Starbucks says it strives to follow data minimization, limited collection and limited use
Starbucks says that, to protect your privacy and comply with applicable privacy and data protection laws, it "strives" to consider its data governance practices through the principles of data minimization, limited collection and limited use. This is a statement of effort and approach, not a specific rule or guarantee about any data type.
Supporting quotations
we strive to consider our data governance practices through the lens of the recognized principles of data minimization, limited collection, and limited use
Qualifications & exceptions
Worded as "strive to consider", an aim rather than a firm promise
Tied to "applicable privacy and data protection laws"
Not stated here
The Notice does not say how these principles are measured or enforced
Use & Processing · Restriction or exception
Aggregated or de-identified data that Starbucks does not try to re-identify is outside the Notice
Starbucks says it may aggregate or de-identify the information it collects. Aggregated or de-identified data that Starbucks does not attempt to reidentify is not subject to this Notice, so the Notice's statements about personal information do not govern that data.
Supporting quotations
We may aggregate or de-identify the information described above. Aggregated or de-identified data that we do not attempt to reidentify is not subject to this Notice.
Qualifications & exceptions
Exception applies only to data Starbucks does not attempt to reidentify
Not stated here
The Notice does not say how data is de-identified or how it may be used afterward
Use & Processing · Company practice
Starbucks may use the information it collects for various business purposes
Starbucks says it may use the information it collects about you for various business purposes. The sections below group those purposes under providing services, communicating with you, research and improvement, legal reasons, targeted advertising and your consent.
Supporting quotations
We may use the information we collect about you for various business purposes, including to:
Qualifications & exceptions
Worded "may use"; the purposes are the ones listed below
Use & Processing · Company practice
Uses to provide services: orders, accounts, loyalty programs, gifts, debugging, app function and payments
Starbucks may process your information when you access or use the Starbucks Services to process or fulfill orders and transactions, maintain and service accounts, support and improve its loyalty programs such as Starbucks Rewards, deliver gift cards or e-gifts and any personalized messages in line with your instructions, debug and repair errors that impair existing functionality, make its websites and mobile applications work, and process payments.
Supporting quotations
We may process your information when you access or use the Starbucks Services, including to:
process or fulfill orders and transactions
maintain and service accounts
support and improve our loyalty programs, such as Starbucks® Rewards
deliver gift cards or e-gifts, and any associated personalized messages, in accordance with your instructions
debug to identify and repair errors that impair existing functionality
facilitate the functionality of our websites and mobile applications
process payments
Qualifications & exceptions
Worded "may process"
Gift delivery follows "your instructions"
Use & Processing · Company practice
Uses to communicate with you about accounts, orders, services and product safety
Starbucks may process information to communicate with you about your accounts, its services and your requests. That includes providing customer service (including through the website "live help" chat), communicating about orders, purchases, returns, services, accounts, programs, contests and sweepstakes, and providing important product safety information and notice of product recalls.
Supporting quotations
We may process certain information in order to communicate with you in relation to your accounts, our services, our marketing, and your requests
provide customer service, including when you interact with our customer service agents through our website’s “live help” chat feature, and requests for information
communicate with you about orders, purchases, returns, services, accounts, programs, contests, and sweepstakes
provide important product safety information and notice of product recalls
Qualifications & exceptions
Worded "may process"
Not stated here
The text of any product safety or recall notices Starbucks sends is not supplied here, so this card cannot say what they contain
Use & Processing · Company practice
Uses for research, development and improvement, and for security, integrity and fraud detection
Starbucks may process personal information to maintain, improve and analyze its websites, mobile applications, ads and the products and services it offers. It may also process information to help ensure the security and integrity of the Starbucks Services, including to detect, prevent or investigate suspicious activity or fraud.
