Privacy Policy

Effective Date: 1 November 2025

Last Updated: 1 November 2025

1. Introduction and scope

This Privacy Policy (“Policy ”) describes how CHAGEE, through its operating company in your country, its parent and other affiliated companies listed below (“ CHAGEE ”) would acquire, collect, use, process, analyse, store, retain, rectify, update, disclose, display, publish, disseminate, erase, and destroy (“Process ”) Personally Identifiable Information of customers through our services, including any of our websites, including our websites hosted on our social media platforms (“CHAGEE Website ”), the CHAGEE Mobile Application (“ Mobile App ”), other CHAGEE owned or operated websites, applications and online services that we may operate, and through our temporary and permanent establishments (“ Stores ”)(the CHAGEE Website, Mobile App and Stores referred as our “ Services ”).

This Policy is crafted in compliance with the relevant legal standards applicable in your country and all the countries we operate in. Changes to this Policy will be posted on this page, along with updated revision dates. We encourage you to review it frequently to stay informed of how we are protecting your information.

This Policy does not apply to external websites or services that display or link to different privacy statements. Websites and services co-branded with other partners may display or link to a joint privacy statement or separate privacy statements of our partners in addition to our Policy. We are not responsible for the policies and practices of third-parties. Any information you submit to those third-parties is subject to their privacy policy, terms and conditions, and other policies. By accessing the CHAGEE Website or utilizing the Services, you hereby validly and expressly consent to Processing your data, including your Personally Identifiable Information, in the manner described in this Policy.

2. CHAGEE entities operating across Asia

We operate across multiple jurisdictions in the Asia-Pacific region through our affiliated entities. These entities act as the Data Controllers and are responsible for delivering services and managing customer relationships in their respective countries:

Singapore: Tea Explorer Pte. Ltd.

Malaysia: Chagee (M) Sdn. Bhd. and CHAGEE Magma Sdn. Bhd.

Indonesia: PT CHAGEE Era Indonesia

Thailand: CHAGEE (Thailand) Company Limited

Vietnam: CHAGEE Vietnam Company Limited

Philippines: CHAGEE Philippines Inc.

Japan: CHAGEE Japan K.K.

Korea: CHAGEE Korea Limited

Each entity processes Personally Identifiable Information in accordance with this Policy and applicable local requirements, while adhering to consistent standards of data protection and privacy across all regions.

3. Information We Collect

4. Personally Identifiable Information / Personal Data

We collect Personally Identifiable Information in the course of provision of our Services to you, or otherwise when you consciously and voluntarily provide it to us. This may occur when you register on our Services, make a purchase, participate in promotions, send us any feedback, or engage in other activities where Personally Identifiable Information is needed for participation. The types of Personally Identifiable Information may include general and specific information as follows:

(a) Your Name, profile picture, email address, postal address, phone number;

(b) Your social media account, comments and chat history;

(d) Payment details (which are processed by secure third-party payment processors);

(e) GPS and location-based data, if such functionality is activated on the Mobile App;

(f) CHAGEE Mobile App account details, membership tier, transaction information, order history, location, number of loyalty points, and loyalty point transaction records; and

(g) Other demographic information such as country of registration, gender, and preferences.

We do not collect or store any information relating to your bank account, payment card information, PIN code, expiry date, CVV number, and any other material information of your account or payment card used for such transactions, which are collected and/or stored by secure third-party payment processors on their own terms and conditions.

5. Other Information

In addition to the Personally Identifiable Information mentioned above, we also automatically collect other types of information when you interact with our Services. This includes:

(a) Browser type, app type and device information;

(b) Operating system and other technical identifiers;

(d) IP address, which may approximate your location at the city or country level.

