Privacy Notice

Effective Date: January 1, 2023Last Updated: September 20, 2023

Introduction

This Privacy Notice sets out how Beam Suntory Inc. and its subsidiaries, parent and affiliated companies, and those acting on our behalf ("Beam Suntory"; "we"; "us"; "our") use your information while operating our business and sets out your legal rights in relation to the information we collect about you, including through our websites, applications, and the website at https://www.ardray.com/en-us/. We may use personal data provided to us either by you or other parties for any of the purposes described in this Privacy Notice or as otherwise stated at the point of collection.

We may modify this Privacy Notice from time to time. We will notify you of any material changes to this Privacy Notice as required by law. We will also post an updated copy on our website. You should check periodically for changes.

Legal drinking age and data of children

This website is not intended for individuals under the legal drinking age and we perform age checks upon visiting the website (without storing your date of birth). We do not knowingly collect, solicit personal information from anyone under the legal drinking age. If we later learn that an individual under the legal drinking age has provided us with personal information, we will delete that information as quickly as possible. Please do not share or forward this website or its contents to anyone underage. If you believe that a child under the legal drinking age may have provided us personal information, please contact us atprivacy@beamsuntory.com.

Links to other websites

This Privacy Notice does not apply to the privacy practices of third-party websites linked within this site. If you click on a third-party link, you will be taken to a website that we do not control. We encourage you to read the privacy statements on the other websites you visit. We are not responsible for the practices of these other parties.

What do we mean by personal data?

Personal data, sometimes referred to as “personal information,” is any information relating to an identified or identifiable natural person and includes all information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household. When “you” or “your” are used in this Privacy Notice, we are referring to the relevant individual who is the subject of the personal data.

The information we collect about you

We may collect a number of different categories of personal data from and about you:

• Identity Data including name,title, marital status, date of birth or age range, and gender.
• Contact Data including billing address, delivery address, email address and phone numbers.
• Financial Data including bank account and payment card details.
• Transaction Data including details about online and offline payments to and from you and records of products and services you have purchased / ordered from us, such as distillery tours, and information collected through digital wallets.
• Login Data including your user credentials and password for any consumer or support accounts.
• Device and Usage Data including information about how you use our website, products, digital assets, apps and services, such as cookie information, internet protocol (IP) address, unique personal identifiers (including that affiliated with your digital wallet address), browser type and version, time zone setting and geolocation, browser plug-in types and versions, mobile device IDs and MAID (Mobile Advertising IDs), operating system and platform and other technology used by the devices you use to access this website.
• Marketing and Communications Data including your preferences in receiving marketing materials, promotions and/or newsletters from us and your communication preferences, responses to customer satisfaction surveys or market research, feedback or complaints which you have communicated to us.
• Photographic and Video Data including CCTV footage from distillery tours, photos and video taken at our events, photos or videos you upload on our website or social media sites.
• Social Media Data including social media interactions, usage, handles, profile photo and other social media profile information (such as number of followers). 
• User Generated Content includingtext, pictures, audios, videos, testimonials, tweets, blog posts and reviews posted by you on online platforms such as social media and e-commerce sites.
• Business-to-Business (“B2B”) Data including information related to our business-to-business and vendor relationships, such as business contact information provided to us online or offline to consummate the relationship and carry out business functions. Examples include your name, title, company you work for, address, email address and phone number.

In addition, other specific types of information may be collected in connection with contests, sweepstakes, promotional offers or other marketing efforts. This could include your dietary and taste preferences. We may also collect aggregated or de-identified information that cannot reasonably be used to identify you.

When do we collect your personal data?

We will mainly collect personal data about you through interactions with you and your use of our website and all other websites within the Beam Suntory family and digital platforms. In addition, this Privacy Notice applies to our use of any information about you which we may collect from you via face-to-face communication, mail, phone, email, social media, event registration/attendance, or any other means of communication (including any form of electronic communication).

We may collect information you provide to us online or offline when we enter into a B2B relationship, in order to consummate the relationship and carry out business functions.

We also collect technical data derived from your browsing. If you want more information about this please check our Cookie Policy.

We may also collect information about you from other entities in our corporate group, our business partners and various other third-party service providers.

How do we use your personal data?

