Privacy Notice for Blade Brandportal
Version September 2018

1. General

This Privacy Notice applies to our internal IT/Commerce tool from Brandware named Blade Brandportal on bladebrandportal.heineken.com (the "Tool") dedicated to HEINEKEN N.V. and its group companies (‘HEINEKEN’, ‘we’ or ‘us’) for all HEINEKEN Employees and located at Tweede Weteringplantsoen 21, 1017 ZD Amsterdam, the Netherlands, where we collect certain personal data. ‘Employees’ are all employees, job applicants or former employees of us, including temporary workers working under the direct supervision of us (e.g. independent contractors, contingent workers, business partners or trainees).

Please read this Privacy Notice carefully as it contains important information to help you understand our practices regarding any personal data that you give to us or that we collect otherwise in the context of the Tool (‘Personal Data’). HEINEKEN International NV is the controller of the Personal Data collected and processed.

2. For which purposes do we use your personal data
In the course of your interaction with our Tool, we collect some Personal Data of you. The purposes for which we use this information are listed below.

• Authentication/authorisation:
  In order to authenticate/authorise your use of our Tool, we will process your: name, email address, password, derived business information and phone number. 

• Creating an account (Account Profile):
  In order to use the Tool we will create an Account Profile of you. You may add more information to this Account Profile. This Account Profile may include your: name, email address, password, derived business information and phone number. 

• Version management of content:
  In order to log the content changes made in our Tool, we may process your Account Profile. 

• Security:
  In order to ensure adequate security and/or prevent malicious use of our Tool, we will record and review who has logged in to the Tool at what time stamp. 

• Reporting:
  In order to optimize our licenses and minimize license fees of the Tool, we will monitor the usage of our Tool. 

Our use of your Personal Data for these purposes in our legitimate interests. The information will be retained as long as we have a purpose for holding on to your Personal Data.

1. Who has access to your personal data
   Members of HEINEKEN staff shall only have access to your personal data where they have a need to know to perform their job and where this is to perform any of the purposes described in this Privacy Notice. These staff members include Service Desk support and/or technical maintenance teams.
   
   As the Tool is ‘open access’ by set-up (knowledge management set-up), all HEINEKEN employees who also have access to the Tool will be able to see your contributions to the Tool.
   
   We may also need to share personal data with third parties in the context of performing any of the purposes for using personal data set out in this Privacy Notice:

• HEINEKEN group companies; 

• third party service providers such as: Macaw and/or Triple; 

• professional advisors (such as accountants, auditors, or lawyers); 

• in case we sell all or some of the assets or shares of a HEINEKEN group company to which Personal Data was transferred to a third party, your personal data may be provided to this third party; 

• law enforcement bodies (regulatory authorities, public bodies and judicial bodies) in order to comply with any legal obligation or court order.

These parties may be located in the Netherlands, Ireland, Germany or other countries in the European Economic Area or elsewhere in the world. When personal data is stored by us outside the EEA we will ensure an adequate level of protection of the transferred data. We require service providers and professional advisors to use appropriate measures to protect the confidentiality and security of the personal data. Where such international data transfer takes place from an EEA country to a recipient in a country that has a different data protection regime, we will ensure that this international data transfer will not negatively affect the level of protection of your personal data and is based on appropriate safeguards including EU Model Clauses or Binding Corporate Rules

1. Security
   We will take appropriate technical and organisational security measures to protect the personal data from misuse, or accidental, unlawful or unauthorized destruction, loss or alteration taking into account the risks involved. These will in any event be in line with market standards.

2. How long do we retain your personal data
   We will retain your personal data for as long as legally required or for as long as necessary for any of the purposes listed in this Privacy Notice, or to comply with legal requirements that we are subject to, as long as reasonably necessary for archiving purposes or as long as advisable in light of an applicable statute of limitations. We will take reasonable steps to destroy or de-identify personal data we hold if it is no longer needed for the purposes set out above or after the expiration of the defined retention term.
   As the Tool’s set up is to ensure internal knowledge management throughout HEINEKEN, typically Account Data will only then be removed when the Tool’s license will be revoked.

3. Access and correction requests, questions and complaints
   Please keep your personal data up to date and inform us of any significant changes. You must also inform your dependents about the content of this Notice and obtain their consent (provided they are legally competent to give consent) for the use (including transfer and disclosure) of their personal data by us.
   
   You have the right to request an overview of your personal data processed by or on behalf of us. You have the right to have your data rectified, deleted or restricted (as appropriate), all subject to applicable data protection laws and other relevant laws and regulations and HEINEKEN guidelines. You have the right to receive an overview of the personal data that you have provided to us in a structured, commonly used and machine-readable format.
   
   You also have a right, in certain circumstances, to require us to stop processing your personal data, but this does not apply where we have compelling legitimate grounds, in which case we will continue processing your personal data. Where you have provided consent to our use of your personal data, you have the right to withdraw your consent without this effecting the lawfulness of our use of this data before your withdrawal.

4. Contact
   If you wish to exercise your rights or if you have a complaint about how your personal data is processed by us or about our privacy and data protection practices in general, you can contact us at webcentre@heineken.com You also have the right to file a complaint with the data protection authority.