6. Sensitive Personally Identifiable Information

We do not collect or process any sensitive Personally Identifiable Information unless such processing is permitted or required under any applicable law. Moreover, if you voluntarily provide us with sensitive Personally Identifiable Information, it will be deemed that you have given your explicit consent for us to collect, use, disclose or process such data solely for the purpose for which it was provided. Sensitive Personally Identifiable Information includes, but is not limited to, the following:

(a) physical or mental health conditions;

(b) political opinions;

(d) commission or alleged commission of any offence; or

(e) biometric data.

7. Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to manage our CHAGEE Website and email programs, tailor our interactions with you, store your preferences and settings, gather demographic information about our user base, and improve our services.

Most web browsers allow you to manage your cookie preferences. You can choose to set your browser to notify you when a cookie is being sent or to remove or reject the cookies entirely. As each browser is different, we recommend referring to your browser’s help menu to learn how to modify your cookie settings. Please note that if you choose to disable or reject cookies, certain features or functions of the CHAGEE Websites or Services may no longer operate as intended.

8. Our legal basis for collection, use and disclosure of your Personally Identifiable Information

We collect, use, and process Personally Identifiable Information in accordance with applicable data privacy laws, including any of the following:

(A) your consent (subject to your right to withdraw consent at any time);

(B) performance of a contract in the provision of the Services to you;

(D) our legitimate business interests, provided that such interests do not override your fundamental rights and freedoms.

9. How We Use your Personally Identifiable Information

10. General purposes

All Personally Identifiable Information collected above may be used for any of the following purposes.

(a) Service Delivery: To manage accounts, deliver orders and services, process payments, and communicate regarding these services.

(b) Personalization: To offer a customized experience, and to tailor our marketing and advertising efforts to suit your needs and interests.

(c) Communication: To communicate about account and service updates, offers, and promotions, as well as respond to inquiries and offer customer support.

(d) Security: To detect, investigate, and prevent activities that may violate our policies or are illegal.

(e) Business Analysis and Improvement: To analyse preferences and user behaviours, and to improve our content, products, and services.

(f) Legal and Regulatory Compliance: To comply with any obligations under applicable laws, regulations, by-laws, codes or guidelines, including for purposes required by government agencies or relevant authorities.

11. Specific purposes of use

(a) CCTV Surveillance at Physical Stores: We may collect video recordings and images of individuals through closed-circuit television (CCTV) systems installed at our physical store locations. CCTV footage may capture your image, movements, and interactions within our premises. We may also integrate third-party tools and services within our CCTV systems to analyse CCTV footage for Security and Business Improvement purposes. Access to this footage is restricted to authorized personnel and retained only for as long as necessary to fulfil its intended purposes, unless a longer retention period is required by law or for investigation purposes. Additionally, all third-party processing of CCTV data is done such that your Personally Identifiable Information is de-identified prior to processing.

(b) Use of Third-Party Service Tools: To help maintain a secure environment and protect the integrity of your account, we may integrate third-party tools within our Mobile App for the purposes of fraud detection, device risk assessment, and identity verification. Depending on your device settings and app usage, these security tools may collect technical information such as your device identifiers (e.g., IMEI, MAC address, Android ID, OAID), application and Wi-Fi environment data (e.g., BSSID, installed apps list), and other system-level attributes. Further, we will always request your explicit consent before collecting any sensitive Personally Identifiable Information, and you can manage or revoke this consent at any time via your device’s settings.

12. Sharing and Disclosure of Personally Identifiable Information

(A) Third-Party Service Providers: We may share your Personally Identifiable Information with third-party vendors who provide services such as data analysis, payment processing, information technology and related infrastructure provision, customer service, email delivery, and auditing.

(B) Affiliates and Subsidiaries: We may share your Personally Identifiable Information within our corporate family (including entities outside of your home country) for data processing, storage, or reporting.

(C) Legal and Compliance: We may disclose Personally Identifiable Information upon government demand or as required by applicable law, regulation, legal process, or enforceable governmental request. This includes sharing information with law enforcement or regulatory authorities.

