Restaurant Brands International, Inc. (RBI), the proud owner of the BURGER KING®, TIM HORTONS® and POPEYES® restaurant brands, knows that your privacy is important. This Privacy Notice sets out our privacy practices that apply when you use any BURGER KING®, TIM HORTONS®, or POPEYES® website, mobile or tablet application or other online service or platform of BURGER KING®, TIM HORTONS®, POPEYES® or any other RBI company that links or refers to it (collectively, the “Services”), regardless of who owns or operates the Services, as well as our interactions with you on third party platforms (such as social media).
Your personal data provided is processed by the following Personal Data Controller:
Burger King Europe GmbH
In case of any questions or concerns, please contact our Data Protection Officer using the details below:
Via email: BKIrelandDPO@rbi.com
Via post: Burger King Europe GmbH
attn.: Data Protection Officer
We collect personal data about our users in various ways. For example, we collect personal data that you provide to us, personal data that we collect through your use of the Services, and personal data that we collect from publicly available sources or third parties.
Data You Provide to Us. We collect personal data you give us when you use the Services. For example, when you visit one of our websites or use one of our Services, create an account with us, buy a stored-value card online, participate in a survey or promotion, we may ask for information such as your name, e-mail address, year of birth, gender, street address, or mobile phone number so that we can provide Services to you. We may collect payment information, such as your credit card number, security code and expiration date, to process a financial transaction you have requested. We also may collect information about the products you buy, including where and how frequently you buy them, your use of coupons and stored-value cards, and the rewards you earn through our loyalty programs so that we can learn more about your interests and better serve you. You are not obliged to provide your personal data to us (neither statutorily not contractually). However, if you decide not to provide your personal data, we may not be able to (fully) provide our Services to you.
Data About Your Use of the Services. In addition to the personal data you provide to us directly, we may collect personal data about your use of the Services. For example, we may collect:
• Device information — such as your hardware model, IP address, other unique device identifiers, operating system version, and settings of the device you use to access the Services.
• Usage information — such as information about the Services you use, the time and duration of your use of the Services and other information about your interaction with content offered through a Service, and any information stored in cookies and similar technologies that we have set on your device.
• Location information — such as your computer’s IP address, your mobile device’s GPS signal or information about nearby WiFi access points and cell towers that may be transmitted to us when you use the Services.
Data From Third-Party Sources. We may receive information about you from publicly and commercially available sources, as permitted by law, which we may combine with other information we receive from or about you. For example, we may receive personal data about you from a social media site if you connect to the Services through that site.
Other Data We Collect. We also may collect other personal data about you, your device, or your use of the Services in ways that we describe to you at the point of collection or otherwise with your consent.
We will process your personal data on the following legal basis:
• Performance of the contract or at your request processing prior to entering into contract
When You Register or Create an Account. If you choose to use certain features on the Services, you may need to register or create an account and provide personal data such as name, email address, location, year of birth and a user name and password that you choose. We use this personal data to identify you and provide the requested feature and Services.
When you Make A Purchase. When you make purchases through the online Services, we may collect personal data such as your name, email address, billing address, the email or mailing address for delivery (if applicable), phone number, and payment card information. This personal data is used to process, fulfill and deliver your order.
• Compliance with Legal Obligations
When You Use the Services in Contravention of the Laws or Service Provider Regulations. As soon as we become aware of the fact that you are using the electronically provided Services against provisions of the binding laws, or the Services terms & conditions or agreement you made with the Service provider on provision of these Services, we may use your personal data in order to establish your liability for such illegal use.
• Our Legitimate Interest
To Respond to You. When you contact us, we may collect personal data that identifies you (such as your name, address and a phone number) along with additional information we need to help us promptly answer your question or respond to your comment. We retain this personal data to assist you in the future and to improve our customer service, products, Services, and promotions.
To Contact You. We may contact you with offers and information about the Services and our affiliates, including to inform you about our products, events, promotions, and special offers that may be tailored to your interests. You may object to receiving commercial messages (excluding transactional messages) from us by following the instructions contained in our electronic messages or by contacting us as set out in the section “Personal data controller, data protection officer and contact details” above.