Your personal data may be used for the following purposes:

• To provide you with products and services.
• To market and promote our products and services.
• To deliver interest-based advertising.
• To improve and develop our business and products.
• To provide and administer our loyalty programs.
• To monitor and analyze trends, usage, and activities in connection with our products and services.
• Consumer support.
• Website administration.
• Enhanced user experience.
• To carry out B2B functions.
• To comply with law or regulation.
• To administer the Ardray NFT Collection and provide participants with digital assets.

How long do we keep your data?

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected, including as required by applicable law or regulation and tosatisfy any legal, accounting, or reporting requirements. When the data is no longer necessary for the purpose for which it was collected, we securely delete it or, in some cases, anonymize it.

With whom do we share your data?

We may share your personal information with subsidiaries of Beam Suntory Inc. and members of our corporate group whose parent company is Suntory Holdings Limited where we have a legal basis for doing so. You can visit our corporate site to find out more. We may also share your personal information with other parties with your consent or at your direction.

We may need to share your information with select other parties that provide services to us or act on our behalf in connection with the operation of our business. We require such other parties to respect the privacy and security of your personal information and to treat it in accordance with the law.  We do not permit these other parties to use your personal information for their own purposes and only permit them to process your information for specified purposes and in accordance with our instructions.

In particular, your information may be disclosed to the following categories of recipients:

• Professional advisers (e.g. IT, legal and financial advisers) and auditors.
• IT and system providers; website development and data storage providers; web and data analytic companies; Web3 developers; and digital wallet providers.
• Ecommerce platform and service providers operating and managingonline stores on our behalf; card and online payment processing service providers.
• Digital, mobile and social media marketing agencies; mail and email deployment agencies; tour booking agencies; customer fulfillment agencies; event and competition organizers and photographers.
• Identity resolution service & data onboarding service providers; online and social media retargeting and remarketing advertisers.
• Logistics, distribution and delivery service providers; manufacturing plants for personalized products.
• Fraud prevention and credit reference agencies; litigation and recovery specialists to recover any non-payment or debt owed to us.
• Building reception and security for distillery tours.
• Trade associates, business partners and other parties with whom we may enter into negotiations with in respect of a commercial agreement, e.g. joint business venture.
• Other parties to whom we may choose to sell, transfer, or merge parts of our business or our assets.
• Law enforcement agencies; financial regulators and other relevant regulatory authorities; government bodies; tax authorities; courts tribunals and complaints/dispute resolution bodies in circumstances where we are required to disclose personal information by law.

Your Privacy Rights

The law in some jurisdictions may provide you with additional rights regarding our use of personal information. To learn more about any additional rights that may be applicable to you as a resident of one of these jurisdictions, please see the following privacy addenda that are attached to this Privacy Notice below.

How to contact us

Please get in touch if you have any questions about how we use your information, or if you wish to contact us about your legal rights or if you have any complaints or feedback about our use of your information. Please contact us at any time by sending an email to us at privacy@beamsuntory.com.

Australia Privacy Addendum

Introduction

This Australian privacy law addendum (the “Australia Addendum”) supplements or modifies the information contained in Beam Suntory’s Privacy Notice (the "Privacy Notice").  This Australian Addendum applies to the collection, use, transfer and disclosure of personal information by Beam Suntory Australia Pty Ltd., Jim Beam Brands Co., Beam Suntory Inc. and their subsidiaries, parent and affiliated companies.

We adopt this Australia Addendum to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (collectively, the "Australian Privacy Laws").

Information Collected

We may collect sensitive information from you, for example your dietary preferences. We will only collect sensitive information from you if it is reasonably necessary in the circumstances and you have consented to that collection or we are otherwise entitled to do so under the Australian Privacy Laws.

Security Measures

We use reasonable security measures to safeguard your personal data by taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of consumers.  We also enter into agreements with service providers to store your personal data.  These service providers have their own security standards for personal data protection.  In light of the evolving risk environment, particularly the risks of security incidents on the Internet, we encourage you to be vigilant with your personal data and exercise caution.

Your Rights

You may contact us to request access to personal information we hold about you, including for the purposes of correcting that personal information by using the “Make a request” option.

Transfers of Information

As Beam Suntory is an international enterprise, there may be instances where it may be necessary for us to transfer your information outside Australia, e.g. to our headquarters in the United States and various subsidiaries (located in the European Economic Area, Singapore and other countries).  We may also transfer your information outside Australia if we use third party service providers from another country (e.g., United States or European Economic Area).

