Privacy Policy

Nespresso Privacy Notice

Nestlé Nespresso S.A. (“Nespresso”), which includes Nespresso’s affiliated companies, is aware that you may wish to be informed about how your personally identifying data and information, such as name, address, telephone/fax numbers or e-mail address etc (“Data”) that you may provide to Nespresso, are treated. Accordingly, we have developed this Privacy Policy (“Policy”) to explain our use of your Data as well as all our reasonable precautions to keep your Data confidential and secure.

By ordering our products and using our services, you are consenting to the Data collection and use practices described in this Policy, as modified from time to time by us. We reserve the right to modify our Policy and invite you to consult this Policy from time to time in order to familiarise yourself with any changes, We will post any new Policy on our websites, changing the date in the last paragraph of such Policy.

The terms of this Policy are without prejudice to any contractual terms you may enter into with us, which shall prevail over the terms of this Policy.

1.What is Personal Data?

In the scope of PDPL personal data is any information relating to an identified or identifiable natural person (“Personal Data”) and the Special Categories Of Personal Data concerning a person’s race, ethnic origin, political opinions, philosophical belief, religion, sect or other faith, attire and clothing, membership to associations, unions or trusts, health, sex life, criminal record and biometric and genetic data. (“Special Categories of Personal Data”).

In the scope of this Disclosure the explanations made concerning your Personal Data also cover your Special Categories of Personal Data.

2.Which Methods Do We Use and For Which Legal Reasons Do We Collect Your Personal Data?

During all of our Personal Data Processing activities we act in accordance with the obligations and principles set forth in regulations, especially PDPL and we take all necessary precautions to make sure your Personal Data is Secure.

Per PDPL we collect and process your Personal Data automatically and by means that are not automatic, through channels listed below and various channels that may be added later, in audio, verbal, written or electronic form and in the scope of Article 5.1, 5.2, 6.2 and 6.3 of PDPL depending on the purpose of processing:

• Through our various websites (“Websites”), especially our websites related to the Nespresso brand and our websites where personal data is processed, that are managed by Group Companies that produce and distribute Company or Nespresso products our mobile and other various applications and all other online channels (“Media Instruments”) belonging to the Group Company that produce and distribute Company or Nespresso products or through cookies (“Cookies”) belonging to the Company or to thirds companies as specified below which enable communication with your devices on websites,

• Through all sales and marketing networks (“Nespresso Stores”) established or operated by the company and managed under Nespresso,

• Through forms and various methods on sales and marketing organized by company employees and/or third parties (“Field Employees”) who operate for Nespresso on behalf of the Company and work in the sales and marketing network,

• Through businesses (“Businesses) that belong to or are under the control of the Company,

• Through accounts operated on behalf of the Company and Nespresso on various social media channels (“Social Media”),

• Through various communication methods, including written correspondence conducted over our e-mail addresses (“E-mail”), short messages (“SMS”) or multimedia messages (“MMS”) and all other types of communication tools (“Communication Tools”),

• Through our call centers (“Call Centers”) managed by the Company or third parties hired by the Company,

• Through third parties like the group companies, business partners and producer companies that the Company provided services to or obtains services from or the companies that they supply services/products to

3.Identity of the Data Controller

In terms of Your Personal Data which you share by the means described above the Data Controller is the Horizon 2000 Gıda Sanayi ve Dış Ticaret Anonim Şirketi registered with the Istanbul Chamber of Commerce under number 285763 with Mersis number 0463029085100019 residing at Dikiliaş, Emirhan Cad. Cami Meydanı Sok. Karakol Çkm. No:1/A Beşiktaş.

4.Which Personal Data Do We Process?

The following are provided as examples of the Personal Data we process:

Your Personal Data that you provide to us: Name-last name, date of birth, T.R. Identification Number, telephone number, e-mail address, address and all other Personal Data that you share with us over the channels specified above.

Various Information Including Personal Data Collected Automatically: Your Personal Data which is collected via automatic search engines, audio visual recording devices, Cookies or other instruments. Data that is collected through cookies is anonymous as long as you don’t become a member and is not in the nature of Personal Data. In this scope the computer and connection information like internet protocol (IP) address that is used to connect your computer to the internet; internet browser extension types and versions, received and read confirmations on e-mails, log on, e-mail address, password, web browser type and version; clock settings; communication system and platform; purchasing history, location, URLs you have entered from our websites, cookies number; products you have viewed or searched, all telephone numbers you have used to call our customer services and audio and visual recordings used for security and quality improvement purposes are all examples of Personal Data.