Supporting quotations
we may process certain personal information, including to:
maintain, improve, and analyze our websites, mobile applications, ads, and the products and services we offer
help to ensure security and integrity of the Starbucks Services, including to detect, prevent, or investigate suspicious activity or fraud
Qualifications & exceptions
Worded "may process"
Covers analysis of its ads as well as its websites, apps, products and services
Use & Processing · Company practice
Uses for targeted advertising, also called cross-contextual and online behavioral advertising
Starbucks may process your information to provide targeted advertising, which the Notice also calls cross-contextual advertising and online behavioral advertising, and offers and promotions you may be interested in. The Notice says you may have certain privacy rights over processing for targeted advertising and points to the "Your Privacy Choices & Rights" section for how to exercise them.
Supporting quotations
We may process your information to provide you with targeted advertising (also known as cross-contextual advertising and online behavioral advertising) and offers and promotions that you may be interested in.
You may have certain privacy rights with respect to the processing of your information for targeted advertising purposes.
Qualifications & exceptions
Rights are stated as "may have certain privacy rights"
Details of the choices are in section 13
Not stated here
This section does not say which categories of information are used for targeted advertising; section 5 and section 13(b) say more
Other business or commercial purposes at your direction or with your consent
Starbucks may process certain information for any other business or commercial purposes at your direction or with your consent.
Supporting quotations
We may process certain information in order to fulfill any other business or commercial purposes at your direction or with your consent.
Qualifications & exceptions
Applies to purposes at your direction or with your consent
Not stated here
The Notice does not say how consent is requested or recorded
Use & Processing · Company practice
Three stated purposes: strictly necessary and functionality, analytics, and advertising
Starbucks lists three purposes for these technologies. Strictly necessary and functionality: some are needed to access and use the websites and apps and to display content and remember your preferences and log-in. Analytics: some help it analyze and measure site usage, testing and performance, such as estimating traffic. Advertising: some may be set by Starbucks or its advertising partners to tailor your experience on its website, in its apps or across your applications or devices by controlling the promotions, advertisements and marketing messages you see. Taken together, it may use this information to personalize your visit or send relevant promotions and advertisements.
Supporting quotations
Some of these technologies are necessary to allow you to access and use our websites or mobile applications and enable the various services and functionalities we offer, including displaying content and remembering your preferences and log-in.
Some of these technologies help us analyze and measure site usage, testing and performance, including by estimating traffic and assessing the volume of the use of services and functionality on websites and mobile applications.
Some of these technologies may be set by us or our advertising partners to tailor your experience on our website, within our mobile applications, or across your applications or devices by controlling the promotions, advertisements and other marketing messages that may appear when you access or use these or other digital properties.
We may use this information to personalize your visit to a website or use of a mobile application or to send you relevant promotions and advertisements.
Qualifications & exceptions
Each purpose is introduced by "some of these technologies"
Advertising technologies "may be set by us or our advertising partners", and can work across your applications or devices
Use & Processing · User right or choice
You can set your browser to accept or reject cookies and similar technologies, but you must take extra steps
Starbucks says most web browsers can be set to accept or reject some or all of these technologies, although you must take additional steps to disable or control them. You may be able to reject some or all of them through your browser settings, and many browsers let you choose before they are set or installed, or remove or reject them altogether. It points you to your browser's Help menu or instructions.
Supporting quotations
Most web browsers can be programmed to accept or reject the use of some or all of these technologies, although you must take additional steps to disable or control these technologies.
You may be able to reject some or all of these technologies by adjusting the appropriate settings in your browser.
Without these technologies, some of the services and functionality on our websites and mobile applications would not work properly.
Qualifications & exceptions
Worded "may be able to"; availability depends on your browser
Rejecting these technologies affects the Services: the Notice says that without strictly necessary technologies some services and functionality would not work properly
Use & Processing · User right or choice
On certain sites you may opt out of certain cookies through the Do Not Sell or Share link or Cookie Preferences
Starbucks says that on certain sites you may also be able to opt out of certain cookies by clicking the "Do Not Sell or Share My Personal Information" link on its website or by choosing in the Cookie Preferences link. For more on exercising your preferences, including how it processes opt-out preference signals, it points to the "Your Privacy Choices & Rights" section.