Where your personal information is disclosed to an overseas recipient, we will take reasonable steps in the circumstances to ensure that the overseas recipient does not breach the applicable Australian Privacy Laws in relation to your personal information.

Contact Information

Please get in touch if you have any questions or comments about how we collect, use or manage your personal information. You can contact us at privacy@beamsuntory.com.  

If you make an inquiry, we will endeavour to respond as soon as practicable and, in any event, within 30 days from the date we receive your question or comment.

Under the Australian Privacy Laws, you have the right to make a complaint to the Office of the Australian Information Commissioner (“OAIC”). Please note the OAIC requires any complaint to be made to us before you make a complaint to the OAIC.  Further details about how to lodge a complaint with the OAIC can be found at https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us.

Brazil Privacy Addendum

Introduction

This Brazil Privacy Addendum (the “Brazil Addendum”) supplements the information contained in Beam Suntory’s Privacy Notice (the “Privacy Notice”) and applies to you (“consumers” or “you”) solely in the following circumstances:

• If the personal data processing activity is carried out in Brazil;
• If the purpose of personal data processing activity is to offer or supply goods or services or to process data from individuals located in the Brazilian national territory; or
• If the personal data has been collected in Brazil.

We adopt this Brazil Addendum to comply with the General Law for the Personal Data Protection (Law No. 13.709/2018; “LGPD”) and, unless defined in this Brazil Addendum or the Privacy Notice, any terms defined in the LGPD have the same meaning when used in this Brazil Addendum.

Note that this Brazil Addendum does not apply to our employees or prospective employees. Please contact your local human resources department if you are an employee and would like additional information about how we process your personal information.

Information Collected

Regarding the section “The information we collect about you” of the Privacy Notice, we only collect personal data limited to the minimum of information necessary to achieve the purpose established by the company for that specific processing activity, case by case, complying with LGPD.

For additional information regarding technical data that we collect,derived from your browsing, please access our Cookie Policy.

Your Rights

Pursuant to the LGPD, you may have the following rights:

a) confirmation of the existence of the processing activity;

b) access to the personal data;

c) correction of incomplete, inaccurate or out-of-date data;

d) anonymization, blocking or deletion of unnecessary or excessive personal data or data processed in noncompliance with the provisions of the LGPD;

e) portability of the personal data to another service or product provider, by means of an express request and subject to commercial and industrial secrecy, pursuant to the regulation of the National Authority;

f) deletion of personal data processed with the consent of the data subject;

g) information about public and private entities with which the controller has shared personal data;

h) information about the possibility of denying consent and the consequences of such denial, as well as the possibility to withdraw the consent;

i) request for reconsideration of automated profiling decisions, in case it exists (in such case, the controller shall provide, whenever requested, clear and adequate information regarding the criteria and procedures used for the automated decision, respecting commercial and industrial secrets); and

j) right to facilitated access to information about the processing of data subject related to personal information, what must be made available in a clear, adequate and ostensible way about, among other characteristics provided for in future regulations by the National Authority:

• specific purpose of the personal data processing;
• form and duration of the personal data processing, respecting commercial and industrial secrets;
• identification of the controller;
• contact information of the controller; information about the shared use of data by the controller and its purpose; and
• responsibilities of the controller and the processor who will carry out the processing of personal data.

The exercise of your rights will be carried out in a manner that does not create a cost burden for you and according to the period and the manner to be set by the National Authority.

For the time being, data subjects in Brazil may exercise any of these rights, free of charge, by using the “Make a request” option or by contacting us at encarregado.beamsuntorybrasil@toisa.com.br.

As Beam Suntory is an international enterprise, there may be instances where it may be necessary for us to transfer your information outside Brazil – for example, to the European Union or United States, to our headquarters and various subsidiaries, or if we use third party service providers from another country. In these circumstances, we will put in place suitable safeguards, for example an intra-group data transfer agreement or standard contractual clauses to ensure that your information is processed securely and in accordance with this Privacy Notice and applicable regulations.

If you require further information about the safeguards we put in place, you can request such information by contacting us by email at encarregado.beamsuntorybrasil@toisa.com.br.

