Last Updated: 20 July 2018

Why do we have a Privacy Policy?

Summary:
When you interact with CIBO Espresso, you trust us with your information and expect us to protect and use it appropriately. We take privacy seriously and are committed to keeping that trust. That starts with helping you understand our privacy practices.
This policy describes the information we collect, how it is used and shared, and your choices regarding this information.

CIBO Espresso Australia Pty Ltd ACN 105 199 693 and its related entities (collectively referred to as “we”, “us”, “our” or “CIBO Espresso”) are committed to protecting the privacy of Personal Information in accordance with the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) (Act) or, where applicable, other data protection laws (such as those in force in the European Union (EU). This Privacy Policy sets out the way we handle Personal Information and includes information on how we collect, use, disclose, keep secure and provide you with access to your Personal Information, whether provided to us via our stores, head office, the CIBO Espresso website, the CIBO Espresso smart device application or other means.

1. What Personal Information do we collect?

Examples of Personal Information we may collect from you includes your name, address, date of birth (age), gender, home address, email address, telephone number, occupation, menu preferences, previous order information, IP address, credit card details, individual interests, preferences, tastes, purchasing behaviour, education details, employment history and other information relating to your work experience. We may also collect an opinion (including information or an opinion forming part of a database, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained from the information or opinion). Those are just a few examples so please review this Privacy Policy closely and let us know if you have any queries.

We do not collect Sensitive Personal Information, which includes information about racial or ethnic groups or religious beliefs, without your express consent or as otherwise required by law. The exception to this is when you apply for a position, or to become a franchisee, in which case refer to the sections below titled “Employment Applications” and “Franchise Applications”. We will not use Sensitive Personal Information for marketing purposes.

Summary:
The term “Personal Information” means any information that can be used to personally identify you.

2. How do we collect Personal Information?

Summary:
We collect your Personal Information in a number of ways. We may collect your Personal Information directly from you or in the course of our dealings with you, for example:

• Information that you provide to us, such as your name
• Information when you use our services, such as your purchase history

We will only collect Personal Information from you that we reasonably require for one or more of our business functions or activities and will do so in accordance with the Australian Privacy Principles.

The kinds of Personal Information we may collect from you will depend on what type of interaction you have with us. We may collect Personal Information from you in the following ways:

• When you participate in a promotion, competition, promotional activity, survey, market research or customer behavioural activity
• When you subscribe to our mailing list or interact or follow our social media pages including Facebook, Twitter and Instagram
• When you download or use a CIBO Espresso App
• We collect information about how you interact with our services. This includes information such as access dates and times, app features or pages viewed, app crashes and other system activity

• When you provide us with Personal Information via our stores or head office or when you place an order in store, by telephone or via our mobile or electronic ordering system

• If you use social media, any information that you allow the social media site to share with us
• If you provide feedback and opinions about our products and services through any channel
• If you contact our Support Centre we may record calls in and out of our Support Centre and so we will collect any Personal Information you provide during the call

• If you are applying for a position with CIBO Espresso, we will collect information as outlined in the section below titled “Employment Applications”

• If you are applying to become a CIBO Espresso franchisee, we will collect information as outlined in the section below titled “Franchise Applications”

• By accessing a website or mobile application via links in an email we have sent and/or by accessing a website or mobile application where you have identified yourself, you consent to the collection of such information where it is Personal Information. We may combine your anonymous or personal visitor session information or other information collected through tracking technologies with other Personal Information collected from you from time to time in order to understand and measure your online experiences and to determine what products, promotions and services are likely to be of interest to you.

• Depending on the CIBO Espresso services that you use, and your app settings or device permissions, we may collect your precise or approximate location information as determined through data such as GPS, IP address and WiFi.
• We may collect transaction details related to your use of our services, including your order details, date and time the service was provided, amount charged, and payment method

• We may also collect Personal Information through cookies and other identification technologies, please refer to “Cookies and Web Beacons” section below.
• Public databases
• If you use our ‘store locator’ feature, you can agree to share your location so that you can easily find the nearest store. If you use the store locator feature on our website(s) the data is cached (temporarily stored) and then trashed.

