Data Protection Policy

1. GENERAL
This Personal Data Protection Policy applies to our website dedicated to consumers in Portugal available at https://www.aguadeluso.pt (the "Site"), where SCC — Sociedade Central de Cervejas e Bebidas, S.A., a company with a share capital of EUR 5,000,000.00 (five million euros), registered in the Commercial Registry Office of Vila Franca de Xira under the single registration number 511147236, with registered office at Estrada da Alfarrobeira, nº 51, 2625-244 Vialonga ("SCC"), collects certain personal data (hereinafter the "Personal Data") and is the controller of such data.
Please read this Personal Data Protection Policy carefully as it contains important information to help you understand our practices regarding any Personal Data you share with us or that we collect in the context of the Site.
We respect your privacy and are committed to keeping your Personal Data secure and managing it in accordance with our legal responsibilities under applicable data protection laws.
Where we need to collect Personal Data to comply with legal obligations, or under contractual terms we have with you and you do not wish to share such necessary Personal Data, we may not be able to provide our services (for example, for the purpose of sending you a prize as part of a promotion) but we will notify you of this at the time.

2. WHAT PERSONAL DATA WE COLLECT AND HOW WE USE YOUR PERSONAL DATA
When using the Site, you will not be required to provide Personal Data, with the exception of cookies.
We clarify the purpose of the use of Cookies and the retention period that will apply to them, shortly, below, and invite you to consult the Cookies Policy for full clarification on the subject, as follows:

1) Information about your visit and use of our Website. When you visit our Website, we collect certain information such as the pages you visit, your clicks and views and your device type, operating system, and web browser type. Information about your use of our Website enables us to construct segments, i.e. groups of Website visitors or consumers with various common characteristics, such as age group, gender or region. You will probably be added to one of our segments.
We use this Personal Data as necessary and in our legitimate interests to promote our products and services to our consumers and visitors to our web site and to attract more consumers and visitors, increase the sale of our products and services.
Please read more about our Cookie Policy to learn how long-term personal data collected by cookies is stored.

2) Maintenance and optimisation of our Website. Your Personal Data will also be used in the maintenance and analysis of our Website to solve performance problems, improve availability and secure the Website against fraud (for example, in case of recurrent login attempts or if login is made without respecting our terms and conditions). The analysis also enables us to check whether the Site is working efficiently so that, if possible, we can improve it.
Our use of your Personal Data for these purposes is necessary to protect our legitimate interests and will be maintained. Please read more in our Cookies Policy about how long-term personal data collected by cookies is retained.

3. HOW WE SHARE YOUR PERSONAL DATA
We need to share Personal Data with third parties to help us provide the services and products we make available to you, and to manage our Website. These third parties are:
• HEINEKEN group companies, for the storage of Personal Data processed through the Website due to shared IT systems;
• Service providers, in case we need to use the provision of a service and data analysis services;
• Agencies that carry out the management of advertising promotions and competitions;
• Service providers that help us organise marketing campaigns and promotions;
• Communication agencies, for marketing and market research purposes;
• Third party service providers of social media platforms (including Facebook, Google and Instagram);
• Courts, litigation parties and their professional advisors, if we consider them necessary for the assertion, exercise or defence of rights in legal proceedings;
• An acquirer or parties interested in acquiring part of our business;
• Where HEINEKEN sells all or part of the assets or shares of a HEINEKEN group company with the transfer of personal data to a third party, your personal data may be made available to that third party;
• In addition, we may use, disclose or transmit your information to a HEINEKEN group company in the event of a reorganisation, merger, sale, joint venture, assignment, transfer or other disposition of all or part of our business, assets or stocks (including in connection with bankruptcy or similar proceedings).
These parties may be established in the European Union or other countries of the European Economic Area, or elsewhere in the world. If we have to store personal data outside the EEA, we will ensure an adequate level of protection for the data transferred. We require service providers to take appropriate measures to protect the confidentiality and security of personal data.