Contact Information

Beam Suntory Brasil Importação e Comércio de Bebidas Ltda.is the data controller in respect of the personal data which we hold about you. As data controller, we are responsible for the decisions regarding the processing of your personal data.

If you have any questions or comments about this Brazil Addendum, the ways in which Beam Suntory collects and uses your information described in this Brazil Addendum or in the Privacy Notice, your choices and rights regarding such use, or wish to exercise your rights under Brazilian law, please do not hesitate to contact our Brazil Data Protection Officer atencarregado.beamsuntorybrasil@toisa.com.br.

European Union / United Kingdom Privacy Addendum

Introduction

This European Union / United Kingdom Privacy Addendum (the “EU/UK Addendum”) supplements the information contained in Beam Suntory’s Privacy Notice (the “Privacy Notice”) and applies to you (“consumers” or “you”) solely in the following circumstances:

• you are in the European Union or the United Kingdom; or
• you access the website of a Beam Suntory Inc. subsidiary that operates in the European Union or the United Kingdom, regardless of where you are located in the world.

We adopt the EU/UK Addendum to comply with (1) General Data Protection Regulation (EU) 2016/679  (“GDPR”), (2) the UK General Data Protection Regulation (“UK GDPR”), and (3) the Data Protection Act 2018, and, unless defined in this EU/UK Addendum or the Privacy Notice, any terms defined in GDPR have the same meaning when used in this EU/UK Addendum.

Your Rights

Pursuant to the GDPR or equivalent local legislation, you may have the following rights:

• Subject access right – You can ask us to provide you with a copy of the personal data that we hold about you and a description of how we use your information.
• Right to rectification – If you believe any information we hold about you may be inaccurate or incomplete, you can ask us to rectify these inaccuracies.
• Right to erasure / right to be forgotten – You can ask us to erase your information in certain circumstances:

• the personal data is no longer necessary in relation to the purposes for which it was collected and processed;
• our legal grounds for processing is consent, you withdraw consent and we have no other lawful basis for the processing;
• our legal grounds for processing is that the processing is necessary for legitimate interests pursued by us or a third party, you object to our processing and we do not have overriding legitimate grounds;
• you object to our processing for direct marketing purposes;
• your personal data has been unlawfully processed; or
• your personal data must be erased to comply with a legal obligation to which we are subject.

However, please note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Right to data portability – Where we process your information using automated means of processing based on your consent or for the purposes of performing a contract with you, you can ask us to supply such information to another party in a machine-readable format.
• Right to restriction of processing – You can ask us to restrict or suspend our processing of your information in certain limited circumstances:

• for a period enabling us to verify the accuracy of your personal data where you have contested the accuracy of the personal data;
• your personal data has been unlawfully processed and you request restriction of processing instead of deletion;
• your personal data is no longer necessary in relation to the purposes for which it was collected and processed but the personal data is required by you to establish, exercise or defend legal claims; or
• for a period enabling us to verify whether the legitimate grounds relied on by us override your interests where you have objected to processing based on it being necessary for the pursuit of a legitimate interest identified by us.

• Right to object to processing – Where we process your information on the lawful basis of our legitimate interests, you have the right to object to us processing your information in certain circumstances:

• our legal grounds for processing is that the processing is necessary for a legitimate interest pursued by us or a third party; or
• our processing is for direct marketing purposes. If you object, your personal data will subsequently no longer be used for direct advertising purposes (objection pursuant to Art. 21 (2) EU GDPR and Art. 18 UK GDPR) but will be retained on a suppression list.
• Right to withdraw consent – If we process personal data based on your express consent, you have the right to withdraw this consent at any time. We do not generally process personal data based on express consent (as we can usually rely on another legal basis). However, please note that this will not affect the lawfulness of any processing of your information carried out before you withdraw your consent. The consents obtained are independent from each other; therefore, you can often revoke one, without affecting the others. Revoking your consent may mean that we are no longer able to provide you with the same services.
• Right to lodge a complaint with a supervisory authority - If you wish to submit a complaint or express any concerns about our use of your information, please contact us in the first instance. We will do our best to resolve your concerns to your satisfaction. However, if you feel that we have not addressed your concerns, please note that you have the right to make a complaint at any time to your local governmental or supervisory authority for data protection issues.