Various Information Including Personal Data from Other Resources: social media tools, current delivery and address information that has been shared with us by our business partners, suppliers and other third parties based on prior consent you have given them; account information, purchase and webpage viewing information; information on searched terms and search results, paid listings (like Sponsored links are all examples of Personal Data..

5.For What Purpose Do We Process Your Personal Data?

We process your Personal Data with your explicit consent as a rule. However, in the exceptional situations allowed in the scope of PDPL your Personal Data may be processed without your consent (PDPL Article 5.2 and Article 6.3).

a) Per Article 5.2 and 6.3 of the PDPL we process Personal Data without your explicit consent in the following situations; (i) for the purpose of fulfilling our legal obligations(tax, legislation, legislation on the protection of consumers, occupational health and safety legislation, code of obligations, commercial and various legislation, telecommunications legislation, banking legislation, etc.), (ii) it is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his consent or whose consent is not deemed legally valid (iii) for the purpose of membership contracts, provision of products and services that have been ordered or purchased over internet sites, to communicate when necessary in this scope, to enable purchase-sale processes in Company Stores, POS use, return, transport services, to establish a remote sales contract in the scope of electronic trade, sale, supply, delivery of products or services, to receive questions or complaints, to respond to you, to provide after sales services, to be used in the event of possible conflicts, to establish or execute a contract, or fulfill your legal obligations or facilitate, exercise and protect a right (iv) provided that processing shall not violate your rights and freedoms, to protect our legitimate activities like but not limited to cost reduction, efficient use of resources, observing the service quality of call centers (processing for ensuring your security, gauging the quality of the services being provided to you, evaluating the demands you submit in this scope and solving these problems, processing over shared servers and software used operationally to reduce costs and all manners of processing that can be excused in the scope of the relevant regulation). Plus we can also process your Personal Data, which you have made public over instruments such as social media, without seeking your explicit consent to the extent that is allowed in the scope of PDPL.

b) If we receive your explicit consent as a Nespresso Club Member in the scope of PDPL Article 5.1 and 6.2 to process your Personal Data by using the above specified channels through the means also described above we may process your Personal Data:

(i) To present you with offers on products and services that are exclusive to you like internet advertising, targeting, re-targeting, cross sales, campaigns, offers and product/service advertisements, to use Cookies for this purpose and make commercial offers taking into account your preferences and most recent purchase

(ii) To determine how you heard about our websites, to create traffic statistics that are not anonymous over a single user record, to make your website visit more pleasant and increase the use and functionality of the website, to get to know you during your website visit and provide content that is made compatible with your expectations and interests and enable personalized searching options, to use Cookies for this purpose and track your use habits according to your previous record when you visit Company Stores and provide you with exclusive offers on products

(iii) To present you with advertisements, campaigns, advantages and other benefits to be made available special to you for sales and marketing activities and for various marketing and CRM (Customer Relations management) work and to use Cookies for this purpose

(iv) To create new product and service models, to use Cookies for this purpose

(v) To send electronic commercial communications (campaigns, newsletters, customer satisfaction surveys, etc.)

(vi) To send gifts and promotional items and various magazines/periodicals

(vii) For corporate communication and to organize various events and invitations in this scope and information on these events.

(viii) Also if we have your explicit consent for using your Special Categories of Personal Data, they may be processed for the purposes specified in PDPL Article 5.2 and for the purposes specified here from clause (i) to (vii).

In this scope you can help us by giving your consent on the documents and fields where your explicit consent is sought for each of the processing types in this Disclosure Statement that require explicit consent. However this Disclosure Statement has been prepared to fulfill our obligation as a Data Controller in the scope of PDPL exclusively and your consent concerning these processes shall be obtained separately and in the event that you do not give consent in the relevant channels these processes shall not be carried out.

6.What is the Period for Our Processing your Personal Data?

Your Personal Data shall continue to be processed in accordance with the time periods required in the legislation on Personal Data Collection, especially PDPL, and in any case for as long as the legitimate purposes continue to exist.