To Deliver Targeted Advertising. We may use your personal data, including your location information, to facilitate the delivery of targeted ads, promotions, and offers to you, on behalf of ourselves, select business partners, and advertisers, on and off the Services. (See “Interest-Based Advertisements” section below.).
To Better Understand Our Customers and to Improve Our Services. In the course of providing the Services, we may collect personal data on our users’ demographics, interests and behavior and analyze that personal data. We do this to better understand and serve our users, and to improve our products and Services.
To Facilitate Participation in Our Stored-Value Card Programs. If you purchase a stored-value card, we may also use your personal data to operate and manage that program, which may include setting up automatic reloads and providing online balance inquiries. We may also use this personal data to develop and improve our product and service offerings and provide you with tailored offers and information.
To Provide and Manage the Products and Services You Request. We use personal data that we collect to process your purchases of products, enable you to participate in features provided by the Services, provide you with tailored offers, and improve the Services that we provide to you. From time to time, we may offer you the ability to personalize our products and Services, such as by uploading a photo or other personal data. We may also use services provided by third parties (such as social media platforms) to serve targeted ads to you and others on such platforms.
When You Use a “Share with a Friend” or Similar Feature on the Services. The Services may offer a “share with a friend” or other similar feature which permits you to electronically send content from the Services to others by providing us with their contact information. Except where permitted by law, we do not use the contact information you provide when using this feature for other unrelated purposes without your consent or the consent of the recipient, as applicable. Please ensure that you only submit contact information for individuals you know and who would want to receive the content you share with them.
To establish, exercise or defense against any legal claims. We may process your personal data in order to establish, exercise or defense any legal claims against us.
Consent. We may otherwise use your personal data with your consent or at your direction.
Depending on the controller the number of operations performed on your personal data may vary. Your personal data will be not subject to automatic decision-making.
We will keep your personal data for as long as it is needed to fulfil the purposes for which it was collected (e.g. if it was collected for the performance of a contract your personal data will be stored for the duration of the contractual relationship to fulfill the contract) and in order to comply with legal or regulatory requirements. This may mean that some personal data is held for longer than other personal data. Your personal data will be stored for a period of two (2) months and deleted afterwards, except if we are required by law to retain it for longer or shorter.
The following provides information about entities with which we may share your personal data. Our practices vary depending on the type of personal data and sharing.
Affiliates. We may share personal data within our family of affiliated companies so that we may provide offers from those companies that may be relevant to you, better understand your preferences, and improve our Services.
Franchisees. We may share personal data with local owners of BURGER KING®, TIM HORTONS®, and POPEYES® restaurants, particularly when they will work with us in delivering Services to you. For example, local restaurants will implement delivery and take-away services that you may request through the Services. We also may provide our franchisees with personal data so that a local restaurant may provide you with offers and promotions that might interest you.
Business Partners. We may also share your personal data with business partners to provide you with Services that you request. For example, if you sign up for a promotion that runs on our Services but that is sponsored or co-sponsored by another company, your personal data may be shared with that sponsor. Please be aware that these entities can have their own privacy practices establishing different rules than the ones stipulated in this Policy. Therefore, we recommend you review their privacy policies carefully.
Service Providers. We may share personal data with companies providing services on our behalf, such as delivery services, hosting vendors, advertising service providers, data analytics companies, marketing service companies, and list managers. We also may share your personal data, including your payment information, as appropriate to process your payments for the Services or complete a transaction. Our service providers are given the information they need to perform their designated functions, and we do not authorize them to use or disclose personal data for their own marketing or other unrelated purposes.
Social Media Services. If you connect a social media account with the Services or engage with our services through a social media platform, we may share your personal data with that social media platform, and it may share personal data about you with us. We may use this personal data to personalize your experience on the Services and on the third-party social media platforms, or to provide you with offers or other products or Services you may request. The social media services’ use of the shared personal data will be governed by the social media services’ Privacy Notice and your social media account settings. If you do not want your personal data shared in this way, do not connect your social media service account with the Services.
Other Parties When Required or Permitted by Law, or As Necessary to Protect Our Users and Services. We and our service providers (including affiliates) may use and share your personal data as we believe is necessary or appropriate to protect, enforce, or defend the legal rights, privacy, safety, or property of the Services, our employees or agents or users, to detect, suppress or prevent fraud or where otherwise required or permitted by applicable law or legal process, including responding to a search warrant or other legally valid requests from public and government authorities (which may include lawful access by governmental authorities, courts or law enforcement agencies).