(D) Business Transfers: In connection with any reorganization, restructuring, merger, or sale, or other transfer of assets, we will transfer information, including Personally Identifiable Information, provided that the receiving party agrees to respect your Personally Identifiable Information in a manner that is consistent with our privacy policies.

(E) Licensee/Franchisee: We may share your Personally Identifiable Information with the licensee who accepts and delivers orders of food and/or beverage products, processes payments for food and/or beverage products, and communicates regarding acceptance and delivery of orders of food and/or beverage products.

(F) Transfer of Personally Identifiable Information overseas: In certain cases, CHAGEE may need to transfer or move Personally Identifiable Information overseas (including, but not limited to, Singapore, Malaysia, Thailand, etc). Any international data transfers will be in accordance with this Policy and in compliance with applicable laws

13. Automation and Profiling

CHAGEE implements automated decision-making and profiling for data processing via CHAGEE Website and Mobile App whereby the automated system processes data obtained without human intervention.

CHAGEE through its Website and Mobile App utilizes data obtained with profiling activities, such as but not limited to, targeted marketing and promotions, pursuant to its legitimate business interests. The automated decision-making and profiling are subject to safeguards laid out in the data privacy policy of CHAGEE.

14. Data Security and Integrity

CHAGEE takes reasonable steps to maintain appropriate physical, technical, and administrative security to help prevent loss, misuse, unauthorized access, disclosure, or modification of Personally Identifiable Information. As part of these efforts, we have implemented physical, electronic, and managerial safeguards to protect the Personally Identifiable Information we process, including access controls, encryption and secure socket layer (SSL) technology for data transmission, firewalls and intrusion detection systems for network protection, and regular audits and staff training to ensure compliance with our data protection policies.

Where CHAGEE provides and/ or transfers any Personally Identifiable Information that it collects from you to its parent, subsidiary, associated and affiliated companies, or to any agent, contractor, third party service provider or licensee/franchisee, located outside of your home country, such transfer will only be carried out where necessary and in the manner as described in this Policy. Prior to any such transfer, CHAGEE conducts adequacy assessments to ensure that the recipient jurisdiction or entity provides a level of protection comparable to that required under applicable data protection laws. Furthermore, all transfers are governed by binding agreements that impose appropriate safeguards to protect your personal data. By accessing the CHAGEE Website or utilizing the Services, you hereby validly and expressly consent to the transfer of your Personally Identifiable Information outside of your home country for the purpose or to the third parties described in this Policy.

CHAGEE will also take reasonable and appropriate security measures to ensure that any disclosure or transfer of your Personally Identifiable Information is conducted in a secure and controlled manner. Such measures include (i) controlled access and role-based permissions; (ii) encryption of data prior to transmission; (iii) secured channels or platforms for data sharing; and (iv) maintaining logs or audit trails for all disclosures made.

We will ensure that all parties to whom your Personally Identifiable Information is disclosed or transferred are, or shall be, bound by legally enforceable obligations to provide a standard of protection to Personally Identifiable Information comparable to the standard of protection as set out under applicable laws. CHAGEE will further use its best endeavours to ensure that each such party maintains appropriate physical, technical and organisational security measures to protect your Personally Identifiable Information against tampering and unauthorised access.

While CHAGEE uses reasonable efforts to protect Personally Identifiable Information in its possession or under its control, the transmission of data over the Internet or any other public network may be subject to loss, interception, and misuse.

