PRIVACY NOTICE

Kalnapilio - Tauro grupe is a part of the Royal Unibrew group of companies under Royal Unibrew A/S, Faxe Allé 1, 4640 Faxe, Denmark (the "Group").

Privacy Policy

When we refer to "we", "us" or "our" in this privacy policy, we are referring to the relevant Group company responsible for the processing of your data. You can find a list of all Royal Unibrew's companies and locations here: https://www.royalunibrew.com/about-us/company-structure . This privacy policy applies to all companies throughout the Group.

The controller of your personal data is the Royal Unibrew Group company with which you interact. If you are unsure which company you are interacting with, you can contact us at GDPR@Royalunibrew.com.

In this privacy policy you can read how we process your information.

This privacy policy applies to anyone who purchases products or services from us, is a supplier or business partner, is a visitor to one of our physical addresses, is a job applicant, participates in one of our events or a competition, or otherwise in-teract with us, such as when you use one of our websites, or communicate with us via social media or another platform.

How we process your personal data

The processing of your data depends on the context in which you interact with us.

Below you can read more about the activities in which we process your infor-mation. Below we specify to whom the information relates, what types of infor-mation we process, the legal basis, and how long we store the information.

In this policy, you can also read more about who we may share the information with.

Please note that we may process information for several different purposes if you interact with us in several ways, e.g., if you are both a customer of ours and visit one of our physical locations.

If you contact us, including filing a complaint

The data controller for the processing of your personal data is the Royal Uni-brew Group company with which you correspond. If you are in doubt about which Royal Unibrew Group company you are corresponding with, you can con-tact us at GDPR@Royalunibrew.com.

The purpose of our processing of your information, if you contact us as a consumer or if you complain about one of our products or an experience with us, is that we can process your inquiry and ensure that you receive a response from us.

Our legal basis for processing your information in the above situations is our legitimate interest in processing your inquiry and ensuring that any complaints, including complaints about our products, are investigated, and handled, cf. Arti-cle 6(1)(f) of the General Data Protection Regulation.

We ask not to receive information that falls within the special category of da-ta, cf. Article 9(1) of the General Data Protection Regulation, including health da-ta, information about religious beliefs or trade union membership. If you never-theless provide such information to us, we assume that you have given your ex-plicit consent to the processing, and we therefore process this information based on your consent, cf. Article 6(1)(a) and 9(2)(a) of the General Data Protection Regulation.

The information we process

We may process the following information about you as a consumer or com-plainant:

• Contact information: e.g. name, address, e-mail, telephone number, post-code, customer number, initials
• Work-related information: e.g. title, position, place of work
• Other information that you yourself provide to us when you contact us
• Special categories of data, e.g. data about your health, religion or trade union membership, if you have provided them in connection with your enquiry with us.

Storage of your information

We do not store information longer than is necessary to fulfill the purpose. The period during which we store your information will be determined specifi-cally depending on the case in which the information is included. We delete your information as soon as your case has been processed unless we need to be able to document the correspondence/complaint for a longer period.

If you are a supplier or business partner

The purpose of our processing of your data when you are a supplier or busi-ness partner is to be able to manage the ongoing trading or cooperation relation-ship, including contract management, and to ensure effective communication with you.

If you are a direct party to the contract (e.g. if you are a one-man business), our legal basis for processing your data is that we can perform a contract with you as a supplier or partner, cf. Article 6(1)(b) of the General Data Protection Regulation. In other cases, we process your personal data on the basis of our le-gitimate interest in safeguarding our rights and obligations under the agree-ments etc. that we have entered into with the company you are employed by, cf. Article 6(1)(f) of the General Data Protection Regulation.

In addition, we process your information to:

• ensure quality and control our supply chain, including to ensure respect for fundamental rights and the fight against crime.
• internal analyses and reporting as well as training of our employees and consultants

Our legal basis for this processing is to pursue our legitimate interest in the above purposes, cf. Article 6(1)(f) of the General Data Protection Regulation. In this context, we register our correspondence with you for documentation to ful-fill the purposes.