Supporting quotations
On certain sites, you may also be able to opt out of certain cookies by clicking the “Do Not Sell or Share My Personal Information” link on our website or making a selection using the Cookie Preferences link.
including how we process opt-out preference signals
Qualifications & exceptions
Available "on certain sites" and for "certain cookies"
Details and opt-out preference signals are covered in section 13
Use & Processing · User right or choice
Advertising-industry opt-out portals for interest-based advertising: DAA, DAA of Canada, NAI, EU and mobile apps
Starbucks notes that many advertising companies that collect information through cookies and similar technologies for interest-based advertising are members of the Digital Advertising Alliance (DAA) or the Network Advertising Initiative (NAI), which maintain opt-out websites for their members. It gives the DAA, DAA of Canada and NAI opt-out portals for website interest-based advertising by each organization's participating companies. Residents of the European Union may opt out of online behavioral advertising from the European Interactive Digital Advertising Alliance's participating members through its website, and the DAA's AppChoices app lets you opt out of interest-based advertising across mobile apps by participating companies.
Supporting quotations
Many advertising companies that collect information from cookies and similar technologies for interest-based advertising are members of the Digital Advertising Alliance (DAA) or the Network Advertising Initiative (NAI), both of which maintain websites where people can opt out of interest-based advertising from their members.
To opt-out of website interest-based advertising provided by each organization’s respective participating companies
Residents of the European Union may opt-out of online behavioral advertising served by the European Interactive Digital Advertising Alliance’s participating member organizations
To opt-out of data collection for interest-based advertising across mobile applications by participating companies, download the DAA’s App Choices mobile application opt-out offering
Qualifications & exceptions
Each opt-out applies only to the participating companies or members of that organization
Separate tools are given for websites, European Union residents and mobile apps
Not stated here
These opt-out portals are run by third-party organizations and are not supplied here; this card cannot say what they cover beyond what the Notice states
Use & Processing · Company practice
Information is stored and processed in the United States, Canada or elsewhere, including outside your country
Starbucks says the personal information you provide is stored and processed on servers owned by Starbucks and other companies in the United States, Canada or elsewhere around the world, including outside the country or jurisdiction where you are located. Regardless of who processes it and where, Starbucks says it will take steps to transfer and protect your information through appropriate safeguards in line with applicable data protection laws and the Notice. EEA, U.K. and Swiss residents are pointed to section 15 for more.
Supporting quotations
The personal information that you provide us is stored and processed on servers owned by Starbucks and other companies in the United States, Canada or elsewhere around the world, including locations outside of the country or jurisdiction where you are located.
we will take steps to transfer and protect your information through appropriate safeguards in accordance with applicable data protection laws and this Notice
If you are a resident of the EEA, the U.K., and Switzerland, please find more information in “Additional Disclosures for Data Subjects in the EEA, the U.K., and Switzerland” below.
Qualifications & exceptions
Servers are owned by Starbucks "and other companies"
Safeguards are described as "appropriate safeguards in accordance with applicable data protection laws and this Notice"
EEA, U.K. and Switzerland: see section 15
Not stated here
The safeguards are not described in this section
Use & Processing · Company practice
If you allow location sharing, Starbucks may use it to customize your experience, measure marketing and tailor messages
If you allow location sharing, Starbucks says your device may communicate with it in ways that let it customize your experience in and around its stores, monitor the effectiveness of its marketing efforts, tailor messages based on your time and location patterns, and limit how many times you see a promotional message or offer. It adds that precise geolocation may be used to fulfill services and application functionality you choose to engage with, and that you can manage the use of that information in your device settings. These uses go beyond the services-only purposes listed with precise geolocation in section 2.
