Last Updated: 21st Sep 2024
This Privacy Policy (“Policy“) sets out the basis upon which Cocca Coffee Pte. Ltd. and its parent and other affiliated companies (“Cocca Coffee“, the “Company“, “we“, “us“, “our“) may collect, use, disclose or otherwise process personal data of customers in our physical coffee shops, and on and through our mobile application(s), website(s) and other related services, including but not limited to Cocca Coffee’s official website (“https://www.coccacoffee.com“), and Cocca Coffee mobile application (“Mobile Application“), as well as other sites, programs and software operated by Cocca Coffee, in accordance with the Singapore Personal Data Protection Act 2012 (“PDPA“). This Policy applies to all personal data in our possession or under our control, including personal data in the possession of organisations which we have engaged to collect, use, disclose or process personal data for our purposes.
It is important that you read this Policy together with any other Terms of Use or terms and conditions provided or made available to you when we are collecting or processing your personal data, so that you are aware of how and why we are collecting and processing your personal data under the PDPA.
If you provide us with personal data about a third party when using our Website, Mobile Application, and/or other sites, programs and software, you are responsible for informing the said third parties and obtain their consent (if such consent is required by applicable laws) for the processing and transfer (including abroad) of their personal data as described in this Policy, as well as their rights of access, correction and withdrawal.
We may collaborate with other business partners and entities, and these business partners and entities may have separate and distinct privacy polices in addition to ours. Please ensure that you read through their privacy policies to understand how your personal data is being collected, used and disclosed.
1. Personal Data
1.1 “Personal data” means any data, whether true or not, about you (or any other individuals) who can be identified either directly or indirectly, from that data or other information that we have or are likely to have access.
1.2 Personal data which we may collect include, without limitation, your:
(a) personal details such as name or alias, gender;
(b) contact details such as your mobile phone number, postal address, email address, and other identifiers or credentials associated with your account on Luckin Coffee’s Mobile Application;
(c) device information, such as device ID, hardware model, IP addresses, file and app names and versions, unique device identifier (UDID), mobile equipment identifier (MEID), advertising identifiers, or any information that may indicate device or app modification;
(d) location details such as GPS location;
(e) financial account and payment information such as your credit and debit card numbers;
(f) transaction information, such as the products and services you purchase, how often you purchase our products and services, where do you usually make your purchase, which physical coffee shops you usually visit, customisation records, and other transaction, purchase, and order information;
(g) activities on Website, Mobile Application and other related platforms and sites such as communication content records, browsing history and browsing records;
(h) photo or video images of you such as CCTV recordings taken at our coffee shop premises;
(i) your comments, suggestions or other information that you provide when interacting with us or related third parties which you have duly authorised for them to share your personal data with us; and
(j) any other personal data that is necessary to meet our legitimate business purposes as the case may be.
2. Collection, Use and Disclosure of Personal Data
2.1 We generally collect personal data that:
(a) you knowingly, willingly and voluntarily provide in the course of or in connection with your interaction with us (such as the setting up of an account on the Mobile Application) after you have been notified of the purposes of which the data is collected, and have provided consent to the collection and processing of your personal data for those purposes; or
(b) the collection and processing of your personal data without consent is permitted or required by the PDPA or other applicable laws.
2.2 We shall seek your consent before collecting any additional personal data and before using your personal data for a purpose which has not been notified to you (except where permitted or authorised by law).
2.3 We may collect and use your personal data for any or all of the following purposes (collectively, the “Purposes“) and we may disclose your personal data to third parties where necessary for the following purposes:
(a) to process, manage, administer and/or facilitate our obligations in relation to your purchase, delivery or use of our products and services, whether through the Website, the Mobile App, our physical coffee shops or other programs, sites and software;
(b) to manage and administer your use and/or access to the Website, Mobile App and/or our products and services;
(c) to provide you with user support, and address any queries that you have in relation to the Website, Mobile App and/or our products and services;
(d) to allow you to participate in different features and functions on the Website, Mobile App, and other related platforms, sites and services；
(e) to tailor a better experience for you by remembering your account preferences, purchase history and payment information;
(f) to notify you about changes to our Website, Mobile App, and other related platforms, sites and services;
(g) to communicate with you via your preferred mode of contact about your orders or purchases of our goods and service;
(h) to provide you with location-based services related to your orders and purchases;
(i) to customise and personalise advertisements and marketing materials for you;
(j) to provide you with promotional and marketing materials about our products and services;
(k) to detect and prevent fraud;
(l) to troubleshoot, analyse, improve and update our Website, Mobile App, and other related platforms, sites and services;
(m) to enforce our policies, Terms of Use, and other guidelines and terms and conditions;
(n) to protect our rights, property, security and reputation;
(o) to comply with applicable laws and regulations;
(p) where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests as the case may be; and
(q) any other legitimate business purposes as the case may be.