The information we process

We may process the following information about you as a supplier or part-ner:

• Contact information: e.g., name, address, e-mail, telephone number, post-code, customer number, initials
• Work-related information: e.g., title, position, place of work
• Financial information, such as payment terms, bank account details and cre-ditworthiness
• IT-related information, such as user ID, log-in details and data and logs about your use of our websites

Storage of your information

We store your information for as long as we have a business relationship and for a period after the end of the business relationship to comply with applicable legislation, including bookkeeping legislation in the countries in which we oper-ate. However, the information may be processed and stored longer in anony-mized form.

If you are a customer or potential customer

The purpose of processing your information when you are a customer or po-tential (consumer or business) customer, including when you shop in our online stores, is that we can fulfill agreements with you, including ensuring the execu-tion, delivery, or cancellation of an order and services related thereto.

If you are a direct party to the contract (e.g., if you are a one-man business), our legal basis for processing your data is to enter into or perform a contract with you as a customer or potential customer in connection with entering into a contract, cf. Article 6(1)(b) of the General Data Protection Regulation. In other cases, we process your personal data based on our legitimate interest in safe-guarding our rights and obligations under the agreements etc. that we have en-tered with the company you are employed by, cf. Article 6(1)(f) of the General Data Protection Regulation.

In addition, we process your information in connection with:

• Customer support and general communications
• Quality assurance of our products and services
• Development of products and services
• Credit ratings
• Internal analyses and reporting as well as training of our employees and consultants

Our legal basis for this processing is basically that we can pursue our legiti-mate interest in the above purposes, cf. Article 6(1)(f) of the General Data Pro-tection Regulation.

The processing may also be necessary for the establishment, prosecution or defence of legal claims, cf. Article 6(1)(f) and Article 9(2)(f) of the General Data Protection Regulation.

The information we process:

We may process the following information about you as a customer or po-tential customer:

• Contact information: e.g., name, address, e-mail, telephone number, post-code, customer number, initials
• Work-related information: e.g., title, position, place of work
• Financial information, such as payment terms, bank account details and cre-ditworthiness
• IT-related information, such as user ID, log-in details and data and logs about your use of our websites
• Photos or video of you

Storage of your information

We store your information for as long as we have a business relationship and for a period after the end of the cooperation to comply with applicable legisla-tion, including bookkeeping legislation in the countries in which we operate. However, the information may be processed and stored longer in anonymized form.

If you visit our websites or use our apps

Personal data about you will be collected through our websites and apps in one or more of the following cases:

• When you visit and browse our websites and apps
• When you create a user profile
• When you download material from our websites and apps
• When you make use of our other features and services

In addition, we will collect your personal data via our websites and apps when you communicate with us, e.g., submit an inquiry through a contact form, when you sign up for our newsletter, when you participate in our competitions or use other services and features through our websites. These processing opera-tions are described in separate sections of the privacy policy.

The purpose of processing your data when you are a visitor to our websites or when you use our apps is:

• that we can manage user accounts and profiles
• that we can develop, improve, and administer these platforms, including en-suring the content is relevant and presented in the most effective way on your device
• to ensure that you can participate in/register in connection with interactive features and offers from us
• to analyze traffic on our websites and apps

Our legal basis for processing your data is our legitimate interest in the above purposes, cf. Article 6(1)(f) of the General Data Protection Regulation, or your consent, which we obtain if this is required by law, cf. Article 6(1)(a) of the General Data Protection Regulation, e.g., in connection with the use of cookies. You can read more about the use of cookies in the section below.

We are also obliged to ensure that we comply with the legislation on the marketing of our products, according to which only persons of a certain age can legally purchase our products and receive marketing of our products, in particu-lar regarding products containing alcohol. We therefore process information for this purpose, and our legal basis for processing this information is our legal ob-ligations to comply with legislation on the purchase and marketing of our prod-ucts, cf. Article 6(1)(c) of the General Data Protection Regulation.

Finally, we may also process information that you have manifestly made public, cf. Article 6(1)(f) and Article 9(2)(e) of the General Data Protection Regu-lation.