7.Transmitting Your Persona Data to Third Parties and/or Foreign Countries

The Company may transmit your Personal Data, which has been collected through the channels and by the means described in this Disclosure Statement to third parties or foreign countries in the scope of PDPL and various legislations and for the purposes. Your Personal Data:

a) May be shared, in the scope of Articles 5.2 and 6.3 of PDPL if there are reasons that do not require your explicit consent with third parties in the country and especially in EU countries, America, England, the OECD countries, Dubai, India, China and Russia from which we receive warehouse, archive, informatics technologies support (server, hosting, program, cloud computing), security, call center support, the Company which we cooperate with and/or acquire services from and/or the Group Companies that produce and distribute Nespresso products, business partners, supplier companies, banks, financing institutions, consultants from which legal, tax, etc. services are acquired and other related parties, authorized agencies and institutions that need to be transmitted to for these purposes.

b) May be shared, in the scope of Articles 5.1 and 6.2 of PDPL on the condition of obtaining your explicit consent with third parties in the country and especially in EU countries, America, England, the OECD countries, Dubai, India, China and Russia from which we receive warehouse, archive, informatics technologies support (server, hosting, program, cloud computing), security, call center support, the Company which we cooperate with and/or acquire services from and/or the Group Companies that produce and distribute Nespresso products, business partners, supplier companies, banks, financing institutions, consultants from which legal, tax, etc. services are acquired and other related parties, authorized agencies and institutions that need to be transmitted to for these purposes, CRM companies, Marketing research companies and third parties that provide support like mailing and SMS transmission for advertisement, marketing and sales.

Also per your explicit consent, if a portion of the Company or its assets (brand, domain name, and including but not limited to other commercial business elements) are sold your Personal Data may be transferred to domestic or foreign third parties including the natural or legal entities that take transfer of your Personal Data, their stakeholders, business partners, intermediaries, consultants to the degree required by the transfer, may be processed to a degree limited to the necessary evaluation by these third parties during the processing period and if a transfer occurs, the party taking transfer may continue to process, as the data controller, the assets and your Personal Data which are values related to these assets.

For security of the Personal Data of our valuable customers we hereby declare that none of your Personal Data in any shape or form is processed in the scope of activities that are not related to Nespresso.

8. Access to Your Personal Data and Your Rights in the Scope of PDPL

Per PDPL article 11 everyone has the right to apply to the company to;

• Learn whether or not your personal data has been processed;

• Request information as to processing if your data has been processed;

• Learn the purpose of processing of the personal data and whether data is used in accordance with their purpose;

• Know the third parties in the country or abroad to whom personal data have been transferred;

• Request rectification in case personal data is processed incompletely or inaccurately;

• Request deletion or destruction of personal data when the reasons for processing your personal have been removed to be evaluated within the principles of purpose, term and legitimacy;

• Request notification of processes to third parties to whom personal data have been transferred when your personal data has been corrected, deleted or removed;

• Object to occurrence of any result that is to her/his detriment by means of analysis of personal data exclusively through automated systems;

• Request compensation for the damages in case the person incurs damages due to unlawful processing of personal data

In this scope you can submit requests to the Company for your rights as stated above by filling out the application form on our Website with identifying information and documentation or you can create your own request fulfilling the conditions specified by the Personal Data Protection Agency through the methods specified below.

(i) By hand delivery with your wet signature or through a notary to the below provided mailing address that is provided below and may be subject to change from time to time,

Address: : Horizon 2000 Gıda Sanayi ve Dış Ticaret A.Ş.

Dikilitaş, Emirhan Cad. Cami Meydanı Sok. Karakol Çkm. No:1/A Beşiktaş, İstanbul (İstanbul Ticaret Sicili No: 285763, Mersis No: 0463029085100019

(ii) By e-mail to our below provided e-mail address from your e-mail address which you have submitted to us previously and which is recorded on our system (please check your e-mail address that is on record in our system) or with a secure electronic signature or mobile signature to our KEP address

E- mail address : kvkk@nespresso.com.tr

KEP address : horizon@hs01.kep.tr

(iii) Other methods determined by the Personal Data Protection Agency that may be added to the above specified methods in the future.

Please confirm the current application methods and application content conditions from the legislation in advance. Applications that do not match the content conditions set forth by the Agency or are sent by methods not accepted by the Agency shall not be accepted.

Your request shall be concluded, depending on the nature of your request, in the shortest possible time and within 30 (thirty) days at the latest free of charge. If a cost is generated due to the fulfillment of your request we can only charge the fees that are set forth by the Personal Data Protection Agency.

You may always keep informed on changes in legislation concerning Personal Data and our applications on our relevant website.