Data subjects in the European Union or the United Kingdom may exercise any of these rights, free of charge, by using the “Make a request” option. We will aim to respond to you within a month but this may be extended if the request is complex or we have received a number of requests from the same individual. If we have doubts about the identity of requester, we may ask for more information to confirm your identity before responding to the request.

As Beam Suntory is an international enterprise, there may be instances where it may be necessary for us to transfer your information outside the European Union or United Kingdom, e.g. to our headquarters and various subsidiaries, or if we use third party service providers from another country. In these circumstances, we will put in place suitable safeguards, for example an intra-group data transfer agreement or standard contractual clauses to ensure that your information is processed securely and in accordance with this Privacy Notice and applicable regulations. If you require further information about the safeguards we put in place, you can request such information by contacting us by email at privacy@beamsuntory.com.

Contact Information

Beam Suntory Inc. is the data controller in respect of the personal data which we hold about you. As data controller, we are responsible for determining the purposes for which we use the information we hold about you.

If you have any questions or comments about this EU/UK Addendum, the ways in which Beam Suntory collects and uses your information described in this EU/UK Addendum or in the Privacy Notice, your choices and rights regarding such use, or wish to exercise your rights under GDPR, please do not hesitate to contact us at privacy@beamsuntory.com.  The address of our EEA Data Protection Officer is Calle Mahonia, 2, 28043, Madrid, Spain.

If you are located in the EEA, we have appointed Beam Suntory Distribution S.L.U. to act as our European representative as required under Article 27 EU GDPR. You can always contact us directly if you wish to raise any issues or queries you may have relating to the processing of your personal data. However, if you wish to contact Beam Suntory Distribution S.L.U., you can do so by email atPrivacy@beamsuntory.com or by post at Beam Suntory Distribution S.L.U., Corporate Headquarters C/ Mahonia 2 - Edificio “Pórtico” 1st Floor, 28043 – Madrid (Campo de las Naciones).

If you are located in the UK, we have appointed Beam Suntory UK Ltd to act as our UK representative as required under Article 27 UK GDPR. You can always contact us directly if you wish to raise any issues or queries you may have relating to the processing of your personal data. However, if you wish to contact Beam Suntory UK Ltd, you can do so by email at Privacy@beamsuntory.com or by post at Beam Suntory UK Ltd, 2 Longwalk Road, Stockley Park, Uxbridge UB11 1BA.

India Privacy Addendum

Introduction

This India privacy addendum (the “India Addendum”) supplements the information contained in Beam Suntory’s Privacy Notice (the “Privacy Notice”).

Information Collected

We may collect personal data that has been voluntarily provided to us by you.

Your Rights

You have the right to withdraw your consent at any time, in writing, by using the “Make a request” option, in accordance with the terms of this Privacy Notice. However, please note that withdrawal of consent will not be retrospective in nature and shall be applicable prospectively. In case you do not provide your information or consent for usage of personal data or subsequently withdraw your consent for usage of the personal data so collected, we reserve the right to discontinue the services for which the said information was sought.

Data subjects in India may exercise any of these rights, free of charge, by using the “Make a request” option to access, review, amend or correct your personal data or withdraw your consent to provide personal data. However, we are not responsible for the authenticity of the personal data provided by you.

You agree and acknowledge that in respect of any data or information which cannot be corrected or amended pursuant to any applicable law, law enforcement requests or judicial proceedings or the like, the aforementioned rights will not be available.

Security Measures

We use reasonable security measures to safeguard your personal data by taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of consumers.  We also enter into agreements with service providers to store your personal data.  These service providers have their own security standards for personal data protection.  In light of the evolving risk environment, particularly the risks of security incidents on the Internet, we encourage you to be vigilant with your personal data and exercise caution.

Contact Information

Please get in touch if you have any questions or comments about how we collect, use or manage your personal information. You can contact us at privacy@beamsuntory.com.  

Mainland China Privacy Addendum

Introduction

This Mainland China Privacy Addendum (the “China Addendum”) supplements the information contained in Beam Suntory’s Privacy Notice (the “Privacy Notice”) and applies to you solely in the following circumstances (“consumers” or “you”):

• you are in the People’s Republic of China (for the purpose of this addendum, China refers to Mainland China, excluding Hong Kong SAR, Macau SAR and Taiwan); or
• you access the website of a Beam Suntory Inc. subsidiary that operates in the People’s Republic of China, regardless of where you are located in the world.

