PRIVACY POLICY

For what purpose do we use your personal data?

Under data protection law, we can only use your Personal Data if we have a proper reason for doing so, e.g.:

• to comply with our legal and regulatory obligations;

• for the performance of a contract with you or to take steps at your request before entering into a contract;

• for our legitimate interests or those of a third party; or

• where you have given consent.

Generally, the information we collect is only used for any purpose for which you submitted it to us, for any purpose made clear to you at the point it was collected or here in this Privacy Policy. These purposes may include:

• When you register or sign-up via our Digital Services: the Personal Data you give is used to provide you with the benefits that typically come along with registration. This includes information on the products and brands that you have signed up to (and, if you have opted-in, to receive information about other Pernod Ricard products), the ability to send, receive and personalize communications you select at the time of registration or that automatically come with your registration. For example, subscription to a newsletter, creation of an account, participation in a sweepstake or contest, invitation to or attendance at an event organized by us or on our behalf;

• When you are selected or invited to attend an event we will use your Personal Data to provide you with details, tickets, and entry information and to provide the organizers with information to allow them to verify your attendance;

• When you enter a sweepstake or contest we use your Personal Data to identify unique entrants and to inform winners and others of the outcome;

• When you use the ‘Send to a friend’ feature: Personal Data for one-time use (typically, names and email addresses) is used only once (e.g., to send a message) and is not retained by us;

• When using e-commerce on some of our websites: we (or a third party on our behalf) will use your Personal Data to create your account, facilitate the purchase process, manage your order and deliver your products under the contract you have with us (or the third party) and to understand your purchase history. We may use automated or technical solutions to detect fraudulent activity or payment and this may include profiling based on automated decision making;

• When you use a QR Code or equivalent feature displayed on our products: we use your Personal Data to send you more information on the products where the QR code or equivalent feature was displayed or other Pernod Ricard products (if you opt-in to receive that information);

• When you submit Personal Data on the iPads or other mobile devices available in Heritage Centres or distilleries: this is used to send you more information on the relevant products;

• Feedback, questions, or comments through our ‘Contact Us’ form and our ‘Tell Us’ compliance reporting system: if you contact us via an online contact form, your information is used to respond to your inquiry or comment;

When you submit your Personal Data, you may also be given the option (through a tick box or other consent mechanism) to have your information used for an activity or service different from the one you are requesting. For example, if you enter a contest to win a prize, you may also be invited to sign up for a newsletter about other products. If you choose to have your information used for another activity or service in this way we will use your information to provide them to you.

In addition, when you submit your Personal Data, you may be given the option (through a tick box or other consent mechanism) for your information to be used for other Pernod Ricard products. If you choose this option we (and other GHP Group d.o.o. affiliates) will use your information to provide you with information and promotions regarding other Pernod Ricard products.

We may also use your email address to send you transactional or administrative communications such as confirmation emails when you sign up for, or unsubscribe from, a specific registration or activity. We may also use it for certain service-related announcements, such as updates to our Privacy Notice, discontinued features or programs on our Digital Services, changes to our online services or technical support policies.

We retain your personal data in our global consumer database which allows us to ensure that your Personal Data remains accurate and up to date and to share your Personal Data with appropriate GHP Group d.o.o. affiliates. To avoid duplication in our database, we may use information about each of your interactions with one of our GHP Group d.o.o. affiliates to check whether your Personal Data is still accurate. We will use that information to complete, enhance or update your Personal Data with the additional information you might have provided.

Subject to applicable laws, this may include occasionally combining, updating, or otherwise enhancing the Personal Data collected through our Digital Services with anonymized data we get from outside records or third parties. For instance, we may combine purely demographic or survey information (e.g., age, gender, household information, and other interests) not linked to any personal information about you with Personal Data collected in other cases (such as during account registration).

We may also use your Personal Data, the combined information referred to above, and/or demographic information for our internal marketing, segmentation, analysis, and demographic studies. This helps us to constantly improve, personalize, and customize the products and services we provide.

