We keep this Privacy Notice under regular review to make sure it is up to date and accurate. This notice was last updated on 3 December 2024.
Introduction to this Privacy Notice
This Privacy Notice explains how Gong cha, its group and affiliated companies and master franchisees ("Gong cha") collects, stores, uses, protects and shares your personal information, when you interact with us. For example, when you purchase our products or visit our website.
Gong cha's group and affiliated companies include Gong cha Global Limited; Gong cha Americas Inc; GC Naperville LLC; GC West Sheridan LLC; GC State Street LLC; GC North Lincoln; Gong cha USA Franchisor, LLC; Gong cha USA Product Supplier LLC; Gong cha USA Inc; Gong cha Korea Co., Ltd.; Gong cha Japan Co.; and Gong cha International Co., Ltd.
Depending on your interaction with us, you might interact with one of our franchisees. Each of our franchisees has their own obligations to present relevant privacy information to you. We have sought to include some of the key information for ease of reference. However, please visit the local franchisee's website or write in to their nominated address.
We will only use your information for reasons you provided in the first place or where we otherwise have a valid basis to do so.
This notice applies to our global business and your information will be shared internationally (e.g., between the UK, EU, APAC and the US) for the purposes set out below.
Residents of certain states with comprehensive privacy laws in the US, including California residents, can view our state-specific privacy disclosures by clicking here.
If you have any questions about the content of this Privacy Notice, the terms used within it, or wish to exercise any of your rights, please contact our DPO using the details provided below.
2. Categories of data collected and method of collection
Depending on how you use our services, we may collect (and have collected in the prior 12 months) the following categories of personal information:
Your personal information is usually processed when you provide it to us, or our carefully selected service providers (e.g., companies conducting surveys on our behalf), directly.
Where you use social media sites and interact with our social media pages, we will collect your social media data from those sites, e.g. to understand your preferences and interests. Your personal information can be collected by one of our franchisees and shared within our group companies. We also collect information indirectly from the tracking technologies used on our site.
3. Purposes of processing and corresponding legal bases
4. Data sharing
In carefully selected scenarios, we share your personal information with third parties. We only do so where we have a lawful reason to do so.
Gong cha has a number of service providers that it has engaged to provide services on its behalf or to you directly:
Marketing and survey companies that obtain feedback and provide insights on our products and services.
Cloud storage providers and other hosting services that help us administer, manage and improve this site.
Gong cha franchisees, affiliates, business partners and entities within our corporate group to ensure we provide a seamless and efficient service.
Government entities, regulatory bodies and law enforcement agencies where valid requests for information are made.
Prospective buyers associated with any prospective M&A activity that Gong cha engages in.
Advertising networks.
Vendors and service providers, including internet service providers; and data analytics providers.
Operating systems and platforms.
Social networks.
5. International transfers
When you access our global site, your personal information will be processed internationally depending on the purpose of processing. This could involve an international transfer outside the country which you reside, including to the United States. Such countries can have data protection laws that are different or less protective than the laws of the country in which you reside. For such transfers, we rely either upon an adequacy decision (which is a country deemed to have an acceptable level of protections to send receive such data from) or upon appropriate safeguards as permitted under applicable law and standards, including relying on Standard Contractual Clauses or other appropriate safeguards permitted under applicable laws (e.g. the General Data Protection Regulation). You can request a copy of our safeguards by contacting our DPO on the contact details below.
6. US State Privacy Disclosures
This section provides additional information for residents of certain US states, such as California, and describes our information practices pursuant to applicable state privacy laws such as the California Consumer Privacy Act 2018, as amended by the California Privacy Rights Act 2020, and its implementing regulations (the “CCPA”). Depending on how you interact or engage with us, we may provide you with other privacy notices with additional details about our privacy practices.
This section applies to “personal information” or “personal data,” whether collected online or offline. This section does not address or apply to our handling of personal information that is exempt from applicable state privacy laws, nor does it apply to our processing of employee or applicant data. We are committed to maintaining and using deidentified information in compliance with applicable state privacy laws.
In respect of collection and processing of personal information in California, your local Gong cha franchisee based in California is responsible for complying with privacy information requirements. In this section, we include information relating to their collection and processing of personal information and provide an overview of your rights under the relevant local law.
