour union membership, political opinion, genetic data, biometric data or data concerning your sex life or sexual orientation, unless it is necessary for our operation and we have a lawful basis to do so. Please note that before our processing, we may permanently mask, remove, black out or hide any of your information which is considered sensitive personal data and not necessary for our operation, and in no intention to alter, fabricate or forge the document or information received from you.
Starbucks may also collect aggregated data or anonymized data that does not directly identify you.
We may combine information we collect about you with information we receive from third parties.
In some instances, Starbucks may combine other information with Personal Data. If other information is combined with Personal Data or if other information is used to identify an individual, such information will be treated by us as Personal Data.
Who Is Concerned by This Notice and From Whom Do We Collect Personal Data?
We collect data directly from you as our shareholder, director, executive, candidate, employee, staff, contract employee, temporary worker, secondee, intern, temporary staff, partner or other personnel (collectively, the “Staff”). We may also indirectly collect personal data about other individuals from you whereas they have no direct relationship with us but are related to our Staff such as for instance the following persons:
- spouse and family member;
- parent or legal guardian;
When you provide us with third party personal data like the examples listed above, please remember to inform the individuals providing the data that we process their personal data and direct them to our present Notice.
We may also obtain personal data from:
- third parties such as regulators or Royal Thai Police for investigation purpose; and
- websites/social media pages or those containing information made public by you (e.g. your own website or professional social media platform).
If You Fail to Provide Your Personal Data
Where we are required by law to collect your information or need to collect your information under the terms of a contract we have with you and you fail to provide your information when requested, we may not be able to perform the contract we have or plan to enter into with you (for example, contribution to social security fund). In this case, we may have to decline to employ or continue to employ you as our Staff, but we will notify you if this is the case at the time your information is collected.
How Does Starbucks Process Information About You?
We may process your Personal Data insofar as there is a lawful basis for conducting such activities. We collect, use or disclose your Personal Data under the following circumstances:
- employment or service contractor pre-conditions (to take steps at Staff’s request before entering into a contract)
- consideration for position with Starbucks; and
- conducting background screening and confirmation of Staff references and educational background.
- remunerations, benefits and progression (to perform a contract with Staff, to fulfil a legitimate interest of Starbucks or other persons or per consent of the relevant individual)
- reviewing and administering salaries, bonuses, pensions and other benefits;
- evaluating performance and position of Staff which Staff’s work attendance will be taken into consideration; however, we will be using only abnormal time attendance such as late attendance for such purpose;
- administering medical benefits and processing sick leave and medical claims for Staff and family member;
- business operation and administration and security and compliance (to perform contract with Staff, to fulfil a legitimate interest of Starbucks and to establish, exercise or defend our legal claim)
- managing and performing human resource operations/ business including any human resource management and other general business management;
- contacting staff or the family member in the emergency event;
- conduct disciplinary proceeding and investigation;
- security reasons (e.g. record of CCTV footage will be used for detection and prevention of crime; detection and prevention of safety incidents; detection and prevention of unauthorised access to Starbucks’ premises and restricted areas; detection and prevention of gross misconduct; supporting safety, security and internal investigations; supporting criminal investigations; and for reviewing security & safety incidents, including security training exercises).
- more generally including to:
- comply with Starbucks’ internal policy, procedure, standard or administration;
- process with insurance company to assess damages and remedies;
- seek advice from external law firm or other third-party service provider; and
- establish, exercise or defend a legal claim.
- legal and regulatory obligations (to comply with our legal and regulatory obligations)
- cooperate, communicate with relevant authorities and respond to lawful authorities’ order, as needed; and
- comply with legal and regulatory obligations which we are subject to.
In any case, where relying on legitimate interest, we ensure the processing remains proportionate and that your interests or fundamental rights are preserved. For certain types of Personal Data processing, we will provide you with specific information and invite you to consent such processing. Note that you may request to revoke your consent at any time, please refer to section “What Are Your Statutory Rights and What Choices Does Starbucks Offer About Personal Data?” below.
Does Starbucks Share Personal Data with Third Parties?
We share your Personal Data in limited ways:
- We may share your Personal Data within Starbucks for the purposes for which we collected the Personal Data, as described above;
- We may share your Personal Data with companies that provide us with support services (such as payroll service provider, other payment services providers, website hosting, email and postal delivery, insurance companies, external law firms, import custom clearance services providers, VISA and work permit agents, provident fund asset management companies, mailing houses or website hosts and data management services providers). These companies may use your Personal Data to perform their functions on our behalf;
- In the event of a merger, acquisition, financing, or sale of assets or any other situation involving the transfer of some or all of our business assets, we may disclose your Personal Data to those involved in the negotiation or transfer. If a change happens to our business, the part of our business that is (as the case may be) sold, acquired or merged, such entity may process your Personal Data in the same way as set out in this Notice;
- We may share your Personal Data with any other person who is under a duty of confidentiality to us; and
- We may share your information in a way that does not directly identify you (e.g. anonymized data or aggregated data) for statistical analysis and other business purposes.
Do We Transfer Your Personal Data Outside Thailand?
We may transfer your Personal Data to the countries outside of Thailand to our parent and other affiliated companies and our third party service providers as part of our normal business operations to perform our services (e.g. our IT service provider).