The information we process:

We may process the following information about you as a visitor to one of our websites or apps:

• Contact information: e.g., name, address, e-mail, telephone number, post-code, customer number, initials
• Photos or video
• Personal information: e.g. age
• Other information that you have published yourself
• Cookies

Storage of your information

Information processed in our apps is stored for as long as your profile is ac-tive, but we may retain the information for a longer period if required by the laws of the countries in which we operate. For retention periods for cookies, please refer to the section on cookies below.

If you visit our social media profiles

We and the providers of the relevant social media platform are joint data controllers for the processing of personal data collected in connection with your visit to our profile or page on the individual social media platform.

We have profiles or pages on various social media (platforms). You can cus-tomize your privacy settings individually on each platform. We refer to the pro-vider's privacy policies as well as settings for using the platform.

You can also contact us if you have questions about the joint data responsi-bility and the processing of your information on social media.

The information we process:

When you visit or interact with our social media profiles, we, and the pro-vider of the social media platform may collect, process and store the following types of personal data about you:

• Information available on your profile, including your name, gender, marital status, workplace, interests and city
• Whether you "like" or have used other reactions to our profile
• Comments you leave on our posts, including in connection with competi-tions
• That you have visited our profile

Purposes of processing

We process your personal data for the following purposes:

• Improving our products and services, including our social media profiles and pages
• Statistics and analysis
• To communicate with you if you comment on a post, leave a review or send us a message
• Marketing in general, including the organization of competitions

The social media providers process, among other things, your personal data for the following purposes:

• Improving their ad system
• To provide us with statistics that the social media providers compile on the basis of, among other things, your visit to our profiles and pages
• Advertising and personalization of activities on the Site

Our legal basis for processing your information is our legitimate interest in being able to communicate with and market ourselves to you on our social me-dia profiles, as well as our legitimate interest in improving our products and services, cf. Article 6(1)(f) of the General Data Protection Regulation.

The social media providers base the processing of your personal data on their legitimate interests, including their interest in improving their advertising system and providing us with statistics that the social media provider, for ex-ample, compiles based on your visit to our profile or social media page.

In addition, social media providers have a legitimate interest in providing an innovative, individually adapted, secure and cost-effective service, cf. Article 6(1)(f) of the General Data Protection Regulation. The social media providers process certain of your personal data in accordance with your consent, which you can withdraw at any time via your privacy settings on the social media, cf. Article 6(1)(a) of the General Data Protection Regulation.

Storage of your information

We encourage you to delete comments, likes and other interactions you have left on our profile if you no longer want them to appear on our pages. We do not delete such publicly available interactions.

If you communicate with us via the social media messaging function, we will delete the messages when you request it.

Please refer to the privacy policy of the individual social media providers for information on how long they keep your personal data.

The social media platform providers’ sharing of information

The providers of social media platforms may, among other things, share your personal data with the following categories of recipients:

• Other entities within the group of companies of which the social media pro-vider is part
• Externally with business partners who provide analysis and survey ser-vices
• Advertisers
• Other people who visit our profile or social media page (to the extent your information is publicly available)
• Researchers and other academics

You can find more information about with whom the social media providers share your personal data in the privacy policy of the individual providers, in-cluding in which cases the social media providers may transfer your personal data to recipients outside the EU/EEA.

If you attend one of our events

If you participate in one of our events, including events sponsored by us, the purpose of processing your information is that we can hold the event and regis-ter your and any companions' participation for administration purposes and to maintain security in connection with the event.

Our legal basis for the processing is that we can pursue our legitimate inter-est in hosting events and meeting your specific wishes and needs in connection with our events, cf. Article 6(1)(f) of the General Data Protection Regulation.

If we process photos or video of you in connection with one of our events, it is based on your consent, which we obtain if this is required by law, cf. Article 6(1)(a) of the General Data Protection Regulation. Please note that by law, we may in many cases process images or video where you are included if it is an image or video where you are not in focus, e.g., if you are part of the audience at an event.

We ask not to receive information that falls within the special category of da-ta, cf. Article 9(1) of the General Data Protection Regulation, including health da-ta, information about religious beliefs or trade union membership. If you never-theless provide such information to us, we assume that you have given your ex-plicit consent to the processing, and we therefore process this information based on your consent, cf. Article 6(1)(a) and 9(2)(a) of the General Data Protection Regulation.

