This Personal Data Protection Policy (“Policy”) describes the principles and practices by which The Capital Coffee processes personal data when customers access the website, create and use accounts, participate in the Membership Program or a promotion program, make purchases, order beverages, make payments, receive or collect orders, contact support, and use other official services.
1. Scope
This Policy applies to personal data processed by The Capital Coffee through thecapitalcoffee.com, Web Retail, Drink Ordering, customer/Member accounts, Experience Locations/POS, the The Capital Coffee App when released, and other official channels that refer to this Policy.
This Policy should be read together with the Privacy Policy, Cookie Policy, General Terms and Conditions, Membership Program Terms, Promotion Program Terms and Conditions, and other relevant specific policies.
2. Personal data protection principles
The Capital Coffee processes personal data in accordance with Vietnamese law, for identified and disclosed purposes and only to the extent necessary; applies appropriate safeguards; respects data subject rights; and does not use data for purposes incompatible with those disclosed unless an appropriate legal basis exists.
3. The role of The Capital Coffee
Depending on the specific activity, The Capital Coffee may determine the purposes and means of processing, carry out processing directly, or engage service providers to perform part of the processing. Allocation of responsibilities and access rights must reflect the actual roles involved and applicable law.
4. Categories of data that may be processed
Depending on the services used, data may include name; phone number; email address; address; account information and Member ID; order, transaction, payment and refund history; Membership information, Points, tier, vouchers and benefits; support communications; marketing preferences; technical data necessary for operations, security and fraud prevention; and location data when a customer actively provides an address or uses a location feature.
The Capital Coffee does not automatically collect every category listed above. Data is processed only when it arises from the relevant feature, transaction or interaction.
5. Sources of data
Data may be provided directly by the customer; generated through use of services and transactions; recorded by The Capital Coffee systems; or lawfully provided by relevant payment, delivery, technical platform or service partners.
6. Purposes of processing
Data may be processed to create, verify and manage accounts; identify customers/Members; perform and reconcile transactions; process orders, payments, fulfillment, returns and refunds; manage Points, tiers, vouchers and benefits; provide support; prevent fraud; maintain system security; handle complaints; fulfill accounting, tax and legal obligations; and for other lawfully disclosed purposes.
7. Legal basis and consent
The Capital Coffee processes data only on a basis permitted by applicable law. Where consent is required, customers are provided with the information necessary to make a voluntary, specific and verifiable choice.
Silence, failure to respond, or merely creating an account, making a purchase, joining the Membership Program or participating in a promotion program is not automatically treated as consent to advertising or marketing that is not necessary for the service.
8. Customer accounts and the Membership Program
Account and Membership data may be processed to verify account identity, maintain a unified Member ID, link eligible transactions, manage Points, tiers, vouchers, benefits and related history, provide customer support and protect the account.
Economic terms, rules for earning or using Points, tier qualification and benefits are governed by the Membership Program authority and are not established by this Policy.
9. Orders, payments and fulfillment
Necessary data may be processed to create and fulfill orders, confirm payments, deliver or provide pickup, determine an appropriate fulfillment point, calculate fees/ETA where the relevant function applies, reconcile transactions, process refunds and resolve transaction issues.
Sensitive payment data processed by payment providers is governed by the mechanisms and responsibilities applicable to those providers; The Capital Coffee processes only the data actually received by its systems and necessary for its functions.
10. Location data
When a customer enters an address or actively uses the “Current location” feature, location data may be processed to normalize the address, determine the service area, identify the nearest or most appropriate fulfillment point, calculate delivery fees and estimated time, and store the snapshot necessary for the order.
The Capital Coffee does not use location data for purposes inconsistent with those disclosed or with applicable law.
11. Advertising, marketing and promotional communications
The Capital Coffee uses personal data for advertising, marketing or promotional communications only where an appropriate legal basis exists and, where required by law, the customer has provided separate consent.
The choice to receive advertising or marketing must be separate from account creation or use of core services. Customers may decline or withdraw that choice without losing access to functions that do not depend on marketing.
When email, messaging or other marketing channels are used, The Capital Coffee must maintain evidence of the customer’s choice and provide an opt-out or unsubscribe mechanism compliant with applicable law.
12. Cookies and similar technologies
Necessary cookies may be used to operate the website, login sessions, cart and essential functions. Analytics, advertising or other non-essential tracking technologies are activated only in accordance with the applicable choice mechanism and legal basis.
Further details are provided in the Cookie Policy and the website’s Cookie Settings tool.
13. Data sharing and processors
Data may be shared to the extent necessary with providers of infrastructure, hosting, email/SMS, payments, delivery, maps/location services, technical support, fraud prevention, accounting or professional services; with partners necessary to perform a transaction; or with competent authorities where required by law.
The Capital Coffee does not unlawfully sell personal data and requires data recipients to protect data in a manner appropriate to their role, processing scope and legal obligations.
14. Transfers of data outside Vietnam
If the use of infrastructure or service providers results in personal data being transferred outside Vietnam, The Capital Coffee fulfills the applicable assessment, documentation, protection and procedural obligations required by law at the time of processing.
15. Retention and deletion
Data is retained for as long as necessary for the processing purpose, the duration of the transaction or customer relationship, complaint resolution, protection of lawful rights and interests, and mandatory retention periods under law. When no basis for retention remains, data is deleted, destroyed, anonymized or otherwise handled through an appropriate mechanism.
16. Data security and confidentiality
The Capital Coffee applies organizational and technical measures appropriate to the nature of the data and processing risks, including access management, account protection, necessary activity logging, backups, provider controls and measures to prevent unauthorized access, use, disclosure, alteration, loss or destruction.
17. Personal data incidents
When an incident involving personal data is identified, The Capital Coffee takes measures to limit its impact, investigate, remediate, retain necessary records, and notify or report to data subjects or competent authorities where required by law.
18. Data subject rights
Within the scope of applicable law, data subjects may request information about and access to their data; correction; withdrawal of consent; objection to or restriction of processing; deletion; provision of data; lodge complaints or denunciations, initiate legal proceedings; claim compensation for damage; and exercise other rights provided by law.
The exercise of a right may be subject to lawful limitations or conditions in individual cases. The Capital Coffee may request reasonable information to verify the requester and protect the relevant account/data before processing a request.
19. Exercising rights and withdrawing marketing choices
Customers may use account management functions, Cookie Settings, unsubscribe/opt-out mechanisms in communications, or contact The Capital Coffee through its official channels. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal and does not prevent processing based on another independent legal basis.
20. Children and persons requiring representation
If a service involves processing data of children or persons for whom the law requires a representative to exercise rights, The Capital Coffee applies mechanisms appropriate to age, legal capacity and applicable requirements concerning representation, consent or special protection.
21. Changes to this Policy
The Capital Coffee may update this Policy to reflect changes in law, systems or processing activities. The version and effective date of an update will be appropriately published. Where a change requires renewed consent, The Capital Coffee will obtain the required choice before applying the relevant processing activity.
22. Contact information
Personal data requests are received through The Capital Coffee’s official contact channels published on the website. The company’s legal information is published in the Legal Center.
23. Governing law
This Policy is governed by the laws of Vietnam concerning personal data protection, consumer protection, electronic transactions, advertising, commerce and other relevant regulations in force at the time of processing.