Carlsberg Kazakhstan Ltd is aware that your personal data safety is very important and, therefore, it undertakes to respect your confidentiality and protect your personal data.

This Confidentiality Policy defines the way Carlsberg Kazakhstan Ltd (Carlsberg, we, our) uses your personal data and measures taken to protect your data and maintain their confidentiality. This Confidentiality Policy applies to you, if you buy goods, receive services, participate in our events or promotional campaigns or otherwise interact with us, including via any of our websites or through communication via social networks and also in connection with your submission of consent for the collection, processing and transfer of personal data. Take a couple of minutes to read in detail this Policy (as well as our cookies policy and terms of use and any other documents, if you use one of our websites). If you are our counterparty, more detailed information on your personal data usage by us may be provided in an agreement with you. Further messages providing information on your personal data usage by us and possibilities to agree or reject certain types of the website usage may be sent as well while we are collecting personal data from you.

This Confidentiality Policy explains the procedure for using personal data and encompasses the following categories:

What personal data we collect?

We are planning to collect and process some or all of your personal data listed below:

• Information about you: your name, residence address, e-mail, phone number, social network user name, sex, date of birth or photo, or information about the employer and your position
• Your transaction details and purchase history: information about purchases and other transactions you made, including with the help of our website or other sales channels, including the delivery address and a description of purchased products
• Information about:payment of the payment item used to purchase our products and services, for example, the credit/debit card number and its validity period
• Information we collect on your participation in our campaigns and contests or presence in our events:information stated in your questionnaires, registration records made by you or us, data of your guests in connection with any promotional campaigns and contests you participated in or won, or any other information associated with your participation in the events, including on any of your eating preferences and need for access-related assistance
• Data on settings of advertising mails: data on your settings of advertising mails and browsing settings and information we collect to find out what products and services may be of interest to you
• Information on how you use our chats, bulletin boards, pages of social networks, and other interactive forums, including any comments, photos, videos and other information you post in the Internet
• Survey information:your response to our market studies
• Our correspondence with you,including any feedback, complaints, and comments from you sent by phone, e-mail, or social networks, or any information about online correspondence in the form of an ordinary letter or personal correspondence or interaction between us. If you contact us by phone, we collect information on the phone number used and any information collected with the help of a call record.
• Credit information and information aimed at counteracting fraud: information relevant to your financial condition, credit worthiness, or any offenses or fraud making available to us by you or any third party
• Technical data, including the Internet Protocol (IP) address used to connect the computer to the Internet or your account data, browser type and version, time zone, type and version of the browser module to be connected, operating system and platform
• Information on your visits to our websites, including a full displacement route by indicating the URL address to our websites, browsing them and going from them to other sites (including the date and time), products you browsed or looked for, pages you browsed, the page loading time, page loading errors, duration of visits to certain pages, information on the interaction between pages (for example, rolling, number of passages, and computer mouse rollover), and also methods used to leave the page.

Personal data sources

We collect most personal data on you directly from you or your interactions with us, our websites or sites of social networks. We can also receive your personal data from other sources such as business partners, subcontractors in the technical maintenance area, payment services and delivery services, from advertising networks, data analysis providers, information search suppliers, credit history bureaus, databases for fighting fraud and other third-party databases, including sanction lists, as well as data on the market and research tools.

Sensitive personal data

Under the data protection laws, certain categories of personal data are considered to be particularly sensitive and, therefore, need additional protection. This category includes information about the health condition, racial or ethnic origin, political opinions, religious beliefs, membership in trade unions or sexual orientation, as well as genetic and biometric data. Information on criminal records and criminal offences is also deemed to fall under the EU Data Protection Law.

In certain cases, we will collect and process such sensitive personal data. For example, when we process requests for special medical aid or help with access or your particular eating preferences in connection with your attendance to an event, which may point out to your religious beliefs such as halal or kosher dishes or in case of special verifications of your person, as a result of which information about previous criminal records may be revealed. We process such sensitive personal data pursuant to the applicable data protection laws, in particular as described in the Section “What we do with your personal data”.