Supporting quotations
If you allow for location sharing, your device may communicate with us in ways that allow for us to customize your experience in and around Starbucks stores, to monitor the effectiveness of our marketing efforts, to tailor messages based on your time and location patterns, and to limit the number of times you see a promotional message or offer.
Precise geolocation may be used to fulfill services and application functionality you choose to engage with.
You can manage the use of that personal information at any time in your device settings.
for purposes of facilitating our services, such as to provide you with information about stores near you, to enable you to remotely order and pay for our products and services, or so that you may have certain Starbucks products delivered to you by a third-party vendor
Qualifications & exceptions
Applies "if you allow for location sharing"
Marketing uses named: measuring marketing effectiveness, tailoring messages by time and location patterns, capping promotional messages
Precise geolocation use for services is tied to features "you choose to engage with"
Managed through device settings
Not stated here
The Notice does not say whether the marketing uses apply to precise location or only to general location
Use & Processing · User right or choice
Preferences for promotional emails, push notifications and inbox messages; promotional emails can be opted out of
The Starbucks App lets all customers set preferences for receiving promotional emails, push notifications on your device, and inbox messages. You may opt out of promotional emails at any time by adjusting your Starbucks online account settings or by clicking the "unsubscribe" link in any promotional email. If you opt out of promotional emails, Starbucks may still send communications about your orders, transactions and any accounts you have with it. Opting out of promotional emails does not turn off automated marketing text messages if you have opted in to them.
Supporting quotations
The Starbucks App allows all customers to set preferences for receiving promotional email communications from Starbucks, receiving push notifications on your device, and receiving inbox messages.
You may opt-out of receiving promotional emails at any time by adjusting your Starbucks online account settings or by clicking the “unsubscribe” link included within any promotional emails we send you.
If you opt-out of receiving promotional emails from us, we may still send communications to you about your orders and transactions, and any accounts you have with us.
Please note that when you opt-out of receiving promotional emails, you may still receive automated marketing text messages if you have opted-in to receiving them.
Qualifications & exceptions
Promotional emails can be stopped at any time through account settings or the unsubscribe link
Order, transaction and account communications may continue after you opt out of promotional emails
Automated marketing texts you opted into continue until you opt out of texts separately
Automated text messages need your consent and you can opt out by replying STOP, END, CANCEL, UNSUBSCRIBE or QUIT
In connection with certain Starbucks Services you may consent to receive automated text messages, including when you contact Customer Care or for marketing purposes. You may opt out of automated texts at any time by replying STOP, END, CANCEL, UNSUBSCRIBE or QUIT to any text you receive. Opting out of automated marketing texts does not stop promotional emails.
Supporting quotations
In connection with certain Starbucks Services you may consent to receiving automated text messages, including when you contact Customer Care or for marketing purposes.
You may opt-out of receiving automated text messages at any time by texting any of the following replies at the end of any text message you receive: STOP, END, CANCEL, UNSUBSCRIBE, or QUIT.
Please note that when you opt-out of receiving automated marketing text messages you may still receive promotional emails.
Qualifications & exceptions
Texts are sent based on your consent
Reply keywords: STOP, END, CANCEL, UNSUBSCRIBE or QUIT
Opting out of marketing texts does not stop promotional emails
Use & Processing · Permission or license
Using the app features described means you consent to Starbucks recording, processing and storing the information
Starbucks says that if you use the Starbucks App features described in this section (location, voice ordering, and messages), you consent to the transmission of your information to Starbucks and/or its agents, and authorize Starbucks and/or its agents to record, process and store that information as necessary to administer the app features and for the purposes described in the Notice. The authorization is tied to the purposes in the Notice as a whole, not only to the feature you used.
Supporting quotations
If you use the Starbucks App features described above, you consent to the transmission of your information to Starbucks and/or its agents, and authorize Starbucks and/or its agents, to record, process, and store such information as necessary for administering the Starbucks App features and for purposes described in this Notice.
