Privacy Policy

Costa Limited ("Costa", "We", "Us") with registered office at Costa House, 6 Porz Avenue, Houghton Hall Business Park, Houghton Regis, Dunstable, Beds, LU5 5YG is the responsible of your personal data processed according to this Privacy Notice. We respect your data and your privacy is important to us.

This Privacy Notice explains what personal data we collect and how it is
used. This notice also explains what rights you have over your personal data
and how you can use those rights.

1. Information we collect from you

We collect information when you use our website. In particular, information we collect from you, includes:

• Personal Data you give us directly such as contact details, specifically
  name, email, address, contact number, and comments or feedback

• If you engage with us online via our website, our cookies and
  similar technologies may capture your IP address, your location, and record how you use the site or app to help improve it and improve your user experience, where your browser settings or permission allows for this, but we will seek your consent where required and/or inform you of this in our Cookie Policy

• If you post information online about us or provide feedback, we keep a
  record

• If you contact us directly and complain or give feedback, receive
  compensation, we will record details and all related informati(including that you provide to us) such as emails, letters, date of birth

• Please note that the responsible entity for Business Customers of Costa Express machines in Mexico is Arca Continental. If you are a Business Customer for example a company buying Costa Express machine for your staff and would like to find out how they process your personal data, or exercise your data subject rights, please visit their privacy notice at:
  

2. Information we receive from third parties.

We may receive your information from other people/organisations in
certain circumstances. This can happen when:

• The Coca-Cola Company, through its affiliates and authorized bottlers in
  Mexico, may help us operate some of our customer information centre services for Costa branded products in Mexico and provide us with information that you supply to them. For customers in Mexico and have any queries regarding our services or products, your queries may be initially handled by The Coca-Cola Export Corporation Mexican Branch, Plantas Industriales, S. de R.L. de C.V. or Arca Continental, who may later escalate your query and share your personal data with us if the query is complicated in nature.

3. Purposes of Data collected:

We use your data to provide and improve our products and provision of services, including for marketing,  analytical and statistics purposes, feedback, complaints and enquiries, and for safety and security reasons, all of this in connection with our products and to provide a better service. We also use your data when you enter competitions or awards that we organise

We will use your data to comply with laws and regulations. We use your
data to prevent and detect crime, such as fraud.

You have the right to object to some of the processing Costa carries out
in connection with data collected. 

Our websites and app use cookies and similar technologies to improve
functionality, recognise you and to customise your experience. You can reject and block cookies in your browser settings. Please see our Cookie Notice for more information

Costa is part of The Coca-Cola Company group of companies, for details
of how personal data is shared with the Coca Cola group, please see the “Data Transfer” section below.

4. Data Transfer

In accordance to Article 37 of the Federal Law on Personal Data
Protection in Possession of Private Parties, your data can be legally
transferred to third parties without your consent in the following cases

(i) Costa is part of the Coca-Cola group of companies worldwide. Your
data can be legally transferred to other companies, whether national or
international, which are part of the Coca-Cola group, to process your personal data in the course of assisting us with customer information services and distribution services. Details of such enquiries and concerns will be shared with Costa if there is a specific complaint relating to Costa that Coca-Cola is unable to handle.

(ii) for some activities Costa uses third party service providers. Your data can be transferred to third party providers for the following services:

• Data analysis to enable us to optimise our services

• IT development, support, maintenance and hosting, including the provision of applications and website hosting

(iii)  If our business is to be integrated with another business or sold, your details would be shared with our advisers and any prospective purchaser’s advisers. Your information could be passed to the new owners. (You will be notified if this happens)

(iv) Personal data may be shared with government authorities and/or law enforcement officials for the prevention or detection of crime, if required by law or if required for a legal or contractual claim.

(v) Other casesas established under Article 37 of the Federal Law on Personal Data Protection in Possession of Private Parties.

5. Cookies and similar technologies.

Our website, apps and marketing emails use cookies and similar
technology. Full information is in our Cookie Notice. This includes
information on how to adjust your browser settings to accept or reject cookies.

6. Data retention

We keep your data to enable us to fulfil our contract with you or to
provide services, whilst you are an active user of our site or where required
by law or to protect legal rights.

We always look to keep your data for the minimum time in line with data
protection principles and our processes. For example, we keep

• Records of payment information in line with tax law and audit
  requirements

• Customer feedback and correspondence with our customer services teams for up to 2 years afterwards, depending on the nature of the interaction and any applicable law, such as health and safety. This enables us to respond to any questions or complaints

• Information to maintain records according to rules that apply to us
  

7. Your ACRO rights

Under the Federal Law on Personal Data Protection in Possession of
Private Parties you have different data subject rights, such as:

• ask for a copy of your information (Access)

• ask for information to be corrected (Rectification)

• ask for information to be erased or deleted (Cancelation)

• ask for us to limit or restrict processing

• object to us processing your data, in particular, where we do not have
  to process the data to meet a contractual or other legal requirement and in relation to processing for direct marketing purposes, including profiling for direct marketing purposes (Opposition)

• ask us to send you a copy in a structured digital format or ask for us
  to send it to another party
  

Some rights, however, may be limited. We may be obliged by law or
regulation to keep information. We must respect other people’s privacy as well, which means we may need to redact or remove information where it includes personal data about someone else, even if it is connected to your data

If you want to exercise any of the mentioned rights you will need to
submit a request form, please see ‘Contact details’ below. To process a request from you, we may need to confirm your identity to ensure we’re accessing the right data. 

8. Contact information

Consumers: If you have any queries you can email: consumidor@coca-cola.com 

For any queries relating to data protection or to exercise any of your rights, please contact Costa's Data Protection Officer by email at costadpo@costacoffee.com or write to them at Data Protection Officer, Costa Limited, Costa House, 6 Porz Avenue, Houghton Hall Business Park, Houghton Regis, Dunstable, Beds, LU5 5YG

9. What entity in Costa is the controller?

The user declares to have been informed of the conditions on protection
of personal data, accepting and consenting to the treatment of these by Costa, under the terms and conditions established in this Privacy Notice

10. Changes and updates

We may change or update this notice from time to time. We will
communicate these as appropriate – for example, by updating our website or, where legally required, by actively telling you about the changes.

Please remember that when you click a link to go from our website to another website, our Privacy Policy no longer applies. Any browsing and interaction on another website, is subject to that website's or third-party notices and policies which we recommend you read. This policy applies solely to data collected and processed by Costa