Sources of Personal Information. We generally collect personal information from the following categories of sources:
Directly or indirectly from you;
Our affiliates, parent companies, subsidiaries and franchisees;
Our business partners;
Social networks;
Internet service providers;
Operating systems and platforms; and
Our vendors and service providers.
Purposes for Collecting and Disclosing Personal Information. As described in the “Purposes of processing and corresponding legal bases” section above, in general, we collect and otherwise process the personal information we collect for the following business or commercial purposes:
Taking and facilitating online orders;
Communicating with customers for marketing purposes;
Carrying our market research to improve products and services;
Information shared when engaging with our customer services teams;
Targeting/advertising activities;
Complying with legal and regulatory requirements;
For the purposes of corporate transactions; and/or
Reviewing prospective franchisees and assessing their suitability to join the Gong cha family.
Sensitive Personal Information. Notwithstanding the purposes described above, we do not collect, use, or disclose “sensitive personal information” beyond the purposes authorized by applicable state privacy laws.
Retention of Personal Information. As more fully described in Section 9 Retention below, we retain your personal information for only as long as necessary to operate our service and the purposes for which the information was collected. Where we have committed to maintaining and using personal information in a deidentified form, we agree not to reidentify deidentified data except as permitted by applicable law.
Disclosure of Personal Information to Third Parties and Other Recipients. The categories of personal information we have disclosed for a business purpose (including in the preceding 12 months) include: identifiers, customer records, commercial information, Internet or other electronic network activity information, , audio, video, and other electronic data, inferences, and sensitive personal information. The categories of third parties and other recipients to whom we may disclose personal information for a business purpose are listed above in this Privacy Notice.
Sales and Sharing of Personal Information. Applicable state privacy laws define "sale" as disclosing or making available personal information to a third-party in exchange for monetary or other valuable consideration. The CCPA defines “sharing” to include disclosing or making available personal information to a third-party for purposes of cross-contextual behavioural advertising, and other state privacy laws consider this to be “targeted advertising.”
We do not “sell” or “share” personal information defined above. We also do not sell or share personal information about individuals we know are under age 16.
Your Privacy Rights. Residents of certain US states may be entitled to exercise privacy rights regarding their personal information. These rights may include the following, depending on your state of residence and are subject to certain exceptions:
Right to Know/Access. The right to request:
The categories or personal information we collected about you;
The categories of sources from which the personal information is collected;
Our business or commercial purposes for collecting, selling, or sharing personal information;
The categories of third parties to whom we have disclosed personal information; and
A copy of the specific pieces of personal information we have collected about you.
Right to Correct. The right to request that we correct inaccurate personal information.
Right to Delete. The right to request we delete your personal information.
Right to Opt-Out of Sales and Sharing. We do not “sell” or “share” personal information, or use it for w, so you do not have the right to opt-out.
Right to Limit Use. We do not engage in uses or disclosures of “sensitive personal information” that would trigger the right to limit use of sensitive personal information under the applicable state privacy laws.
Right to Opt-Out of Profiling in Furtherance of Decisions that Produce Legal or Similarly Significant Effects. We do not use personal information to inform decisions that produce legal or similarly significant effects, so you do not have the right to op-out of this use.
Right to Appeal. If we deny your privacy rights request, you may have the right to appeal our decision by sending an email to dataprivacy@gong-cha.com and providing information about the decision you are appealing. We will review your appeal and notify you of any decision via email.
Right to Non-Discrimination. We will not discriminate against you for exercising any of the rights described in this section.
Exercising Your Privacy Rights. If you are a resident of a state that provides for the above privacy rights and would like to exercise your privacy rights, you may do so via any of the methods described below:
Email us at dataprivacy@gong-cha.com
Write in to ’The Directors’, 2nd Floor 20 Midtown, 20 Procter Street, London, United Kingdom, WC1V 6NX.
Verification. Before responding to your request, we must first verify your identity using the personal information you recently provided to us. You must provide us with your full name and email address. We will take steps to verify your request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.
Authorized Agents. You may designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization in their first communication with us, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.
Notice of Financial Incentives. We may make available certain programs or offerings that are considered “financial incentives” under the CCPA as described below:
Our membership and loyalty program allows you to earn rewards or discounts whenever you shop at our stores or order take-out and use your membership information. Rewards may be redeemed for various offerings. Participants may also receive exclusive offerings and periodic rewards. We encourage you to read the terms of our membership program before registering.