The information we process

• Contact information: e.g., name, address, e-mail, telephone number, post-code, customer number, initials
• Work-related information: e.g., title, position, place of work
• Photos or video
• Other information that you yourself have provided in connection with the event
• Special categories of data, such as information about your health or religion, religion or trade union membership, provided by you in connection with your participation in the event

Storage of your information

As a rule, we store your information for up to 1 year, unless we are obliged to store your information for a longer period in the country where we have held the event, or for as long as necessary for us to handle any matters relating to the event, including to document participants in the event and respond to inquiries from you.

If you visit one of our physical locations

The purpose of processing your information when you are a visitor to one of our locations is to ensure security for both our own and our visitors' sake, as well as to investigate, prevent and document accidents and criminal matters.

In addition, we are obliged to ensure safety around the processes that are part of our food production, for example to comply with applicable legislation on food quality and safety.

We have installed video surveillance as well as logging of the use of access cards at certain of our locations.

The legal basis for processing your data is our legitimate interest in register-ing visitors to our locations and maintaining a certain level of security, cf. Article 6(1)(f) of the General Data Protection Regulation.

We ask not to receive information that falls within the special category of da-ta, cf. Article 9(1) of the General Data Protection Regulation, including health da-ta, information about religious beliefs or trade union membership. If you never-theless provide such information to us, we assume that you have given your ex-plicit consent to the processing, and we therefore process this information based on your consent, cf. Article 6(1)(a) and 9(2)(a) of the General Data Protection Regulation.

The information we process

We may process the following information about you as a visitor to one of our locations:

• Contact information: e.g., name, address, e-mail, telephone number, post-code, customer number, initials
• Work-related information: e.g., title, position/seniority, field of work, access card ID
• Other ID: e.g., your license plate if you have used our parking area
• Special categories of data, such as data concerning your health, religion, or trade union membership, if you have provided these during your visit.

Storage of your information

As a rule, we store your information for up to 1 year, unless we are obliged to store your information for a longer period in the country where you have vis-ited one of our locations, or for as long as necessary for us to handle any matters relating to your visit, including to document your visit and respond to inquiries from you.

Video surveillance is stored for up to 30 days, after which it is automatically deleted.

If you receive marketing or participate in a marketing competition

The purpose of processing your data when you receive marketing or partici-pate in a marketing competition is that we can carry out and administer market-ing, including sending newsletters and conducting and administering competi-tions.

We also process your information to ensure that we comply with relevant legislation, e.g., applicable Marketing Practices Act(s) in the country where the marketing activities are carried out, when you receive marketing of our products or participate in our competitions.

We will only send you product information, newsletters, and other market-ing material by e-mail if you have given your prior and explicit consent to this, unless applicable law allows us to contact you without such consent. In this connection, we make sure to fulfill our legal obligations to comply with legisla-tion on the purchase and marketing of our products, cf. Article 6(1)(c) of the General Data Protection Regulation.

If you participate in one of our competitions and win a prize, we may make your and your potential guests' information available on our website or on our social media pages. We may also share your information with third parties if necessary to provide you with your prize. The legal basis for processing in con-nection with competitions is generally the performance of an agreement with you, cf. Article 6(1)(b) of the General Data Protection Regulation.

For the above purposes, we may also process information that you have manifestly published, e.g., on one of our social media pages, cf. Article 6(1)(f) and Article 9(2)(e) of the General Data Protection Regulation.

The information we process

• Contact information, e.g., name, address, email, telephone number, zip code, customer number, initials
• Participant information: for example, information about you and your guests in connection with a competition that you enter or have won
• Photos or video of you and your potential guests
• Personal information: Age
• Other information that you yourself have provided in connection with par-ticipation in a competition or similar.

Storage of your information

We store your information for up to 2 years, unless we are obliged to store your information for a longer period in the country in which you have received marketing or participated in a competition or for as long as necessary for us to handle any matters regarding marketing or participation in a competition, in-cluding to document your participation. However, the data may be processed and stored longer in anonymized form.