Qualifications & exceptions
Triggered by using the described Starbucks App features
Covers Starbucks "and/or its agents"
Purposes are those "necessary for administering the Starbucks App features and for purposes described in this Notice"
Not stated here
The Notice does not say whether you can withdraw this consent other than by not using the features or changing device settings
Use & Processing · Restriction or exception
Starbucks says it does not use sensitive information beyond what the law permits, so it offers no Limit link
Starbucks says it does not collect, process or disclose sensitive personal information for the purpose of inferring characteristics about you, or for any purpose other than when permitted under applicable law. For that reason it says it is not required to provide a "Limit the Use and Disclosure of My Sensitive Personal Information" link. The statement is bounded by "when permitted under applicable law", so it does not by itself list the purposes Starbucks uses sensitive information for.
Supporting quotations
We do not collect, process or disclose sensitive personal information for the purpose of inferring characteristics about you or for any purpose other than when permitted under applicable law.
As such, we are not required to provide a “Limit the Use and Disclosure of My Sensitive Personal Information” link.
Qualifications & exceptions
The exception is "any purpose other than when permitted under applicable law"
Starbucks gives this as its reason for not providing a Limit link
Not stated here
The Notice does not list which sensitive categories are used for which permitted purposes; section 2 lists precise geolocation, consumer health data and account login information as possibly sensitive
Use & Processing · Company practice
Rewards uses the collected categories of information and works with licensees, affiliates, providers and partners
For the Starbucks Rewards loyalty program, Starbucks says it uses the categories of personal information described in the "Information We Collect" section, including information you provide, information collected automatically and information from other sources, to operate the program, including to send you promotions, content and special offers and for the other uses in the Notice. It says it works with many third parties to offer the program's benefits, falling into three categories: Starbucks licensees, subsidiaries and affiliates; service providers; and business partners, and points to the "How We Disclose Your Information" section. It also says it does not assign monetary value for the information collected through the program when sending email communications.
Supporting quotations
Starbucks collects and uses the categories of personal information described in the “Information We Collect” section, including information you voluntarily provide us (such as your name and email), information we collect automatically, and information from other sources to operate the Starbucks® Rewards loyalty program, including to send you promotions, content, and special offers and the other uses described in this Notice.
We work with many third parties to offer the benefits of our Starbucks® Rewards loyalty program. Those partners may fall into the following categories: Starbucks licensees, subsidiaries, and affiliates; service providers; and business partners.
Starbucks does not assign monetary value for the information we collect through the Starbucks® Rewards loyalty program when sending email communications.
Qualifications & exceptions
Uses "the other uses described in this Notice" are included, so the program use is not limited to loyalty benefits
Partners are described by category, not named
Not stated here
The statement that no monetary value is assigned is limited to information collected through the program "when sending email communications"; the Notice does not address other uses
Use & Processing · Company practice
EEA lawful bases: Starbucks must have a lawful basis whenever it acts as a data controller
Where a Starbucks entity acts as a data controller that determines the purposes and means of processing, such as when it collects, uses and shares personal data as described in the Notice, it says it must have a lawful basis for the processing. The bases it lists are performing a contract, its legitimate business purposes, complying with legal obligations, and your consent.
Supporting quotations
Where a Starbucks entity is acting as a data controller that determines the purposes and means of processing your personal data, such as when we collect, use, and share personal data as described in this Notice, we must have a lawful basis for processing for doing so.
Our lawful bases for processing personal data include:
Qualifications & exceptions
Applies where a Starbucks entity "is acting as a data controller"
Bases listed with the word "include", so the list may not be complete
Use & Processing · Company practice
EEA basis: performing a contract with you, such as purchases, gift card delivery and order communications
One lawful basis is to conclude or perform a contract with you, for example to process your purchases of or requests for products and services, including delivering gift cards in accordance with your instructions, and to communicate with you about orders, purchases, returns, services, accounts, programs, contests and sweepstakes. The item is split across several blocks in the extracted text, but reads as one list.