Legitimate interests – managing our business

In relation to a number of uses of Personal Data we refer to above we are doing this on the basis that it is in our legitimate interests – or those of a third party – for us to do so. A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. These interests cover a number of aspects of our business operations, namely:

• Ensuring that we are as efficient as we can be so we can deliver the best Digital Service and products for you that we can and understanding our customers and the users of our Website;

• To allow us to provide bespoke Digital Services and products where requested by you, to personalize your experience and to tailor the content, offers, and promotions we send to you promoting our products and services;

• Protecting our commercially valuable information and also our intellectual property;

• Preventing and detecting fraud and/or criminal activity that could be damaging for us and for you;

• For credit control purposes and to make sure our customers can pay for the products we provide;

• Understanding how our business is performing and considering how to improve our performance; and

• Ensuring we are able to keep up to date with our customers and contacts and developments in their organizations.

Promotional communications

We may use your Personal Data to send you updates (by email, text message, telephone or post) about our products and Digital Services, including exclusive offers, promotions or new products and Digital Services.

We have a legitimate interest in processing your Personal Data for promotional purposes. This means we do not always need your consent to carry out promotional activities. However, where consent is needed, we will ask for this consent separately and clearly.

You have the right to opt-out of receiving promotional communications at any time by:

• contacting us at Info@jvrakia.com

We may ask you to confirm or update your marketing preferences if you instruct us to provide further products or Digital Services in the future, or if there are changes in the law, regulation, or the structure of our business.

What happens if you do not wish to share your personal data with us?

If you choose not to submit any Personal Data when requested, you may not be able to participate in certain activities or use some of the personalized features of our Digital Services. This may also limit the services and special offers we can provide you. For example, if you refuse to share your email address, you will not be able to receive any of our newsletters or otherwise register for our Digital Services. However, you do not need to give us any Personal Data to simply browse our websites and learn more about us and our products.

Who do we disclose your personal data to and why?

We will never share your Personal Data with any third party that intends to use it for direct marketing purposes unless we have specifically told you and you have given us explicit permission to do this.

We may share your Personal Data with affiliates within the GHP Group d.o.o.. The purposes are explained in Articles 2 and 3 above. The information we collect as described in this Privacy Policy may come from the entity to which you provide it but may also be made available, subject to your consent, through such entity to other affiliates of the GHP Group d.o.o. to provide you with news and promotional information about their products or programs you have shown interest in.

If you wish to withdraw your consent to such sharing and use of your information, please address your request as indicated in Article 9 of this Privacy Policy. Please tell us if you are withdrawing your consent for us to share your Personal Data with all of the affiliates in the GHP Group d.o.o. to provide you with news and promotional information or just some of those affiliates (and, in that case, please indicate which ones).

We may also share your Personal Data with other third parties, but only in the following circumstances:

• We may use third parties to help deliver our products or Digital Services to you, e.g. payment service providers, warehouses and delivery companies;

• We may share your Personal Data with social media providers such as Facebook, Twitter and Instagram, in which case email addresses will be uploaded then hashed. For example, where you are a registered user of Facebook, we will use your email address in an encrypted format to enable Facebook to find other registered users of their services that share similar interests to you based on: (1) information that we observe about you from your different interactions with us; and (2) the information Facebook holds about you;

• We may share your Personal Data with third parties who provide programmatic advertising services to serve you with relevant advertising;

• We may use service providers, agents or contractors e.g. marketing and digital agencies to support the internal operation of our Digital Services, and to assist us with administering them or the various functions, programs and promotions available on them. Any such third party must provide appropriate levels of security for your Personal Data and, where required, are bound by a legal agreement to keep your Personal Data private, secure and to process it only on our specific instructions;

• When we run a joint or co-sponsored program or promotion on our Digital Services with another company, organisation, or other reputable third party, we may collect and process Personal Data and share it with that partner or sponsor as part of the event. If your Personal Data is being collected by (or is shared with) a company other than one that is part of the GHP Group d.o.o. as part of any such promotion, we will let you know at the time it is collected;