• If you use the CIBO Espresso app and have location services enabled, your most recent location each time you open the app will be cached. Previous locations are trashed, but each app open is stored.

• We may use CCTV in or around CIBO Espresso businesses to investigate any type of incident and protect our personnel. We will restrict access to any footage.

CIBO Espresso may combine the information collected from these sources with other information in its possession.

In some circumstances, we may collect Personal Information from third parties such as credit reporting agencies or marketing agencies. Where we do, we will ensure that we act in accordance with relevant Australian laws.

4. Cookies and web beacons

As you navigate through our websites or smart device applications, certain information can be passively collected (by us or our vendors) using various technologies such as cookies, internet tags or web beacons, and navigational data collection (log files, server logs and clickstream data). Using “cookies” enables us to collect data regarding your personal preferences, including what products you have ordered, at what times and in what amounts, the pages you have visited in what order and so forth. This enables us to recognise you as a specific customer and to help us and our third-party service providers present targeted and customised advertising to you. For example, we can keep track of the drinks you like such that if you consent, we can send you information about new products and promotions that you might be interested in.

If you do not wish to receive cookies, you can change your browser settings such that your device does not accept cookies or please contact us. However, please note that certain areas of the CIBO Espresso website or CIBO Espresso app may only be accessed in conjunction with cookies.

5. Third-party links

The websites may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control, endorse or make representations about these third-party sites and are not responsible for their privacy statements. When you leave our websites, we encourage you to read the privacy

Summary:
CIBO Espresso and its partners may use cookies and other identification technologies on our apps, websites, emails, and online ads for purposes described in this policy.
A “cookie” is a small text file that is stored on your browser or device that can identify you as a unique customer and store your personal preferences.

notice of every website you visit. If you choose to give Personal Information to unrelated third parties it will not be covered by this Privacy Policy.

On our online services, we may also have providers of other services like apps, tools, widgets and plug-ins (for example Instagram “Like” features), which may also use automated methods to collect information about how you use these features. These organisations may use your information in line with their own policies.

6. Employment applications

We collect Personal Information when you interact with us with regards to employment.

Examples of when we collect Personal Information includes when you apply for a position with us, complete an employment form for us, contact our Support Centre in respect to an employment opportunity, visit our website, social media channels or mobile applications.

In considering your application, we may also obtain Personal Information about you from third parties. For example, from your previous employers, recruitment agencies, nominated referees, government agencies and regulatory authorities. Subject to your consent, we may also collect Sensitive Personal Information about you such as information about your health (including any disability), any criminal record, if it is relevant to the role that you are applying for, and whether you identify as Aboriginal or Torres Strait Islander.

We collect Personal Information for a variety of purposes, including but not limited to any one or more of the following purposes: verifying your identity, communicating with you, assessing you for a position with us or one of our related entities and storing your information for future employment opportunities.

If you do not provide us with the information we request, we will be unable to do one or more of the above.

We may disclose your information to; referees or previous employers, recruitment agencies or agencies or contractors acting on our behalf, our related entities, law enforcement agencies to verify whether you have a criminal record or educational organisations to the extent necessary to verify your qualifications.

If we engage third party contractors to perform services for us which involves handling Personal Information, we will take reasonable steps to prevent the contractor from using the Personal Information except for the purpose for which it was supplied.

We will hold your Personal Information for future job opportunities with us, unless you tell us not to.

7. Franchise applications

We collect Personal Information about franchise applicants. This may include Personal information about residency status, employment history, financial capacity (including bank account information) and other information relating to your qualifications and experience.

Examples of when we collect Personal Information includes when you apply to be a franchisee with us, complete a form for us (CIBO Espresso Franchise Application Form), contact our Support Centre, visit our website, social media channels or mobile applications or otherwise provide Personal Information to us.