15. Data Retention and Disposal

We retain Personally Identifiable Information for as long as necessary to fulfil the purposes for which it was collected, and following the fulfilment of those purposes, we may continue to retain your Personally Identifiable Information for a further period of up to 7 years to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period for Personally Identifiable Information, we consider the amount, nature, and sensitivity of the Personally Identifiable Information, the potential risk of harm from unauthorized use or disclosure of your Personally Identifiable Information, the purposes for which we process your Personally Identifiable Information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Upon the expiry of the retention period, we will take reasonable steps to ensure that your Personally Identifiable Information is securely deleted or permanently removed from our records, in accordance with the requirements of applicable laws

16. Your Data Subject Rights

Subject to the relevant laws of your country, you may have the following rights which you may exercise by reaching out to us, subject to an identity verification and assessment of the validity of such exercise:

(A) The right to be informed about how we collect and use your Personally Identifiable Information;

(B) The right to access and obtain a copy of your Personally Identifiable Information;

(D) The right to object to the processing of your Personally Identifiable Information;

(E) The right to request the deletion or blocking of Personally Identifiable Information under certain conditions

(F) The right to withdraw your consent to the Processing, where consent was provided (in such case, there may be aspects of the Services we cannot provide to you without your consent);

(G) The right to lodge a complaint with your home country’s supervisory authority;

(H) the right to request your Personally Identifiable Information in a portable format to facilitate a transfer of Personally Identifiable Information to another data controller; and

(I) and any other rights granted under applicable laws.

17. Access and Control of Your Information

CHAGEE recognises your rights under applicable laws to access the Personally Identifiable Information we hold about you, to request corrections or updates to that data, and to withdraw or limit your consent to the processing of your personal data or any other rights as specified under paragraph 10. To exercise any of these rights, you may submit a written request to our Data Protection Officer using the contact details provided below.

Where you maintain an account with us on Mobile App, you may also access and update certain Personally Identifiable Information directly by logging into your account and visiting the “Manage My Account” section.

18. Direct Marketing Preferences

CHAGEE may with your consent use your Personally Identifiable Information to send you marketing, promotional or advertising communications about our products, services, offers or events. You may at any time opt out of receiving such communications. To manage your marketing preferences, you may:

(A) Follow the unsubscribe or opt-out instructions in promotional emails and SMS we send you.

(B) Log in to your account via the Mobile App and update your preferences under the “Manage My Account” section.

19. Personally Identifiable Information of minors

CHAGEE does not knowingly collect or process Personally Identifiable Information of individuals under the age of 18 (or 13 in some countries) without the prior consent of a parent or legal guardian. If you are under the age of 18 (or 13), you must obtain such consent before submitting any Personally Identifiable Information to us, and this consent must be clearly indicated at the point of submission.

If we become aware that Personally Identifiable Information has been provided by a minor without the required consent, we will take reasonable steps to delete the data from our records. Parents or guardians who believe that their child has submitted Personally Identifiable Information without consent may submit a written request to our Data Protection Officer using the contact details provided below.

20. Privacy Policy Updates

We may update this Policy from time to time. When we do so, we will post the new Policy on this page and change the date at the top of the Policy. Subject to any applicable legal requirements to provide additional notice and/or obtain consent, any changes to this Policy will be communicated to you through existing CHAGEE’s communication channels and resources.

21. Contact Us

For any questions or concerns regarding our privacy practices or this Policy, you can contact our Data Protection Officer at the following email addresses below.

Data Controller and Data Protection Officer contact:

Singapore privacy_SG@chagee.com

Malaysia privacy_MY@chagee.com

Indonesia privacy_ID@chagee.com

Thailand Email: privacy_TH@chagee.com Address: No. 9 G Tower Grand Rama 9, 10th Floor, Office No. GS1002, Rama 9 Road, Huai Khwang Sub-District, Huai Khwang District, Bangkok 10310

Vietnam privacy_VN@chagee.com

Philippines privacy_PH@chagee.com

Japan privacy_JP@chagee.com

Korea privacy_KR@chagee.com

We value your opinions and suggestions and encourage you to share your views on our privacy practices with us. This Policy is designed to provide a comprehensive overview of our commitment to protect your privacy and to handle your Personally Identifiable Information with care and respect. As regulations and technologies evolve, we will continue to update this Policy to reflect changes in our practices.

22. Conflict

In the event of any conflict or inconsistency between the English version of this Policy and any other translated versions, the English version will prevail.