Employee Privacy Notice
Last updated 1 June 2021
The Starbucks name and reputation were built on a foundation of trust. This Starbucks privacy notice (“Notice”) describes how Coffee Concepts Retail Co., Ltd. and its parent and other affiliated companies (“Starbucks”, “we” or “us”) collect, use and disclose (“process”) your personal data when you apply for a position in our organization and during and after your employment with us or provision of services to us. The purpose of this Notice is to let you know which personal data we collect about you, the reasons why we process such data and how long we keep it. Starbucks may transmit your information outside of Thailand in the manner and for the purposes described in this Notice.
References in this Notice to “you” or “your” are references to individuals whose information is processed by us or on our behalf in connection with their application for a position in our organization, their employment with us, their provision of services to us including such person’s family member. Please see further information in section “Who Is Concerned by This Notice and From Whom Do We Collect Personal Data?” below.
What Types of Information Does Starbucks Process?
Personal data which identifies you, either directly or indirectly, as an individual (“Personal Data”) that may be processed by Starbucks may include:
- identity data –your first name, last name, nickname, specimen signature, date of birth, gender and information in your household registration, identification (ID) card or passport which contains citizen ID card or passport number, nationality and photograph;
- contact data – private or professional such as your address and e-mail address, phone number and social media account;
- family data – your marital status and details of any dependents, including their name(s), date of birth and gender, next of kin and emergency contact information;
- tax and financial data – your payroll records, tax ID, bank account details and other payment information;
- professional data – your job position, employer, salary, educational background and other information included in the resume or cover letter as part of application process and information in any right to work documentation including work permit and or visas;
- human resources data – record regarding your employment with Starbucks such as start and end date of employment, remuneration history, salary, bonus, performance information, absence information, pension and benefits information, provident fund, work history, working hours, work attendance records, training records, social security or national insurance number and location of workplace;
- CCTV data – closed-circuit television video (“CCTV”) footages that are installed at our head office and our physical stores;
- technical data – your internet protocol (IP) address, technical specifications and login credentials used to connect to Starbucks’ website and apps.
- criminal offence data – your criminal record on the criminal convictions and offences;
- health data – your physical and mental health status (e.g. a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state);
In addition to your Personal Data, you may also in some instances provide us with information about other people, such as name, phone number and email address of the emergency contact and beneficiary. Please see further information in section “Who Is Concerned by This Notice and From Whom Do We Collect Personal Data?” below.
We will not ask for any other sensitive personal data such as data related to your racial or ethnic origins, religious or philosophical beliefs, labour union membership, political opinion, genetic data, biometric data or data concerning your sex life or sexual orientation, unless it is necessary for our operation and we have a lawful basis to do so. Please note that before our processing, we may permanently mask, remove, black out or hide any of your information which is considered sensitive personal data and not necessary for our operation, and in no intention to alter, fabricate or forge the document or information received from you.
Starbucks may also collect aggregated data or anonymized data that does not directly identify you.
We may combine information we collect about you with information we receive from third parties.
In some instances, Starbucks may combine other information with Personal Data. If other information is combined with Personal Data or if other information is used to identify an individual, such information will be treated by us as Personal Data.
Who Is Concerned by This Notice and From Whom Do We Collect Personal Data?
We collect data directly from you as our shareholder, director, executive, candidate, employee, staff, contract employee, temporary worker, secondee, intern, temporary staff, partner or other personnel (collectively, the “Staff”). We may also indirectly collect personal data about other individuals from you whereas they have no direct relationship with us but are related to our Staff such as for instance the following persons:
- spouse and family member;
- parent or legal guardian;
When you provide us with third party personal data like the examples listed above, please remember to inform the individuals providing the data that we process their personal data and direct them to our present Notice.
We may also obtain personal data from:
- third parties such as regulators or Royal Thai Police for investigation purpose; and
- websites/social media pages or those containing information made public by you (e.g. your own website or professional social media platform).
If You Fail to Provide Your Personal Data
Where we are required by law to process your Personal Data or need to process your Personal Data under the terms of a contract we have with you and you fail to provide your Personal Data when requested, we may not be able to perform the contract we have or plan to enter into with you (for example, contribution to social security fund). In this case, we may have to decline to employ or continue to employ you as our Staff, but we will notify you if this is the case at the time your Personal Data is collected.
How Does Starbucks Process Information About You?
We may process your Personal Data insofar as there is a lawful basis for conducting such activities. We collect, use or disclose your Personal Data under the following circumstances:
- employment or service contractor pre-conditions (to take steps at Staff’s request before entering into a contract)
- consideration for position with Starbucks; and
- conducting background screening and confirmation of Staff references and educational background.