What we do with your personal data?

According to data protection laws, we have to establish your identity and inform you about the legal grounds or “basis” for our use of your personal data. For each case of usage mentioned below, we specify the purpose, for which we use and disclose information, and the grounds we rely on in using such data. Explanations of each ground can be found here.

Depending on how you interact with Carlsberg, we will use your personal data for the following purposes:

• Provide and manage products and services you requestedDischarge our obligations arising under any agreements entered into by you and us, including for the purpose of organizing deliveries, fulfilling or cancelling orders, supplying information, products or services to you that were requested by you, and also notifying of changes in our products and services.

Legal grounds: performance of obligations under agreements, lawful interests (so that we could discharge our obligations and provide products or services to you, notify you of changes in our products and services).

• Ensure efficient communication with you:Answer your questions, respond to your comments, complaints, or other messages, including any issues associated with our products.

Legal grounds: lawful interests (they permit us to maintain correspondence with you and provide products and services to you), lawful claim

• Control activities and keep records of our correspondence with you

Control our correspondence with you, including ensuring the quality of services, compliance with procedures and for training purposes

Legal grounds: lawful interests (to ensure the quality of our products and services)

• Provide marketing materials to you

Provide information to you by ordinary mail, e-mail, phone, SMS texts, or advertisements in the Internet or social network on the products and services we offer, if such products or services are similar to those you have already acquired or have been interested in or information about which you agreed to receive. We can also use our data for marketing products and services of the selected business partners. Where required by law, we send a request for your consent while collecting your data for the purposes of any of these marketing types. We make it possible to cancel subscription or give up any further communication in any electronic marketing means sent to you, or you can cancel at any time by contacting us through data provided below in the Section “Contacts”.

Legal grounds: consent, lawful interests (keeping you updated on our products and services)

• Understand our clients’ needs, develop and adapt our products and services

We can analyze personal data available to us to determine or understand the efficiency ratio of advertisements to be seen by you and other clients and offer advertisements relevant to your interests. We can provide generalized information to our advertisers, offer and recommend products or services to you, our clients and users of our website, which may be of interest to you.

Legal grounds: lawful interests (to ensure the quality of our products and services, which permits us to improve our products and services, present the content and services to you on our websites).

• Hold promotional campaigns and contests

If you participate in promotional campaigns and contests, hold such promotional campaigns and contests, including for informing you that you have won. If you win an award, pursuant to regional laws, we may disclose your personal data and personal data of your guests on our websites, pages of social networks, and in press releases. We can also make these data available to third parties, which may need such information for delivering an award.

Legal grounds: legal obligations, implementation of agreements, lawful interests (for successfully holding promotional campaigns and events).

• Hold our events

If you visit an event organized or otherwise supported by us, we may use your personal data, including specific eating preferences, information about your health condition and help with access to the event in connection with this event.

Legal grounds: lawful interests (they permit to hold our events, ensure and take into account your specific preferences and needs during our events), clear consent (if required).

• As part of antifraud efforts

We and other organizations may have access to certain information and use it to prevent fraud in cases stipulated by the applicable laws and rules, just as best practices at any moment. If false or inaccurate information has been supplied, any fraud has been revealed or suspected, data may be handed over to antifraud agencies and other organizations and they may be recorded by us or them.

Legal grounds: legal obligations, lawful interests (to add you to our acceptable risk portfolio and help prevent crimes and fraud), significant public interests.

• Carry out certain verifications of you such as KYC (client identification) and credit history verification

If you are a client or a potential client, we may use your personal data for carrying out certain verifications of you (or your company). For this purpose, we may disclose your data to the competent governmental authorities, including to governmental institutions, organizations, and agencies in charge of preventing fraud. The law enforcement agencies may receive and use this information. We and other organizations receiving access to and using data recorded by such agencies may receive them from countries other than the country you stay in.

Legal grounds: legal obligations, claim, significant public interests, lawful interests (assistance in fighting crime and fraud).