Supporting quotations
to conclude or perform a contract with you, for example to:
process your purchases of or requests for products and services, including delivering
gift cards in accordance with your instructions;
communicate with you about orders, purchases, returns, services, accounts, programs,
contests, and sweepstakes;
Qualifications & exceptions
Examples are introduced by "for example"
Gift card delivery follows your instructions
Use & Processing · Company practice
EEA basis: legitimate business purposes such as customer service, improving services, fraud and security, app function
Another lawful basis is Starbucks' legitimate business purposes, including to respond to customer service inquiries and requests for information; maintain, improve and analyze its websites, mobile applications, ads and the products and services it offers; detect, prevent or investigate security breaches or fraud; and facilitate the functionality of its websites and mobile applications. The list is introduced by "including", so it gives examples. The items are split across several blocks in the extracted text.
Supporting quotations
for our legitimate business purposes, including to:
respond to your customer service inquiries and requests for information;
maintain, improve, and analyze our websites, mobile applications, ads, and the
products and services we offer;
detect, prevent, or investigate security breaches or fraud; and
facilitate the functionality of our websites and mobile applications;
Qualifications & exceptions
Introduced by "including", so examples rather than a closed list
Not stated here
The Notice does not describe any balancing test or how you can object beyond the rights listed below
Use & Processing · User right or choice
EEA basis: your consent for promotional email and other electronic messages, which you can withdraw at any time
The last lawful basis is your consent, for example to send you personalized promotions and special offers by email and other electronic means, or to tell you about its brands, products, events or other promotional purposes. You can withdraw consent at any time by changing your promotional preferences in your Starbucks App account online, or by contacting Starbucks as described in "Contact Us".
Supporting quotations
on the basis of your consent, for example to send you via email and other electronic means personalized promotions and special offers or informing you about our brands, products, events, or other promotional purposes.
You can withdraw your consent at any time by modifying your promotional preferences in your Starbucks App account online, or by contacting us as described in the “Contact Us” section below.
Qualifications & exceptions
Consent covers electronic promotional messages in this example
Withdrawal is available "at any time" through promotional preferences or by contacting Starbucks
Use & Processing · User right or choice
EEA: right not to be subject to legal or significant automated decisions, which Starbucks says it does not make
The listed EEA rights include the right not to be subject to automated decision-making that produces legal or significant effects on an individual. Starbucks adds that it does not engage in such decision-making.
Supporting quotations
Not be subject to automated decision-making producing legal or significant effects on an individual, which we do not engage in.
Qualifications & exceptions
The statement that Starbucks does not engage in this applies to automated decision-making producing legal or significant effects
Use & Processing · Company practice
EEA transfers: data may be moved to and processed in the United States and elsewhere, with protection steps
Your personal information may be transferred to, stored and processed in a country other than the one in which it was collected, including the United States. It may also be processed by staff outside the EEA who work for Starbucks or its third-party service providers. In those cases Starbucks says it will take appropriate steps to ensure an adequate level of data protection for the recipient as required under the GDPR and as described in the Notice.
Supporting quotations
Your personal information may be transferred to, stored, and processed in a country other than the one in which it was collected, including the United States.
It may also be processed by staff operating outside the EEA who work for Starbucks or for our third-party service providers.
we will take appropriate steps to ensure an adequate level of data protection of the recipient as required under the GDPR and as described in this Notice
stored and processed on servers owned by Starbucks and other companies in the United States, Canada or elsewhere around the world
Qualifications & exceptions
Transfers include the United States and processing by staff of Starbucks and its service providers outside the EEA
Safeguards are described only as "appropriate steps to ensure an adequate level of data protection"
Not stated here
The specific transfer mechanisms are not described in this section; section 16 describes participation in the Data Privacy Framework