We may combine and compare Personal Information that we hold about you with other information collected from, or held by, others.

In considering your application, we may also obtain Personal Information about you from third parties, for example, from your previous employers, business contacts or nominated
referees. Subject to your consent, we may also collect Sensitive Personal Information about you such as information about any criminal record you may have or your membership of any professional or trade association.

We collect Personal Information for any one or more of the following purposes:

• assessing your application to become a CIBO Espresso franchisee;
• assessing whether you are suitable to progress to each stage of the CIBO Espresso franchise

recruitment process; and/or

• storing your information for future CIBO Espresso franchise opportunities.

If you do not provide us with the information we request, we will be unable to do one or more of the above.

We may disclose your information to; referees or previous employers, recruitment agencies or agencies or contractors acting on our behalf, our related entities, law enforcement agencies to verify whether you have a criminal record or educational organisations to the extent necessary to verify your qualifications.

If we engage third party contractors to perform services for us which involves handling Personal Information, we will take reasonable steps to prevent the contractor from using the Personal Information except for the purpose for which it was supplied.

8. Franchisees

A number of CIBO Espresso businesses are owned and operated by franchisees. CIBO Espresso’s franchisees are required to follow this privacy policy. If you are concerned that there may have been a breach of this privacy policy by a franchisee, please contact the relevant franchisee entity or CIBO Espresso directly.

This privacy policy does not apply to our franchisee’s conduct on websites or mobile apps they operate.

9. How we store your Personal Information

Where we store your Personal Information depends on what interaction you have had with us. However, some areas may include databases for processing customer enquiries, feedback or for general data processing or databases for email or SMS marketing communications.

10. Information retention and deletion

Summary:
CIBO Espresso retains user profile and other information for as long as you maintain your My Cibo (the CIBO Espresso loyalty program) or other CIBO Espresso account.
If you withdraw consent to the collection or use of Personal Information, CIBO Espresso deletes such Personal Information.
Users may request deletion of their accounts at any time. Following such request, CIBO Espresso deletes the information.

We only keep your Personal Information for as long as it is required for the purpose for which it was collected or as otherwise required by law. We will take appropriate measures to destroy or permanently de-identify your Personal Information if we no longer need to retain it. These measures may vary depending on the type of information concerned, the way it was collected and how it was stored.

There may be circumstances relating to employment or franchise applications or inappropriate or legal conduct which prevent CIBO Espresso from permanently deleting Personal Information. For example, in the case of fraud or where litigation has been threatened.

11. How your Personal Information will be used

We collect your Personal Information so that we can use it for our functions and activities and provide products and services to you, which include, among other things:

Providing services and features

CIBO Espresso uses the information we collect to provide, personalise, maintain and improve our products and services. This includes using the information to:

• Create and update your account
• Verify your identity
• To assist us in providing goods and services to you
• processing orders you place with us in our stores or via our electronic or mobile ordering system, providing you with email or SMS confirmation of your orders, providing you with our products and processing refunds where applicable;

• Perform internal operations necessary to provide our goods and services, including to troubleshoot software bugs and operational problems, to conduct data analysis, testing, and research, and to monitor and analyse usage and activity trends

• features to personalise your experience on our CIBO Espresso platforms
• to identify services and products that may be of interest to you
• assisting you with remembering and re-ordering from our menu in future
• administering and conducting traineeships

Summary:
CIBO Espresso does not sell your Personal Information to third parties.

• facilitating our internal business operations, including fulfilment of any legal and regulatory requirements
• to facilitate our feedback program
• processing and considering your employment application and conducting reference checks (refer to Employment Application section above)

• providing information that you request about our franchises and processing and considering your franchise application and conducting record checks (refer to Franchise Application section above)

• Facebook Custom Audiences: If you use Facebook, we may use your email address in an encrypted format to match with your Facebook profile so that we can provide you with personalised advertising on Facebook. This is subject to the privacy settings you have chosen on Facebook.