• Improve and run our websites and make the content relevant

Make sure that only adults that have reached the age of officially permitted alcohol consumption have access to and interact with our websites; improve our websites and ensure the most efficient content presentation on your computer; administer our websites and perform in-house operations, including eliminating defects, analyzing data (including a traffic data analysis), testing and researching, for the statistical and survey purposes; enable you to participate/register for obtaining the interactive functions of our services; as our efforts to ensure safety of our websites; make sure that the content of our websites is presented in the most efficient way for you and your device, which may include your data transfer to business partners, suppliers of services, as well as analysts and suppliers of search engines.

Legal grounds: lawful interests (it permits us to administer our websites and give you access to the content and services on our websites), legal obligations.

• Reorganizeor change our activities

In cases where we are: (i) an object of negotiations over the sale of our business or any part of it to a third party; (ii) an object of the sale to a third party; or (iii) an object of reorganization, we will have to transfer any or all of your personal data to the relevant third party (or its consultants) in the course of any due diligence of the company for the purposes of analyzing any offered sale or reorganization of the company. We will also have to hand your personal data over to the reorganized economic entity or third party after the company’s sale or reorganization to be used for the purposes mentioned in this confidentiality policy.

Legal grounds: lawful interests (to make it possible to change our company’s activities), legal obligation.

• Performance of regulatory obligations

We may process your personal data according to our regulatory requirements that may imply your personal data disclosure to third parties, particularly insurers, courts and/or regulatory or law enforcement agencies as a result of any information inquiries, court litigations or investigations conducted by such parties in any country of the world or where they have to do these proceedings.

Legal grounds: legal obligations, lawful claims, lawful interests (cooperate with the law enforcement and regulatory agencies).

If you have any questions as to the legal grounds we rely on, please contact us by using information provided in the Section “Contacts”.

Your personal data disclosure

Apart from the above third parties, you also give us a permission to disclose your personal data, including cross-border transfer, to any member of our group, i.e. our subsidiaries, our parent holding company and its subsidiaries, which may use such data for any of the purposes described above. We will also disclose your personal data to third-party suppliers of services (such as suppliers of marketing, IT, and administrative services), which may process them on our behalf for any of the purposes stated above.

We do not disclose to our advertisers information on persons available for identification, but we may provide to them general information about our users (for example, we may inform them that 500 men under 30 clicked on their advertisement on a specific day). We may also use such generalized data so that advertisers could reach their targeted audiences (for instance, women at a specific place). We may use personal data received from you to meet the needs of our advertisers by placing their advertisement for this target audience.

How do we use cookies?

Our websites use cookies to distinguish you from other users. They help you browse our websites in a pleasant way and make sure that their content is relevant for you. To find out more about how we use cookies, please go to our cookies policy.

Use of chats, bulletin boards, or other forums by you

We offer access to chats, messages, bulletin boards, or interactive zones where visitors can post their comments or information to be used by our visitors. If you participate in a chat, a bulletin board, or any other interactive site where personal data may be posted on our websites, in addition to this confidentiality policy you must read our chat rules before entering data as you must follow these rules. As you know, everything that you post in the Internet is available to the entire world. We make no declarations and assume no obligations with respect to information you post willingly.

How we protect your personal data?

Where is your personal data stored?

Data we collect from you may be transferred and stored outside Kazakhstan, if they are stored in the same volume in which they are stored in Carlsberg Kazakhstan Ltd  database. Data may also be processed by the staff working outside Kazakhstan in our company or for one of our suppliers. Such staff may be engaged, among other things, to fulfill your order, process your payment details, or provide services.

How long are your personal data stored?

Your personal data will be stored as long as permitted by law and will be stored only as long as necessary so as to provide to you any requested products, services, or information or for any other purposes stated in the Section “What we do with data” above.

For example, we may store certain information on transactions and correspondence until expiration of the period of limitation of actions for such transactions. We may also keep such data to comply with the legislative data storage requirements.