We store documentation of your marketing law consent for 2 years from when you have revoked your consent to receive direct marketing material.

If you participate in market research or similar

If you participate in a market survey, questionnaire survey or similar, the purpose is to understand you as a customer or consumer. We process your data to understand, calculate or determine the perception of our products, us as a supplier or the effectiveness of our services, performance, or marketing. This supports that we can, among other things, improve our products, services, in-formation, and marketing aimed at you, and that you can receive recommenda-tions regarding products and services.

Our legal basis for processing is that we can pursue our legitimate interest in ensuring the quality of and improving our products and services as well as offer-ing you relevant offers and services, cf. Article 6(1)(f) of the General Data Protec-tion Regulation.

If required by law, we obtain your prior consent to contact you about market research before processing your data, cf. Article 6(1)(a) of the General Data Pro-tection Regulation.

The information we process:

• Contact information: e.g., name, address, e-mail, telephone number, post-code, customer number, initials
• Work-related information: e.g., title, position, place of work

Storage of your information

As a starting point, we store your information for up to 5 years. We only store your information for as long as it is legal and as long as it is nec-essary to be able to answer any inquiries from you. However, the information may be processed and stored longer in anonymized form.

If you are applying for a job

If you apply for a job, you must create a profile in our recruitment system, where you can also read more about the processing of your information in con-nection with recruitment in our separate personal data policy for job applicants, which you can find in the recruitment system.

If you are an applicant for a position, the purpose of processing information about you is to assess whether you are a qualified candidate for a vacant posi-tion. We also register your information to document your application after the recruitment process has been completed.

Our legal basis for processing your personal data is your request for our pro-cessing of your application and CV prior to possibly entering an employment contract, cf. Article 6(1)(b) of the General Data Protection Regulation.

If you are hired, we store the information that has been part of the recruit-ment process in your personnel folder.

If you are covered by our compliance, anti-crime or similar activities

The data controller for the processing of personal data collected as part of our whistleblower scheme is Royal Unibrew A/S.

The purpose of processing your data in connection with our compliance, an-ti-crime or similar activities is that we can:

• Check that our transactions and dealings, including with business partners and third parties, comply with applicable law and our ethical guidelines, and ensure that we only have business partners and suppliers who meet these standards
• Ensure compliance with our policies, procedures, guidelines and standards if you use our services or visit physical locations
• Ensure the quality of our products and services
• Contribute to the fight against crime, including fraud, and to establish, de-fend or assert a legal claim.
• Manage and operate our whistleblower portal. If you have reported a case anonymously, we will not have access to your information
.

The processing of your data is necessary for us to pursue our legitimate in-terests in the above purposes and to ensure documentation of the fulfillment, cf. Article 6(1)(f) of the General Data Protection Regulation.

In certain cases, we are obliged to process the information to comply with anti-money laundering legislation or other legislation, cf. Article 6(1)(c) of the General Data Protection Regulation.

Furthermore, we may process your data to establish, defend or assert a legal claim, cf. Article 6(1)(f) or Article 9(2)(f) of the General Data Protection Regula-tion.

The information we process

• Contact information: e.g., name, address, e-mail, telephone number, post-code, customer number, initials, as well as information about you and any com-panions in connection with an event, competition, survey or similar in which you have participated.
• Work-related information: e.g., title, position/seniority, field of work, admis-sion card ID
• ID information: Personal identifikation number, driver's license information, passport information
• Other ID: e.g., your license plate if you have used our parking area
• Financial information: Bank account information, transaction information, purchase history
• Photos and video, e.g., from an event
• Special categories of data, such as information about your health, religion or trade union membership, that you have provided to us in the course of an inter-action with us
• Digital footprints: browser "fingerprint", your devices' "fingerprint", IP ad-dress, MAC address, OS, location information, browsing history, user ID/login name, password, online nicknames, social media profiles, voIP names (e.g., skype name), logs, device ID (e.g., IMEI, ICCID, IMSI)
• Other information included in a report made on the whistleblower por-tal
• Cookies (You can read more about the use of cookies in the section below)

Storage of your information

We do not store information longer than is necessary to fulfill the purpose. The period during which we store your information will be determined specifi-cally depending on the case in which the information is included. The period depends, among other things, on the basis on which your data is processed.