• Facebook Lookalike Audiences: If you use Facebook, we may use your email address in an encrypted format to enable Facebook to find other registered users of their services that share similar interests to you based on how you interact with CIBO Espresso and what information Facebook has about you.

Customer support
CIBO Espresso uses the information we collect to provide customer support services, including to:

• Direct your questions to the appropriate customer support person
• Investigate and address your concerns
• Monitor and improve our customer support responses
• administering and responding to your enquiry or feedback about our products
• to process and respond to any feedback provided by you

Legal proceedings and requirements

CIBO Espresso may share your information if we believe it is required by applicable law, regulation, operating agreement, legal process or governmental request, or where the disclosure is otherwise appropriate due to safety or similar concerns:

Communications from CIBO Espresso
CIBO Espresso may use the information we collect to communicate with you about:

• promoting and marketing current and future products, services, promotions, studies, surveys, news, updates and events
• conducting, and allowing you to participate in, a promotion, competition, promotional activity, survey or market research; fulfil any related awards, and serve you relevant ads and content about our goods or services and those of our business partners
• special promotions and offers and analysing our products and services so as to improve and develop new products and services.

This communication (including direct marketing materials) may take place via: email, text messages, other digital services (such as through our My Cibo app), phone, internet-based marketing including targeted online advertising and online behavioural marketing.

You consent to us sending you those direct marketing communications by any of those methods.

You may receive some of these communications based on your profile as a CIBO Espresso user. Users can object to this type of processing. You can contact us at any time if you no longer wish to receive marketing materials from us or our related entities.

With your consent

CIBO Espresso may share your information other than as described in this policy if we notify you and you consent to the sharing.

Vendors

We may share your Personal Information with vendors who provide services to us, such as fulfilling orders (e.g. Deliveroo), carrying out research (data processing), managing promotions, personalising customer experiences and other information technology services. We do not allow these vendors to use this information or to share it for any purpose other than to provide services on our behalf.

12. Marketing Opt-Outs

At any time, you may opt-out of receiving direct marketing communications from us or our related entities. We will then ensure your details are removed from our mailing lists and stop sending direct marketing communications to you within a reasonable period after your request is made (usually within 5 business days from receiving your request). To opt-out follow the instructions in the marketing communications we send you or contact us.

Please note that if you opt out, we may still send you non-promotional messages, such as receipts or information about your account.

13. Disclosure of Personal Information to third parties

We may disclose Personal Information we collect from you:

• to our related entities, suppliers, consultants, contractors or agents for the purposes set out in the section above or for other purposes directly related to the purpose for which the Personal Information is collected
• to relevant federal, state and territory authorities for the purpose of investigating a food safety or health issue
• to CIBO Espresso franchisee partners if you have made an enquiry or complaint relating to a store that is owned and operated by one of our franchisees
• where the law requires or authorises us to do so (whether in Australia or overseas)
• to others that you have been informed of at the time any Personal Information is collected from you
• with your consent (express or implied) to others

14. Overseas disclosures

We are based in Australia, so your Personal Information will be processed in Australia. However, some of our related entities and third-party goods and services providers are located overseas. We may need to share your Personal Information with organisations or persons located outside of Australia.

The countries in which these organisations or persons are located will depend on the circumstances, but in the course of our ordinary operations, we may disclose Personal Information to our third- party service providers located in the United States, United Kingdom and Italy.

If we disclose Personal Information to a third party in a country which does not have equivalent privacy laws to Australia, we will take steps to ensure that you are provided with appropriate safeguards in respect of your Personal Information. This might include entering into contractual clauses with the third-party that place obligations on the third-party in relation to their handling your Personal Information.

Whilst CIBO Espresso will take all reasonable care to ensure that overseas providers will handle your Personal Information securely, you acknowledge that by agreeing to the disclosure of your Personal Information to these overseas entities for the purposes stated above, CIBO Espresso will not be held accountable for any breaches of the Australian Privacy Principles by an overseas recipient.