Your Rights

Pursuant to the PIPL or equivalent local legislation, you may have the following rights:

• Subject access right – You can ask us to provide you with a copy of the personal information that we hold about you and a description of how we use your information.
• Right to rectification – If you believe any information we hold about you may be inaccurate or incomplete, you can ask us to rectify these inaccuracies.
• Right to erasure / right to be forgotten – You can ask us to erase your information in certain circumstances:

• the purposes of processing have been achieved or cannot be achieved, or such information is no longer necessary for achieving the purposes of processing;
• we cease to provide products or services, or the storage period has expired;
• you withdraw your consent;
• your personal data has been unlawfully processed; or
• other circumstances as provided by laws and administrative regulations.

However, please note that if the storage period provided by any law or administrative regulation has not expired, or it is difficult to erase personal information technically, we will cease the processing of personal information other than storing and taking necessary security protection measures for such information.

• Right to data portability – Where our processing of your information meets the requirements of national cyberspace department for transferring personal information, you may request the transfer of personal information to a designated information processor.
• Right to withdraw consent – If we process personal data based on your express consent, you have the right to withdraw this consent at any time. We do not generally process personal data based on express consent (as we can usually rely on another legal basis). However, please note that this will not affect the lawfulness of any processing of your information carried out before you withdraw your consent. The consents obtained are independent from each other; therefore, you can often revoke one, without affecting the others. Revoking your consent may mean that we are no longer able to provide you with the same services.

Data subjects in China may exercise any of these rights, free of charge, by using the “Make a request” option. We will aim to respond to you in a timely manner, but may take longer if the request is complex or we have received a number of requests from the same individual. If we have doubts about the identity of the requester, we may ask for more information to confirm your identity before responding to the request.

Contact Information

Beam Suntory Inc. is the information processor in respect of the personal information which we hold about you. As information processor, we are responsible for determining the purposes for which we use the information we hold about you.  If you are located in China, we have appointed Beam Suntory Spirits Trading (Shanghai) Co., Ltd. to act as our China representative as required under Article 53 of PRC Personal Information Protection Law (“PIPL”).

If you have any questions or comments about this China Addendum, the ways in which Beam Suntory collects and uses your information described in this China Addendum or in the Privacy Notice, your choices and rights regarding such use, or wish to exercise your rights under PIPL, please do not hesitate to contact our Mainland China Data Protection Officer at privacy@beamsuntory.com.

New Zealand Privacy Addendum

Introduction

This New Zealand privacy law addendum (the “New Zealand Addendum”) supplements or modifies the information contained in Beam Suntory’s Privacy Notice (the “Privacy Notice”).  This New Zealand Addendum applies to the collection, use, storage, transfer and disclosure of personal data by Beam Suntory NZ Limited and its parent and affiliated companies.

This New Zealand Addendum applies in addition to, and does not limit, our rights and obligations under the Privacy Act 2020 (as amended or replaced from time to time) (“NZ Privacy Act”) or any specific authorization that you provide to us when you interact with us or use or services.

Information Collected

You are not required to provide us with any personal information that we request.  However, if you do not do so, we may not be able to provide certain services to you.

Your Rights

Under the NZ Privacy Act, you have the right to access and request correction of any personal data we hold about you by using the “Make a request” option.  We rely on you to update us if your contact details change.  

Contact Information

Please get in touch if you have any questions or comments about how we collect, use or manage your personal information. You can contact us at privacy@beamsuntory.com.  

Singapore Privacy Addendum

Introduction

This Singapore Privacy Addendum (“Singapore Addendum”) supplements, details or modifies the information contained in Beam Suntory’s Privacy Notice and applies to all visitors and users of our website originating from Singapore (“you”). We adopt the Singapore Addendum to comply with the Personal Data Protection Act 2012 (“PDPA”).

This Singapore Addendum is designed to assist you in understanding how we may collect, use, disclose or otherwise process personal data you provide to us in accordance with the PDPA and in making informed decisions when you are using our website.  

As used in this Singapore Addendum:

• “personal data” means data, whether true or not, about a customer who can be identified (a) from that data; or (b) from that data and other information to which we have or are likely to have access; and
• “customer” means an individual who (a) has contacted us through any means to find out more about any goods or services we provide, or (b) may, or has, entered into a contract with us for the supply of any goods or services by us.

