Privacy Policy
Effective Date: February 2026
Gulf Coffee Company (hereafter referred to as “we” or “our” or “us” or “GCC” or “organisation”) are firmly committed to protecting your privacy.
This Privacy Notice has been created to demonstrate our company’s commitment to keep personal data private and secure. This Privacy Notice explains who we are, how we collect, share, and use personal data about you, and how you can exercise your data privacy rights or communicate us for redressal of your data privacy-related queries or concerns.
This Privacy Notice is provided in a layered format so you can click through to the specific areas set out below.
IMPORTANT INFORMATION AND WHO WE ARE PURPOSE OF THIS PRIVACY NOTICE
This Privacy Notice will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from), including any data you provide through this website when you sign up to a newsletter, take part in a survey, download any GCC publication, take part in a competition, or use any of our mobile applications.
It is important that you read this Privacy Notice together with any other privacy notice or fair processing notice we provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Notice supplements the other notices and is not intended to override them.
This website is not intended for children, and we do not knowingly collect data relating to children.
DATA CONTROLLER
Gulf Coffee Company is a Kuwaiti Company (hereinafter “GCC”). This Privacy Notice is issued on behalf of the GCC so when we mention “GCC”, “we”, “us” or “our” in this Privacy Notice, we are referring to the relevant company in GCC responsible for processing your data.
In this Privacy Notice “You” or “Your” refers to data subject (customers, employees, website visitors or contingent workers) whose personal data is processed by us.
Gulf Coffee Company is the data controller and responsible for this website. GCC’s Data Protection Officer is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact the Data Protection Officer using the details set out below.
CONTACT DETAILS
Our full details are:
Full name of legal entity: Gulf Coffee Company (trading as GCC).
Postal address: 39th Floor, Assima Tower, Sharq, Kuwait City, State of Kuwait.
Phone: +965 22270100
Data Protection email address: info@cariboucoffee-me.com
THIRD-PARTY LINKS
Our website include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy notices/statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
THE PERSONAL DATA WE COLLECT ABOUT YOU
Personal Data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:
Identity Data includes first name, maiden name, last name, username or similar identifier, title, date of birth. Contact Data includes address, email address, telephone number and company details (including your company (or employer’s) name, position or title, company size, type of business/vertical and/or turnover).
Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website
Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
Usage Data includes information about how you use our website, products and services.
Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data is derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Notice.
We do not collect any Special Categories of Personal Data about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about you. We do collect information about your health, biometric data, criminal convictions and offences.
HOW DO WE COLLECT YOUR PERSONAL DATA?
We use different methods to collect data from and about you including through:
DIRECT INTERACTIONS
You normally give us your identity, contact, resume by filling in forms or by corresponding with us by phone, and email or otherwise. This includes sharing of personal data for the following purpose:
- Records of your interactions with us such as emails and other correspondence and your instructions to us.
- Providing your feedback.
- By filling in forms.
- d) By sharing your personal data such as resume for recruitment purpose.
e) By interacting with us on social media platforms such as Facebook, Twitter, and LinkedIn etc.
AUTOMATED TECHNOLOGIES OR INTERACTIONS
Log Files. Log information is data about your use of the Service, such as IP (Internet Protocol) address, browser type, referring/exit pages, operating system, date/time stamps, and related data, which is stored in log files.
Cookies. A cookie is a small data file transferred to your computer (or other device) when it is used to access our service. Cookies are used for many purposes, including to enable certain features of our service and remember your preferences, your equipment, browsing actions and patterns, to better understand how you interact with our service, to provide you advertising on and off the service, and to monitor usage by visitors and online traffic routing. You can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from the online services you visit.
THIRD PARTIES OR PUBLICLY AVAILABLE RESOURCES
We receive personal data about you from various third parties as set out below:
- Analytics providers such as Google based outside EU; and
- Advertising networks based inside and outside the EU.
HOW WE USE YOUR PERSONAL DATA
We will only use your personal data in the following circumstances:
Consent
When you give us your consent, for example, to access your contacts on your phone or allow us to have access to your location. You have the right to withdraw your consent at any time. To withdraw your consent just go to the Privacy Settings in our mobile application or Android or iOS Mobile app settings or contact us at Info@cariboucoffee-me.com
Performance of a Contract
When we need to execute a contract with you to which you are a party or to take steps at your request before entering such a contract by accepting applicable terms and conditions or specific related terms relating to other services offered by us.
Where we need to collect Personal Data under the terms of a contract we have with you, and you fail to provide that data when requested, we will not be able to perform our services under the contract we have or are trying to enter into with you (for example, to provide you with any of our services). In this case, we will have to cancel a service you have with us but we will notify you if this is the case at the time.
Legal or regulatory obligation
When we need to collect Personal Data by law. If you fail to provide that data when requested, we will not be able to perform our services under the contract with you (for example, to provide you with any of our products or services). In this case, we will have to cancel a product or service you have with us and we will notify you at that time.
Legitimate Interests
Legitimate Interest means the broader stake that GCC has in the processing or the benefit that we derive from the processing of your Personal Data.
Where we rely on legitimate interests, we make sure that we consider and balance any potential impact on you and your rights before we process your Personal Data for our legitimate interests.
Additionally, we also process certain special categories of data such as criminal convictions and biometric data where we are lawfully permitted to do so and only for limited purposes such as fraud or loss prevention and for security purposes in our stores and premises. Apart from this, we do not collect any of the following Special Categories of Personal Data about you that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, or genetic data.
We rely on consent as a legal basis for processing your personal data in relation to sending third party direct marketing communications for the purpose of targeting advertising campaigns via email and or SMS. You have the right to withdraw consent to marketing at any time by contacting us in our Contact Details section.
PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
|
Purpose/Activity |
Type of data |
Lawful basis for processing including basis of legitimate interest |
|---|---|---|
|
To manage our relationship with you which will include: |
(a) Identity |
(a) Performance of a contract |
|
To enable you to partake in a prize draw, competition or complete a survey |
(a) Identity |
(a) Your consent |
|
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) |
(a) Identity |
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) |
|
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you |
(a) Identity |
(a) Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy) (b) Your consent |
|
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences |
(a) Technical |
(a) Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy) |
|
To make suggestions and recommendations to you about goods or services that interest you |
(a) Identity |
(a) Necessary for our legitimate interests (to develop our products/services and grow our business) |
|
To provide industry news content with market insights, relevant case studies and information that will help, educate, and inform you during their buying journey |
a) Identity |
(a) Necessary for our legitimate interests (to develop our products/services and grow our business) |
|
To manage our relationship with you as an employee |
(a) Identity |
(a) Performance of a contract with you |
|
To process payments |
(a) Identity |
(a) Performance of a contract with you |
|
To comply with the national health and safety regulations and security reasons |
(a) Identity |
(a) Necessary for our legitimate interests (for managing our premises, perimetral security and to prevent fraud and crime) |
Note that we can process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground, we are relying on to process your personal data where more than one ground has been set out in the table above.
CHANGE OF PURPOSE
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes). If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact the Data Protection Officer using the contact details provided in this Privacy Notice.
MARKETING
We are committed to providing you with choices regarding certain Personal Data uses, particularly around marketing and advertising. We will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to receive 3rd party marketing communications at any time by contacting us.