15. Security

We take protecting your Personal Information seriously and are continuously developing our security systems and processes. We take reasonable steps to protect your Personal Information from misuse and loss and unauthorised access, modification or disclosure. We do this by having physical and electronic security systems and by limiting who can access your Personal Information. We also have online and network security systems in place for our websites, so that the information you provide us online is protected and secure. Your Personal Information may be held in electronic or hard copy form. We use third party service providers to store some personal information.

As our website and smart device application are linked to the internet which is inherently insecure, CIBO Espresso cannot provide any assurance regarding the security of the information you communicate to us online. We cannot guarantee that such information will not be intercepted so you transmit such information at your own risk. Please contact us if you become aware of, or suspect, any breach of security.

If we become aware of a data breach that is likely to result in serious harm (for example, your Personal Information was shared with unauthorised persons) we will notify you as soon as is practicable and the Office of the Australian Information Commissioner about that actual or possible breach.

16. Access to Personal Information and Correction

We aim to ensure that any information we obtain from you is accurate. You can request access to your Personal Information or advise us of any required correction and information which you believe to be inaccurate by forwarding a request to privacy@ciboespresso.com.

We will require you to verify your identity and to specify what information you require. We may charge a fee to cover the cost of verifying the application and locating, retrieving, reviewing and copying any material requested. If the information sought is extensive, we will advise the likely cost in advance and can help to refine your request if required.

The exceptions under the Australian Privacy Principles which affect your right to access your Personal Information we hold about you include the following:

• access would pose a serious threat to the life or health of any individual
• access would have an unreasonable impact on the privacy of others
• a frivolous or vexatious request
• the information relates to a commercially sensitive decision-making process
• access would be unlawful or denying access is required or authorised by law
• access would prejudice enforcement activities relating to criminal activities and other breaches of law, public revenue, a security function, or negotiations with the individual

• legal dispute resolution proceedings.

17. Contact Us

Although we are committed to ensuring that at all times there is strict adherence to the Australian Privacy Principles, in the event that you are dissatisfied in any way with the collection, use, storage and/or disclosure of your Personal Information or believe that there has been a breach of
the Australian Privacy Principles, we invite you to contact us as soon as possible. We have appointed an internal Privacy Complaints Manager (who is also our Privacy Officer) to whom your complaint or any queries may be directed by:

E-mail at privacy@ciboespresso.com Calling us on (03) 9508 4400
Writing to us at the below address:

Attention: Privacy Officer
Retail Zoo Legal Department Level 8, M-City Office Building and Business District, 2107-2125 Dandenong Road, Clayton Victoria 3168.

If our Privacy Policies do not answer a question that you have about how we manage your Personal Information, please call or email us.

All complaints are to be made in writing to CIBO Espresso and CIBO Espresso is then allowed a reasonable time (within 30 days) to respond to complaints. We may ask you to participate in a dispute resolution scheme (such as mediation) in order to resolve your complaint.

If you are not satisfied with our response, you can write to “Privacy Complaints Manager, Retail Zoo Legal Department, Level 8, M-City Office Building and Business District, 2107-2125 Dandenong Road, Clayton Victoria 3168.′′. If you are not satisfied with the manner in which we deal with your complaint, you may refer it to the Office of the Australian Information Commissioner (“OAIC“). You can contact OAIC by:

• visiting www.oaic.gov.au;
• forwarding an email to enquiries@oaic.gov.au;
• telephoning 1300 363 992; or

writing to OAIC at GPO Box 5218, Sydney NSW 2001. 18. Changes to this Privacy Policy

We may occasionally make changes to this Privacy Policy. We will post any changes to this privacy policy on our websites and applications. When we make material changes to this Privacy Policy, we will provide you with notice pursuant to applicable laws.

To the extent permitted under applicable law, by using our services after such notice, you consent to our updates to this policy.

We encourage you to periodically review this policy for the latest information on our privacy practices.

18. CIBO Espresso subsidiaries and affiliates

We share information with our subsidiaries and affiliates to help us provide our services or conduct data processing on their behalf.