We delete the information as soon as the case in which your information is included has been closed, unless your information is included in other cases, or has been collected for other purposes, after which we can store the information longer.

Sharing personal data

We may share your personal data with our suppliers and partners if necessary to fulfil our obligations to you. Suppliers and partners may be, for example, suppli-ers of goods or services (e.g., in connection with the delivery of an order to you), IT suppliers and providers of IT systems.

In connection with visits to our websites, use of other digital services offered by the Group or participation in events and when receiving other marketing material, we may also share your information with hosting companies, providers of booking systems, providers of marketing services and other providers of services necessary to fulfil these purposes. Such service providers will process the personal data in accordance with our instructions under signed data processing agreements.

Information may be required to fulfill our obligations under the law or to pro-tect our or others' rights, property, or safety. In these cases, we may disclose in-formation to public authorities, auditors, lawyers, or other advisors.

In some cases, we disclose your data to other companies in the Group for the purpose of analyzing, developing, and managing our business, as well as in cases where our services are shared between our companies.

In connection with the development of the Group, the corporate structure may change, e.g., by transfer of all or part of the activities. In the event of transfer of parts of the business or other commercial changes, the processing basis for the connected disclosure of personal data is generally our legitimate interest herein.

If we transfer information to third parties outside the EU and/or EEA, we are obliged to take special precautions to ensure that your information is protected. We will always ensure an adequate level of data protection and a lawful basis for the transfer of your data, for example by using the EU Standard Contractual Clauses (SCC).

You can contact us at any time for more information about who your infor-mation is shared with.

Consent

In cases where we process your information based on your consent, you can always withdraw your consent. If you withdraw your consent, we will stop pro-cessing your information unless we are entitled or obliged to continue processing or storing your information on other grounds, including in accordance with the law.

Withdrawing your consent does not affect the lawfulness of the processing based on your consent before its withdrawal.

You can withdraw your consent at any time by:

• Contacting us (see contact details below)
• Deleting your profile in cases where you have created a profile
• Consent to cookies can be withdrawn as described in the cookie policy of the website you are visiting

If you withdraw your consent, you may not be able to fully use the features we offer on our websites.

Cookies

We use cookies on our websites. You can read more about our use of cookies in the cookie policy, which is available and updated at any time via a link on the web-site you are visiting.

Your rights

According to the law, with certain exceptions, you have certain rights in con-nection with our processing of your information:

• You have the right to gain insight into the information we process about you
• You can object to our collection and further processing of your infor-mation
• You have the right to have your information corrected or deleted, subject to certain statutory exceptions
• You have the right to ask us to restrict processing
• In certain cases, you have the right to receive the information we have regis-tered about you and request us to transfer such data to another data controller (data portability)
• If we process your data on the basis of "our legitimate interest", then you can object to the processing on this basis

Your rights may be restricted in the country where you live.

If you wish to exercise your rights, please contact us (see contact details below). In connection with inquiries regarding your rights, we ask you to provide us with sufficient information to enable us to process your inquiry, including that you ena-ble us to identify you in relation to what your request is about.

References to other websites, etc.

Our websites may contain links to other websites. We are not responsible for the content of other websites (third party websites) or for the procedures such third parties have for collecting and processing information. When you visit a third-party website, you should read the website owner's privacy policy and other relevant policies.

Contact us

If you wish to exercise your rights or if you have questions about the processing of your data, you can contact us per e-mail at: GDPR@Royalunibrew.com.

You can also always contact your local company under the Royal Unibrew Group. You can find a list of all Royal Unibrew's companies and locations here https://www.royalunibrew.com/about-us/company-structure

Complaints

If you disagree with the way we process your information or the purposes for which we process the information, you are welcome to contact us at GDPR@Royalunibrew.com.

You can also lodge a complaint with your local data protection authority. You can find an overview of data protection authorities in the EU here: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Changes to the Privacy Policy

We reserve the right to change this privacy policy in the event of significant changes in legislation or as a result of changes in our processing activities.