When we run a promotion in partnership with a third party outside the GHP Group d.o.o., we may provide a separate link to their privacy policy which you should read before you share any Personal Data. The operators of other sites may collect information from you which will be used by them in accordance with their own data protection policy or privacy policy. If you do not want your information to be collected by or shared with a company other than the GHP Group d.o.o., you can choose not to opt in or participate in these events at the time the Personal Data is collected or requested;

• We may also disclose your Personal Data if we are required to do so by law or by law enforcement agencies or regulatory bodies, or if such action is necessary to comply with legal or regulatory processes, to respond to or pursue any claims, or to protect the safety or rights of us, our employees, customers, or the public;

• In the event of a merger or acquisition of all or part of us by another company, or in the event that we were to sell or dispose of all or a part of our business. In this case the acquirer would have access to the information maintained by us, which could include Personal Data, subject to applicable law. Similarly, Personal Data may be transferred as part of a corporate reorganisation, insolvency proceeding, or other similar event, if permitted by and done in accordance with applicable law;

• We may share aggregated demographic or survey information with third parties, but this information is in anonymous form and does not contain any Personal Data. The aggregate information that we share may include anonymous information that is captured through the use of cookies and other similar tracking technology, as explained in Article 2.

Is your personal data sent to recipients located in other countries and why?

We and our affiliates in the GHP Group d.o.o. are a global group and your Personal Data may be transferred across international borders. It may be transferred to countries that have different data protection laws to the country from where you submitted your Personal Data. Your Personal Data may also be transferred between different companies of the GHP Group d.o.o. located in different countries.

We will, however, ensure the transfer complies with data protection law both during transit and at the storage location, and all Personal Data will be secure. Our standard practice is to use standard data protection contract clauses that have been approved by the European Commission. You can check here for a list of countries where we have an affiliate within the GHP Group d.o.o. that may receive your Personal Data.

Our main service providers for the operation of our Digital Media are based in the United States. The transfers of personal data to these services providers are implemented in accordance with applicable laws and rely on standard contractual clauses as set out by the European Commission. Such service providers are also bound by a contract that ensures a high standard of privacy protection and requires (amongst other provisions) that they act only on a member of GHP Group d.o.o.’s instructions and implement technical measures necessary on an ongoing basis to keep your Personal Data secure.

How long do we keep your personal data?

We may store the Personal Data that you send to us via our Digital Services in our databases. We will not retain your Personal Data for longer than necessary for the purposes set out in this policy. Different retention periods apply for different types of Personal Data.

We retain your Personal Data as long as your account is active, for the duration of a contract with you or however long it takes to provide you with the products or services requested, to answer queries or resolve problems, to show that we treated you fairly, to keep records required by law and to improve or offer new services

We may also need to retain your Personal Data to comply with our legal and regulatory obligations, resolve disputes, enforce our agreements, and similar records management purposes.

We may also retain your Personal Data for a reasonable period after you stop using our services or our Digital Services. After this period, your Personal Data will be deleted from all systems in the GHP Group d.o.o..

If you ask us to delete your information in accordance with your rights set out in Article 9 below, we will retain basic information on a suppression list to record your request and to avoid sending you unwanted materials in the future.

How do we keep your personal data secure?

We have appropriate security measures to prevent your Personal Data from being accidentally lost, or used or accessed unlawfully. These include: (i) storing your Personal Data in secure operating environments that are not available to the public and that are only accessible to authorized employees, our agents, and contractors; and, (ii) verifying the identities of registered users before they can access Personal Data we store about them.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Therefore, you should exercise caution and review the privacy policies applicable to those external websites you visit, before you provide your Personal Data.

How can you contact us?

If you have any questions, complaints, or comments about this Privacy Policy or how we collect and manage your Personal Data, please contact us either:

By writing to GHP Group d.o.o. Volčji Potok 24A, Volčji Potok, 1235 Radomljeor sending an email to: Info@jvrakia.com

Changes to this privacy policy

This privacy notice was last updated: in March 2022. We may change this privacy policy from time to time, so please check back regularly to keep informed of updates to this Privacy Policy and our Cookies Policy.