Your data disclosure outside the EEA

If we disclose personal data of a person residing within the European Economic Area, we may require specific additional measures to protect relevant personal data. Some countries outside the EEA were approved by the European Commission as countries considerably ensuring the equivalent protection of the provisions of the law on protection of personal data of the EEA citizens. Therefore, additional data protection measures are necessary for exporting personal data to these countries or territories, if they are stored in the same volume in which they are stored in Carlsberg Kazakhstan Ltd  database. When it comes to countries not approved by the European Commission, we will appropriately protect personal data against their transfer, for example, standard contractual provisions approved by the EC commission or obligatory corporate rules allowed by the relevant legislative requirements.

Please inform us by using data provided in the Section “Contacts” below, if you wish to read a copy of any specific data protection tools used for exporting your personal data.

What do we do to protect personal data?

We undertake to do our best to guarantee the reliable processing of your personal data according to this confidentiality policy and the Law of the Republic of Kazakhstan “About personal data and their protection”. If we provided to you a password (or at your own option), which gives access to the specific sections of our websites, you are responsible for keeping this password confidential. We ask you not to disclose this password to others.

Unfortunately, information transmission in the Internet is not completely safe. Although we will do our best to protect your personal data, we cannot guarantee the safety of such data transmitted to our websites. In this case, you assume all risks associated with such data transmission. Once we receive your data, we undertake to apply strict procedures and protection tools to prevent any unauthorized access.

What about links to other sites?

Our websites and fan pages in social networks can sometimes have links to the websites of our partner networks, affiliates, or other third parties. If you follow a link to any of these websites, please note that they have their own confidentiality rules and we assume no responsibility for such policies. Check these rules before sending any personal data to such websites.

Your rights and contact with us

Marketing

You may demand that we do not process your personal data for marketing purposes. Normally, we inform you or obtain your consent (before data collection), if we plan to use your data for such purposes or if we plan to disclose your data to any third parties for such purposes.  You can use your right not to allow such processing by checking certain fields in the forms we use to collect data or by clicking on “Cancel subscription” in the lower part of an e-mail we send you for marketing purposes. You can also use this right at any time by contacting us via [email protected].

Information update

We will do our best to ensure your personal data accuracy. To help us with this, you must notify us of any changes in your personal data you provided to us by contacting us using information in the Section “Contacts” below.

Your rights

If you stay within the EEA while interacting with us, under certain conditions you may demand that we:

• provide to you additional information about how we use and process your personal data;
• provide to you a copy of your personal data we store;
• eliminate any personal data inaccuracy and fill out any of your incomplete personal data we process;
• delete personal data we have no right to process any longer; and
• restrict the method we use to process your personal data while we are considering a request you sent.

Besides, under certain conditions you may:

• in cases where processing is based on your consent, cancel this consent;
• demand that we transfer personal data supplied by you and data we still keep at a third party in an electronic form;
• object to any personal data processing on the basis of “lawful interests” or “public interests”, if our grounds for the main processing exceed the scope of your interests, rights, and freedoms; and
• object to any direct marketing applied to you (including creation of your personal profile as a client for such purposes) at any time.

These rights are exercised by taking into account certain exceptional restrictions for protection of public interests (for example, crime prevention or detection) and our interests (for example, confidentiality maintenance), and not all such rights may be available in the country you stay in.

If you are not satisfied with the way we use your personal data or our response to any use of such rights, you may file a complaint with the EU Information Commissioner’s Office.

Contacts

We will be grateful for any questions, comments, and inquiries relevant to this confidentiality policy, which should be sent to [email protected].

This policy updates

Any amendments we may make to this confidentiality policy will be published on this page and, in relevant cases, we will keep you updated by e-mail. Please check again whether this confidentiality policy has been updated or amended.

This confidentiality policy was updated in January 2019.

Legal grounds for using personal data

Below are the main legal grounds recognizing our use of your personal data allowed:

These grounds are the main legal grounds we normally rely on to justify our use of the special categories of your personal data and criminal records: