Privacy Policy

This Privacy Policy explains which personal data KFC Aruba collects, why we collect it, how long we keep it, and which rights you have.

Last updated: 7 August 2026 · Version 1.0

1. Controller

KFC Aruba Restaurants VBA, Caya Ernesto Petronia 62, Aruba, is the controller for the processing described in this policy. Contact: info@kfc.aw / +297 280 1110.

2. Which law applies

We process personal data in accordance with Aruban privacy legislation (the Landsverordening bescherming persoonsgegevens). Where we offer goods or services to, or monitor the behaviour of, individuals in the European Union or the European part of the Kingdom of the Netherlands, we also apply the European General Data Protection Regulation (GDPR) standard. We apply the stricter standard where the two differ.

3. Personal data we process

  • Contact and request data: name, email address, phone number and message content when you contact us or place a telephone order.
  • Job application data: name, contact details, CV, work history and any information you choose to share.
  • Transaction data: order details and receipt information. Card payments are processed by our payment provider; we do not store full card numbers.
  • Website data: IP address (shortened where possible), device and browser type, pages viewed, referrer and interaction data collected through cookies and similar technologies.
  • Social media data: public interactions when you engage with our Facebook, Instagram, TikTok or YouTube channels.
  • Camera images: footage from security cameras in and around our restaurants.
  • Account data (staff only): email and role information for our content management system.

We do not knowingly collect data from children under 16 through this website.

4. Purposes and legal bases

  • Serving you and handling orders — performance of an agreement.
  • Answering questions and complaints — performance of an agreement / legitimate interest.
  • Recruitment — steps prior to a contract / consent.
  • Website security, fraud prevention and safety in our restaurants — legitimate interest.
  • Analytics and improving our website and menu — consent (analytics cookies).
  • Marketing, promotions and advertising measurement — consent.
  • Legal, tax and accounting obligations — legal obligation.

Where processing is based on consent, you may withdraw it at any time; this does not affect prior processing.

5. Cookies

Our website uses functional, analytical and (only with your consent) marketing cookies. Full details and your choices are described in our Cookie Policy.

6. Sharing your data

We share personal data only where necessary, with:

  • IT, hosting, database and website service providers acting as processors under a processing agreement;
  • payment providers, banks and accountants;
  • marketing, analytics and social media platforms, where you have consented;
  • the KFC franchisor (Yum! Brands and affiliates) for brand, quality and reporting purposes;
  • authorities, when we are legally required to do so.

We do not sell personal data.

7. International transfers

Our service providers may store data outside Aruba, including in the United States and the European Union. Where data protected under the GDPR is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Retention

  • Contact and complaint correspondence: up to 2 years after the last contact.
  • Job applications: up to 4 weeks after the procedure ends, or 1 year with your consent.
  • Financial and transaction records: as required by tax law (generally 10 years).
  • Camera footage: normally no longer than 4 weeks, unless needed for an incident.
  • Cookie and analytics data: as set out in our Cookie Policy.

9. Security

We apply appropriate technical and organisational measures, including encrypted connections (HTTPS), role-based access control, authentication for our content management system and database-level access rules. No method of transmission or storage is completely secure; if a data breach occurs that is likely to affect you, we will inform you and the competent authority where required.

10. Your rights

You have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have data erased, where applicable;
  • restrict or object to processing, including direct marketing;
  • receive your data in a portable format (where the GDPR applies);
  • withdraw consent at any time;
  • lodge a complaint with a supervisory authority.

Send requests to info@kfc.aw. We may ask you to identify yourself and will respond within one month. If you are in the European Union, you may also complain to your national data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).

11. Changes

We may update this Privacy Policy. The current version is always published on this page with its date of last update.