4. PERSONAL DATA SECURITY
We have taken appropriate security measures to prevent your Personal Data from being accidentally lost or used, accessed, altered, or disclosed without authorisation. Furthermore, access to your Personal Data is limited to employees, agents, contractors and third parties who need it for professional reasons, subject to the duty of confidentiality.
Unfortunately, we cannot guarantee the complete security of information transmission over the Internet, so please note that the security of information depends in part on the security of the device you use to communicate with us and the security you apply to protect account information and passwords. Therefore, please protect this information appropriately.
Our Website may include links to third party sites, extensions, and applications. Clicking on these links or activating these links may allow these third parties to collect or share data about you. We are not required to control these third-party sites, extensions, or applications, nor are we responsible for their privacy statements. We encourage you to read the privacy statement of each site you visit and each third party service or application you use.

5. RETENTION OF PERSONAL DATA
The Personal Data provided by you will be kept for the maximum time legally required or as long as necessary to provide you with any services requested in accordance with applicable laws and on the basis of consent, in accordance with the purpose explained. We will take appropriate steps to destroy or de-identify Personal Data that we keep if it is no longer necessary for the purposes set out above or after the defined retention period.

6. COOKIES
The information referred to in this Data Protection Policy is collected using cookies or similar techniques. Cookies are small text files containing small amounts of information that are transferred and may be stored on your device, e.g., your computer (or other internet-enabled devices such as a smartphone or tablet). The similar techniques we use that may be similar to cookies are tracking pixels.
These cookies and similar techniques are often necessary to remember your account settings, adopted language and country, but also enable us to measure and analyse your behaviour on our Site and to display personalised advertising on our Site or third party sites. We will ask for your consent to use cookies, where necessary. For more information on what cookies we use and how we use them, please read our separate Cookie Policy.

7. SOCIAL NETWORKS
You may choose to share information from our Site via social media such as Facebook, Instagram, or Twitter. This means that the information you share, with your name and preferences, will be visible to visitors to your personal pages. We advise you to carefully read the data protection policies of the social networks in question as they are applicable to the processing of your Personal Data by such third parties.

8. CHILD PRIVACY
We do not collect personal data from persons under the age of 18 or, if they provide us with such data, it will be deleted immediately as soon as we become aware of this fact.

9. YOUR CHOICES AND YOUR RIGHTS
If your personal data is or has been subject to the General Data Protection Regulation (GDPR) or, to the extent applicable, by local law, you will have the right to request, where applicable, access to, rectification of or deletion of your personal data, as well as to request limitation and objection to processing or portability of your personal data. All these rights are subject to data protection laws and related legislation, the Heineken Data Protection Procedure and other Heineken guidelines.
Data subjects may change their cookie preferences at any time and in accordance with the relevant policy. However, you are hereby informed that the withdrawal of consent to the processing of cookies does not render any processing under the previously granted consent unlawful.
Please read our separate Cookie Policy to learn how you can change your cookie preferences and delete cookies.
You also have the right, under certain circumstances, to request that we stop processing your personal data. However, this does not apply if we have other legal justifications for continuing to process your data (for example, where we have to comply with a legal obligation).
Please note that if you exercise any of your choices and rights, you may no longer be able to use the services provided by the Site, in whole or in part.
Data subjects have the right to lodge a complaint with the National Data Protection Commission.

10. UPDATES
We will keep this Data Protection Policy under review by making updates periodically. Any changes to this Data Protection Policy will be published on this page and, as far as possible, communicated to you.

11. CONTACT
The data subjects of Personal Data may exercise their rights free of charge and at any time. If you have any questions, objections, or complaints about the way we handle your personal data or about this Data Protection Policy, you can contact us using the following details and we will review your request.
To do so, please write to us:
By e-mail: privacy@centralcervejas.pt.
By registered mail: SCC – Sociedade Central de Cervejas e Bebidas, S.A., nº 51, Estrada da Alfarrobeira, 2625-244 Vialonga.
Remember that we may ask you for proof of identity when you send us an application so that we can check your identity.

The latest version of this Personal Data Protection Policy is dated 27 June 2022.