2.4 We will only use your personal data for the Purposes for which we collected it. In the event we need to process your personal data for an unintended purpose, we will obtain your prior consent, unless such consent is deemed given under the PDPA or one of the exceptions in the PDPA applies.
2.5 We may share your personal data with third parties, including our third party service providers (such as our delivery partners, credit card processors, website hosts etc.), our affiliates and other related entities for the abovementioned Purposes, and in particular:
(a) where we need to do so to facilitate our obligations to you;
(b) where we engage third parties service providers to perform any of the functions for the abovementioned Purposes;
(c) to comply with our legal or regulatory obligations;
(d) in other cases where you consent to us doing so.
2.6 We may also share your personal data with those involved in the negotiation or transfer in the context of a merger, acquisition, financing or sale of assets or any other situation involving the transfer of our business assets.
3. Transfers of Personal Data Outside of Singapore
3.1 We may transfer your personal data to and between our affiliates, other related entities, and third party service providers or other recipients, and such transfer may involve the sending of your personal data to recipients outside of Singapore for the carrying out or fulfillment of the abovementioned Purposes.
3.2 Where we transfer your personal data overseas, we will implement appropriate and suitable safeguards to ensure that the transferred personal data will be accorded the same level of protection as under the PDPA or as required by applicable laws.
4. Protection of Personal Data
4.1 To safeguard your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, we will introduce appropriate administrative, physical and technical measures to secure the storage and transmission of your personal data by us. Details of such measures are available upon request. We will only disclose your personal data both internally and to our authorised third party service providers on a need-to-know basis.
4.2 You should be aware, however, that no method of transmission over the internet or method of electronic storage is completely secure. While security cannot be guaranteed, we strive to protect the security of your information and are constantly reviewing and enhancing our information security measures.
5. Retention of Personal Data
5.1 We will only retain your personal data for as long as it is necessary to fulfil the purposes for which it is collected, or as required or permitted by applicable laws.
5.2 We will cease to retain your personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for business or legal purposes.
6. Accuracy of Personal Data
6.1 We rely on the personal data provided by you. You are responsible in ensuring that the personal data that you provided us is current, complete and accurate. Please update us if there are any changes to your personal data by informing our Data Protection Officer in writing or via email at the contact details provided below.
7. Access and Correction of Personal Data
7.1 You may make an access request for access to a copy of the personal data that we hold about you or information about the ways in which we use or disclose your personal data, or a correction request to correct or update your personal data which we hold. You may submit your request in writing or via email to our Data Protection Officer at the contact details provided below.
7.2 We may charge you a reasonable fee for an access request. If so, we will inform you before processing the request. To process your request, we may request for specific information from you to help us verify your identity. This is one of our measures to help safeguard your personal data and prevent any unauthorised access by third parties.
8. Data Portability Transfer of Personal Data
8.1 If you request for your personal data to be transferred to another organisation, we may do so in a commonly used machine-readable format.
9. Withdrawal of Consent
9.1 The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time it is being withdrawn by you in writing. You may withdraw consent and request us to stop using and/or disclosing your personal data for any or all of the Purposes listed above by submitting your request in writing or via email to our Data Protection Officer at the contact details provided below.
9.2 Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities.
9.3 Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in a position to perform obligations under and/or in connection with your employment or contract, and/or continue your employment or contractual relationship (as the case may be). Should you decide to cancel your withdrawal of consent, please inform us in writing or via email to our Data Protection Officer at the contact details provided below.
9.4 Please note that withdrawing consent does not affect our right to continue to collect, use and disclose your personal data where such collection, use and disclosure without consent is permitted or required under the PDPA or applicable laws.
You can update your account information or manage your preferences at any time by logging into your account via our Application.
10. Cookies
10.1 We may use cookies on our websites and other platforms to collect and process your personal data. Please refer to our Cookies Policy to understand the types of cookies that we use, and how you can control the use of cookies.
11. Effect of Policy and Changes to Policy
11.1 This Policy applies in conjunction with any other notices, policies, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of your personal data by us.
11.2 We may revise this notice from time to time without any prior notice. You may determine if such revision has taken place by referring to the date on which this Notice was last updated. Your continued access and use of our Website, Mobile Application, and other sites, programs and software operated by us constitutes your acknowledgement and acceptance of such changes.