Other terms used in this Singapore Addendum shall have the meanings given to them in the PDPA (where the context so permits).

This Singapore Addendum applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of your personal data by us.

We may revise this Singapore Addendum from time to time without any prior notice. You may determine if any such revision has taken place by referring to the date on which this Singapore Addendum was last updated. Your continued use of our services constitutes your acknowledgement and acceptance of such changes.

Information Collected

We generally rely on personal data provided by you (or your authorized representative). In order to ensure that your personal data is current, complete and accurate, please update us if there are changes to your personal data.

Your Rights

The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time it is being withdrawn by you in writing. You may withdraw consent and request us to stop collecting, using and/or disclosing your personal data for any or all of the purposes listed above by using the “Make a request” option.

• Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. In general, we shall seek to process your request within ten (10) business days of receiving it.
• Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in a position to continue providing our goods or services to you and we shall, in such circumstances, notify you before completing the processing of your request. Should you decide to cancel your withdrawal of consent, please inform us in writing.
• Please note that withdrawing consent does not affect our right to continue to collect, use and disclose personal data where such collection, use and disclose without consent is permitted or required under applicable laws.

If you wish to make (a) an access request for access to a copy of the personal data which we hold about you or information about the ways in which we use or disclose your personal data, or (b) a correction request to correct or update any of your personal data which we hold about you, you may submit your request by using the “Make a request” option.

• Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.
• We will respond to your request as soon as reasonably possible. In general, our response will be within thirty (30) business days. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the PDPA).

Retention

We may retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws.

We will cease to retain your personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for legal or business purposes.

Transfers of Information

As Beam Suntory is an international enterprise, there may be instances where it may be necessary for us to transfer your personal data outside of Singapore. If we do so, we will obtain your consent for the transfer to be made and we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPA.

Do Not Call Register

Unless you have provided your consent, we will not for marketing purposes, call or send any text message, to a Singapore telephone number unless we have obtained valid confirmation that the Singapore telephone number is not listed in the register maintained by the Personal Data Protection Commission (“Do Not Call Register”).

For this purpose, we will have valid confirmation that a Singapore telephone number is not listed in the Do Not Call Register if we made an application to Personal Data Protection Commission of Singapore (“Commission”) to confirm whether the Singapore telephone number is listed in the Do Not Call Register; or received confirmation from the Commission that the Singapore telephone number is not listed in the Do Not Call Register.

When calling or sending a text message to a Singapore telephone number, we will provide information on the individual or organization who authorized the call or text message and will not conceal or withhold the calling line identity of the caller or sender, as the case may be.

If you have not provided your consent or have listed your Singapore telephone number with the Do Not Call Register but have received a call or message from us, please do not hesitate to inform in writing or via email to our Data Protection Officer at the contact details provided below.

Contact Information

If you have any questions or inquiries on this Singapore Addendum, our personal data protection policies and procedures please do not hesitate to contact our Singapore Data Protection Officer atprivacy@beamsuntory.com.

South Africa Privacy Addendum

Introduction

This South Africa Addendum (the “South Africa Addendum”) supplements the information contained in Beam Suntory’s Privacy Notice (the “Privacy Notice”) and applies to the personal information that is collected, shared and used by any subsidiary or corporate affiliate of Beam Suntory that is incorporated in South Africa or that processes personal information in South Africa.  We adopt this South Africa Addendum to comply with the Protection of Personal Information Act 4 of 2013 (POPIA), which is South Africa’s primary data protection legislation.

Your Rights

Pursuant to POPIA, data subjects have the following rights:

• Right to be notified that personal information about him / her is being collected, and that his / her personal information has been unlawfully accessed.
• Right to access to confirm whether a data controller holds personal information about him / her, and to request a data controller to correct, destroy or delete personal information about him / her.
• Right to object on reasonable grounds, to the processing of his / her personal information, and to object, at any time, to the processing his / her personal information for purposes of direct marketing.
• Right to reject unsolicited electronic communications for purposes of direct marketing, and not to be subject to a decision based solely on the automated processing of his / her personal information and that is intended to provide a certain profile about him / her (e.g. credit worthiness, location, health, personal preferences or conduct).
• Right to submit a complaint to the Information Regulator in the event of any alleged interference with his or her personal information.
• Right to institute civil proceedings for damages in the event of any alleged interference with his or her personal information.

