COSTA PARTNERSHIPS PORTAL PRIVACY NOTICE

What does this policy cover?

Costa Limited and its wholly owned Subsidiaries ("Costa", "We", "Us") processes your personal data when you access Costa’s systems (“the Systems”). This policy only relates to Costa Limited’s processing and describes how Costa will make use of your data when you access the portal whether you are an employee of a Costa Franchisee, a business partner, a bottler or as a supplier of Costa.

You have the right to object to some of the processing which Costa carries out. More information about your rights and how to exercise these is set out in the “Your rights” section of this notice.

What information do we collect?

We collect and process personal data about you when you access this site. This includes:

  • Business email address

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

As required by Costa to conduct our business and pursue our legitimate interests, in particular:

  • verifying your identity;

  • communicating with you; and

  • providing account maintenance and support services.

  • monitoring use of our systems for audit and security purpose, and use of your information to help us monitor, improve and protect our Systems, both online and offline;

  • monitoring user accounts to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law; and

  • we use information you provide to investigate any complaints received from you or from others, about our systems, products or services;

For purposes which are required by law:

  • In response to requests by government or law enforcement authorities conducting an investigation.

Who will we share this data with, where and when?

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of Costa for the purposes identified above and providers for hosting and maintenance and data storage.

In the event that the business is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business.

If you require further information about whom we share your data with, you can contact us at costadpo@costacoffee.com.

No personal data provided is shared outside of the UK.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format, and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the UK Information Commissioner’s Office or relevant data protection authority where you live, work or where you believe a breach may have occurred.

For accessing Costa’s Systems, the provision of information is mandatory: if relevant data is not provided, then we will not be able to provide access to the Systems.

How do I get in touch with you or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, by writing to Costa Limited, 3 Knaves Beech Business Centre, Davies Way, Loudwater, High Wycombe, Buckinghamshire, HP10 9QR. You can also get in touch with Costa’s data protection officer at costadpo@costacoffee.com

Which Costa entity is my data controller, and which affiliates might my data be shared with?

The data controller for your information is the Costa Limited.

How long will you retain my data?

We process data only for as long as necessary for the identified purposes. In particular, where we process personal data for security and audit purposes, we retain it for 13 months.

For more information on our retention periods, you can contact us at the details provided above.

Cookies and similar technologies

This site use cookies and similar technologies. Full information is in our Cookie Notice. This includes information on how to adjust your browser settings to accept or reject cookies.