- remunerations, benefits and progression (to perform a contract with Staff, to fulfil a legitimate interest of Starbucks or other persons or per consent of the relevant individual)
- reviewing and administering salaries, bonuses, pensions and other benefits;
- evaluating performance and position of Staff which Staff’s work attendance will be taken into consideration; however, we will be using only abnormal time attendance such as late attendance for such purpose;
- administering medical benefits and processing sick leave and medical claims for Staff and family member;
- business operation and administration and security and compliance (to perform contract with Staff, to fulfil a legitimate interest of Starbucks and to establish, exercise or defend our legal claim)
- managing and performing human resource operations/ business including any human resource management and other general business management;
- contacting staff or the family member in the emergency event;
- conduct disciplinary proceeding and investigation;
- security reasons (e.g. record of CCTV footage will be used for detection and prevention of crime; detection and prevention of safety incidents; detection and prevention of unauthorised access to Starbucks’ premises and restricted areas; detection and prevention of gross misconduct; supporting safety, security and internal investigations; supporting criminal investigations; and for reviewing security & safety incidents, including security training exercises).
- more generally including to:
- comply with Starbucks’ internal policy, procedure, standard or administration;
- process with insurance company to assess damages and remedies;
- seek advice from external law firm or other third-party service provider; and
- establish, exercise or defend a legal claim.
- legal and regulatory obligations (to comply with our legal and regulatory obligations)
- cooperate, communicate with relevant authorities and respond to lawful authorities’ order, as needed; and
- comply with legal and regulatory obligations which we are subject to.
In any case, where relying on legitimate interest, we ensure the processing remains proportionate and that your interests or fundamental rights are preserved. For certain types of Personal Data processing, we will provide you with specific information and invite you to consent such processing.
Does Starbucks Share Personal Data with Third Parties?
We share your Personal Data in limited ways:
- We may share your Personal Data within Starbucks for the purposes for which we collected the Personal Data, as described above;
- We may share your Personal Data with companies that provide us with support services (such as payroll service provider, other payment services providers, website hosting, email and postal delivery, insurance companies, external law firms, import custom clearance services providers, VISA and work permit agents, provident fund asset management companies, mailing houses or website hosts and data management services providers). These companies may use your Personal Data to perform their functions on our behalf;
- In the event of a merger, acquisition, financing, or sale of assets or any other situation involving the transfer of some or all of our business assets, we may disclose your Personal Data to those involved in the negotiation or transfer. If a change happens to our business, the part of our business that is (as the case may be) sold, acquired or merged, such entity may process your Personal Data in the same way as set out in this Notice;
- We may share your Personal Data with any other person who is under a duty of confidentiality to us; and
- We may share your information in a way that does not directly identify you (e.g. anonymized data or aggregated data) for statistical analysis and other business purposes.
Do We Transfer Your Personal Data Outside Thailand?
We may transfer your Personal Data to the countries outside of Thailand to our parent and other affiliated companies and our third party service providers as part of our normal business operations to perform our services (e.g. our IT service provider).
In case of international transfers originating from Thailand to another country, the transfer of your Personal Data may take place where the Thailand Personal Data Protection Committee has recognised such country as providing an adequate level of data protection, your Personal Data may be transferred on this basis.
For transfers to the countries where the level of protection has not been recognised as adequate by the Thailand Personal Data Protection Committee, we will either rely on a derogation applicable to the specific situation (e.g. if the transfer is necessary to perform our contract with you) or implement one of the following safeguards to ensure the protection of your Personal Data:
- Standard contractual clauses;
- Binding corporate rules approved by the Office of Thailand Personal Data Protection Committee.
How Long We Retain Your Personal Data?
Your Personal Data processed for the purposes hereunder will be stored only to the extent necessary during the term of your employment with us, for the period necessary to fulfil the purposes outlined in this, including during a transition period (e.g. for the compliance of our obligations regarding data retention as established in applicable laws), or responding to legal claims or regulatory requests (if any).
In principle we will retain your Personal Data as long as required or permitted by applicable law. For instance, most of your data is kept for the duration of the employment relationship and 10 years after the end of the employment, in accordance with statute of limitation in relation to employment litigation case under Thai law.
When Personal Data is no longer needed, or in any event, after legal authority to retain it has expired, we will remove your Personal Data from our systems and records and/or take steps to properly anonymize it.
What If I Am A Minor?
We welcome everyone to become part of our Starbucks’ community, However, if you are under the age of 20, an additional consent from your legal guardian is required prior to becoming part of our team or having any interactions with us by any means.
How is Personal Data Secured?
Starbucks takes reasonable steps to maintain appropriate physical, technical and administrative security to help prevent loss, misuse, unauthorized access, disclosure or modification of Personal Data.
While we take these reasonable efforts to safeguard your Personal Data, no system or transmission of data over the Internet or any other public network can be guaranteed to be absolutely secure. You are responsible for protecting your password(s) and maintaining the security of your devices.
Privacy Notice Updates
Notice went into effect on date at the top of this page. We may update this Notice from time to time.
We will notify you of any material changes through our website or through our other usual communication channels that might affect the way we collect, use or disclose your Personal Data. We encourage you to look for updates and changes to this Notice by checking the date of our Notice when you visit our Sites..
We welcome your questions, comments and concerns relating to our processing of your Personal Data under this Notice. You may contact us by email at firstname.lastname@example.org, or by phone at 02-339-0996.
Coffee Concepts Retail Co., Ltd.
12th, 16th floors, Exchange Tower, 388 Sukhumvit Road, Klongtoey, Bangkok 10110 Thailand