In case of international transfers originating from Thailand to another country, the transfer of your Personal Data may take place where the Thailand Personal Data Protection Committee has recognised such country as providing an adequate level of data protection, your Personal Data may be transferred on this basis.
For transfers to the countries where the level of protection has not been recognised as adequate by the Thailand Personal Data Protection Committee, we will either rely on a derogation applicable to the specific situation (e.g. if the transfer is necessary to perform our contract with you) or implement one of the following safeguards to ensure the protection of your Personal Data:
- Standard contractual clauses;
- Binding corporate rules approved by the Office of Thailand Personal Data Protection Committee.
How Long We Retain Your Personal Data?
Your Personal Data processed for the purposes hereunder will be stored only to the extent necessary during the term of your employment with us, for the period necessary to fulfil the purposes outlined in this, including during a transition period (e.g. for the compliance of our obligations regarding data retention as established in applicable laws), or responding to legal claims or regulatory requests (if any).
In principle we will retain your Personal Data as long as required or permitted by applicable law. For instance, most of your data is kept for the duration of the employment relationship and 10 years after the end of the employment, in accordance with statute of limitation in relation to employment litigation case under Thai law.
When Personal Data is no longer needed, or in any event, after legal authority to retain it has expired, we will remove your Personal Data from our systems and records and/or take steps to properly anonymize it.
What Are Your Statutory Rights and What Choices Does Starbucks Offer About Personal Data?
We believe in putting you in control of your Personal Data. You have the following rights under the conditions set out under applicable law and regulations pursuant to the conditions and requirements set forth thereunder
Right of access: You have the right to obtain from us the access to your Personal Data under our responsibility, or request that we disclose how your Personal Data is obtained without your consent. You have the right to obtain a copy of the processing of your Personal Data. For additional copies requested by you, we may charge a reasonable fee based on administrative costs as permitted by Personal Data Protection Act B.E. 2562 (2019).
Right to rectification: You have the right to obtain from us the rectification of your inaccurate or incomplete Personal Data to be accurate, up to date, completed, and not misleading.
Right to erasure: You have the right to ask us to erase, destroy or anonymize your Personal Data, to the extent permitted by law. Note that this is not a blanket right to require all your Personal Data to be deleted. We will consider each request carefully in accordance with the requirements of any laws relating to the processing of your Personal Data.
Right to data portability: You have the right to receive your Personal Data which you have provided to us unless it is impossible by technical circumstances. You also have the right to request us, where technically feasible, to directly send or transfer your Personal Data in such formats to other data controller if it can be done by the automatic mean.
Right to object: You have the right to object to collection, use or disclosure of Personal Data, on grounds relating to your particular situation., in accordance with the statutory provisions. If you file an objection, we will continue to collect, use or disclose your Personal Data only if we can document legitimate reasons that outweigh your interests, rights and freedoms, or if collection, use or disclosure is for the assertion, exercise or defence of legal claims or scientific, historical research or statistical, as may be applicable.
Right to withdraw consent: If you have consented to collection, use or disclosure of your Personal Data by us, you have the right to withdraw your consent at any time.
Right to file a complaint: You have the right to file a complaint with the responsible data protection supervisory authority, in the case where, in your view, we, our Staff or service providers violate or fail to comply with the Personal Data Protection Act B.E. 2562 (2019) or notifications issued thereunder.
If you wish to exercise the rights listed above, please submit a data subject request form which is available here Data Subject Request form
We may need to request specific information from you to help us confirm your identity and ensure your right to access your information (or to exercise any of your other rights). This is a se(–Link–)curity measure to ensure that your information is not disclosed to any person who has no right to receive it. Please include a scan/copy of your proof of identity for identification purpose when required.
You will not have to pay a fee to access your information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
In accordance with applicable regulation, in addition to your rights above, you are also entitled to lodge a complaint where, in your view, we or our Staffs violate or fail to comply with the Personal Data Protection Act B.E. 2562 (2019) or notifications issued thereunder, with the Personal Data Protection Committee.
We try to respond to all legitimate requests within 30 days. Occasionally it may take us longer than 30 days if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
What If I Am A Minor?
We welcome everyone to become part of our Starbucks’ community, However, if you are under the age of 20, an additional consent from your legal guardian is required prior to becoming part of our team or having any interactions with us by any means.
How is Personal Data Secured?
Starbucks takes reasonable steps to maintain appropriate physical, technical and administrative security to help prevent loss, misuse, unauthorized access, disclosure or modification of Personal Data.
While we take these reasonable efforts to safeguard your Personal Data, no system or transmission of data over the Internet or any other public network can be guaranteed to be absolutely secure. You are responsible for protecting your password(s) and maintaining the security of your devices.
Privacy Notice Updates
Notice went into effect on date at the top of this page. We may update this Notice from time to time.
We will notify you of any material changes through our website or through our other usual communication channels that might affect the way we collect, use or disclose your Personal Data. We encourage you to look for updates and changes to this Notice by regularly checking the date of our Notice when you visit our Site.
We welcome your questions, comments and concerns relating to our processing of your Personal Data under this Notice. You may contact us by email at email@example.com
Coffee Concepts Retail Co., Ltd.
12th, 16th floors, Exchange Tower, 388 Sukhumvit Road, Klongtoey, Bangkok 10110 Thailand