Other Parties in Connection With a Corporate Transaction. We reserve the right to transfer any personal data we have about you in the event that we sell or transfer all or a portion of our business or assets to a third party, such as in the event of a merger, acquisition, or in connection with a bankruptcy reorganization.
Otherwise With Your Consent or at Your Direction. In addition to the sharing described in this Privacy Notice, we may share personal data about you with third parties whenever you consent to or direct such sharing.
Aggregated Data. We also may provide aggregated personal data, and data with personal identifiers removed, to third parties to describe how our customers are using the Services.
Choices With Respect To Cookies and Similar Technologies. You may block cookies and similar technologies in your browser or device settings, as and if permitted by such device.
Choices With Respect To Interest-Based Advertising. You may object to profiling performed by us or third parties affiliated to us regarding direct marketing as well as to receiving targeted advertising from participating ad networks, audience segment providers, ad serving vendors, and other service providers by visiting websites operated by the Network Advertising Initiative and Digital Advertising Alliance or by sending an e-mail to email@example.com.
Manage Your Account. You may access, modify or delete your account on the settings or profile page, or by contacting the Data Protection Officer at BKIrelandDPO@rbi.com with such written request.
Your Rights. Where the processing of your personal data is based solely upon your consent, you have the right to withdraw your consent at any time. If you decide to withdraw your consent we will stop processing your personal data for that purpose. This will not impact on the legality of any processing undertaken by us prior to the withdrawal of your consent.
You have also the right to request access to your personal data, the right to rectification of inaccurate personal data, the right to deletion (under certain circumstances), the right to limit the processing (under certain circumstances), and the right to data portability. You are also entitled to object to the processing of your personal data in certain situations.
Subject to applicable law, you may also have a right to access, update, and correct inaccuracies in other personal data in our custody and control, subject to certain exceptions prescribed by law. You may request access, updating and corrections of inaccuracies in the personal data we have by emailing or writing to us at the contact information set out below. We may request certain personal data for the purposes of verifying the identity of the individual seeking access to their personal data records.
You can also lodge a complaint with a President of the Data Protection Office or relevant supervisory authority. To contact the Data Protection Commission, we invite you to visit its website: www.dataprotection.ie.
Email Promotions. You may opt out of receiving commercial email, text message, and other electronic messages from us (excluding transactional messages) by following the instructions contained in those messages.
We have in place physical, electronic and organizational procedures to protect personal data in our custody and control against loss, accidental or unlawful destruction, theft and unauthorized access, use, modification and disclosure.
Children’s Privacy. We do not knowingly collect any personal information from children under the age of 16 without parental consent, unless permitted by law. If we learn that a child under the age of 16 has provided us with personal information, we will delete it in accordance with applicable law.
Links to Third-Party Sites. Our Services may link to third-party websites and services that we do not operate and are outside of our control. We are not responsible for the security or privacy of any information collected by other websites or other services. Please exercise caution and review the privacy statements applicable to the third-party websites and services you use.
International Transfers. The Services are headquartered in Switzerland. Please be aware that information you provide to us or that we obtain as a result of your use of the Services may be collected in your country and subsequently transferred to, maintained and processed in Switzerland, Ireland, or another country by us or our service providers for the purposes mentioned above in accordance with applicable law. We may also transfer your personal data to third countries outside the European Union (“EU”) or the European Economic Area (“EEA”), which may provide lower standards for data protection as your country of residence. While transferring your personal data to third countries we will ensure that the addressees provide appropriate safeguards. Information on used safeguards and the means by which you may obtain a copy of them will be available from the Data Protection Officer under BKIrelandDPO@rbi.com.
Changes to Our Privacy Notice. We may modify this Privacy Notice from time to time. We will notify you of changes by posting changes here, or by other appropriate means. Any changes to the Privacy Notice will become effective when the updated policy is posted on the Services and you were informed on the changes of our Privacy Notice.
Questions. Please contact our Data Protection Officer at BKIrelandDPO@rbi.com with any questions or concerns about this Privacy Notice or the manner in which we or our service providers treat your personal information.