Our membership program involves collecting the following categories of personal information:
Identifiers, such as name, email address, phone number, date of birth, and membership number.
Personal information described in Cal. Civil Code § 1798.80(e), such as phone number.
Commercial information, such as records of your purchases and rewards redeemed.
Inferences drawn from the above categories.
We may share this personal information with the categories of third parties listed under “Disclosure of Personal Information to Third Parties and Other Recipients.”
Gong cha benefits financially from our membership program through increased customer loyalty and sales, but we do not assign an independent monetary value to the personal information we collect in connection with the program. Further, the precise value we receive from each member’s personal information can vary greatly by individual and depends on (without limitation) (a) the amount spent, and rewards accumulated, (b) the rewards redeemed, and (c) how often a member shops at our stores. Some benefits to members may also be intangible, such exclusive member functionality available via an app or the member’s account.
To the extent we calculate the value of the personal information we collect through our membership program, we do so in good faith based on the expenses related to the collection and retention of personal information in connection with the program.
You must opt-in to the membership program. You may withdraw from our membership program at any time by contacting us at dataprivacy@gong-cha.com. Please note that by withdrawing from our membership program you will no longer have access to the program’s benefits and rewards. If you request that we delete your personal information, then the rewards you have earned will no longer be available because we will no longer be able to associate you with those points and rewards.
Rights Under California Shine the Light Law. Under California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), California residents who provide us certain personal information are entitled to request and obtain from us, free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing use. Such requests may be made once per calendar year for information about any relevant third-party sharing in the prior calendar year. To submit a “Shine the Light” request, email us at dataprivacy@gong-cha.com, and include in your request a current California address and your attestation that you are a California resident.
7. Children
Our online services are not directed to, and we do not knowingly collect personal information from, children under the age of 16. If you are a minor, please do not attempt to send any personal information to us. If a minor has provided us with personal information without parental or guardian consent, the parent or guardian should contact us immediately to remove the relevant personal information.
Should we become aware that a minor has provided us with personal information, we will take steps to promptly delete such information from our systems.
8. Contact details
Should you have any questions about the contents of this notice or if you would like to exercise any of your rights, please contact the directors at 2nd Floor 20 Midtown, 20 Procter Street, London, United Kingdom, WC1V 6NX.
9. Retention
We will retain your personal information for only as long as necessary to operate our service and the purposes for which the information was collected. We might need to also process your information to meet legal, regulatory and accounting obligations, or as otherwise required or permitted by law. We will aim to anonymise and/or aggregate personal information and store such anonymised or aggregated information in order to analyse metrics and trends.
We retain your information in accordance with our established retention periods. We determine the appropriate retention period for personal information by considering the amount of information processed, its nature and sensitivity, the potential risk of harm and its severity, our business interests, whether we can achieve those purposes through other means, and applicable legal requirements.
When we no longer require the personal information we have collected about you, we will either delete or otherwise anonymise it.
10. Security
Keeping your information secure is important to us. We have implemented policies, technical and organisational measures to help protect your information from unauthorised or unlawful processing.
Even though we take these steps to keep your information secure, you should be aware that the use of the internet is not entirely secure and for this reason we cannot guarantee the security of any information which is transferred from you or to you through the internet. Should you wish to learn more about how to protect your information and your devices against online fraud, please visit www.getsafeonline.org.
11. Rights of individuals
Under data protection law, individuals in the EU and UK have rights we need to make you aware of. The rights available to you depend on our reason for processing your information and there are some exemptions to those rights, which means you may not receive all the information you desire. To find out more, contact our DPO on the details provided.
You have the right to ask us for information pertaining to and copies of your personal information.
You have the right to ask us to rectify information you think is inaccurate.
You also have the right to ask us to complete information you think is incomplete.
You have the right to ask us to erase your personal information in certain circumstances.
You have the right to ask us to restrict the processing of your information in certain circumstances.
You have the right to object to processing if we are able to process your information because the process is in our legitimate interests.
You have the right to data portability. This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
You have the right to complain to your local supervisory authority. For example, in the UK, the supervisory authority is the Information Commissioner's Office (https://www.ico.org.uk/).
If we process your personal data on the basis of your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.