Data subjects in South Africa may exercise any of these rights, free of charge, by using the “Make a request” option.

Contact Information

If you have any questions or comments about this South Africa Addendum, the ways in which Beam Suntory collects and uses your information described in this South Africa Addendum or in the Privacy Notice, your choices and rights regarding such use, or wish to exercise your rights under POPIA, please do not hesitate to contact the South African Information Officer at privacy@beamsuntory.com.  

United States Privacy Addendum

This United States Privacy Addendum (the “US Addendum”) supplements the information contained in Beam Suntory’s Privacy Notice (the “Privacy Notice”) and applies solely to all visitors, users, and others who have rights under comprehensive state privacy legislation (“consumers” or “you”). Unless otherwise defined in the Privacy Notice, any terms defined in this US Addendum have the meaning used in applicable comprehensive state privacy legislation. Note that this US Addendum does not apply to our employees or prospective employees. Please contact your local human resources department if you are an employee and would like additional information about how we process your personal information.

Sensitive Personal Information

Under United States privacy laws, certain types of personal information are considered “sensitive” personal information or data and require additional data privacy rights and obligations. Beam Suntory collects Financial Data and Login Data, as described in the “The information we collect about you^[a]” section in the Privacy Notice, which may be considered sensitive personal information under California’s privacy law, the California Privacy Rights Act (“CPRA”). We only collect this sensitive personal information to provide the goods or services you requested, detect security incidents, and resist malicious, deceptive, fraudulent or illegal activities (“Permitted Uses”). Because Beam Suntory uses this sensitive personal information for Permitted Uses, we do not need to provide a Limit Use and Disclosure of Sensitive Personal Information right under the CPRA.

Beam Suntory also does not collect any information that would be considered sensitive personal data under other states’ privacy laws, which would require obtaining your opt-in consent.

Selling or Sharing of Personal Information

We do not sell your personal information to third parties for monetary consideration.  However, we may share your personal information with third parties for advertising purposes.See our Cookie Policy for more details. Beam Suntory does not have actual knowledge of any collection, use sale, or sharing of personal information of consumers under 16 years of age.

Summary of Personal Information Handling Practices

Beam Suntory provides in the chart below a summary of our prior 12 month personal information handling practices, which is consistent with our current information handling practices

Third Parties that Control the Collection of Personal Information We allow our cookie and adtech partners to control the collection of personal information on our website and during the course of providing our services. Please see our Cookie Policy for the names of these third-party businesses and a hyperlink to their privacy policies.

Retention of Personal Information

We store personal information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations. For more details about our personal information retention policy, please contact us at privacy@beamsuntory.com or at +1 855 380 9577. 

Your Rights and Choices

Applicable privacy laws privacy laws afford consumers residing in the United States certain rights with respect to their personal information, subject to certain exceptions. Subject to certain limitations, you have the following rights in the United States:

• (1) Right to Delete. You have the right to request us to delete the personal information we have collected about you.
• (2) Right to Correct. You have the right to request us to correct inaccurate personal information we maintain about you.
• (3) Confirm Processing. You have the right to confirm whether we are processing your personal information.
• (4) Right to Know and Access. You have the right to know and access the personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.
• (5) Data Portability. You have the right to receive the information under right (4) in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the personal information to a person without impediment, where the processing is carried out by automated means.
• (6) Right to Opt-Out. You have the right to opt out of certain processing, such as opting out of profiling or our sale or sharing of your personal information.
• (7) Right to No Discrimination. You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; and (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
• (8) Right to Appeal. If we decline to take action in response to your exercise of a privacy right, we will inform you within 45 days of receipt of your request the justification for declining to take action and provide you instructions on how to appeal the decision.

Exercising Your Rights

To exercise your rights described above, please submit a verifiable consumer request to us by either:

• Calling us at +1 855 380 9577.
• Visiting  “Make a request”.

Except for the right to opt-out related to selling or sharing your personal information for and right to limit use of sensitive personal information, we will need to verify your identity before honoring your privacy right request.  We will honor your privacy rights request within 45 calendar days of receipt of your request, unless we request an extension as permitted by data privacy laws.  However, we will honor opt-out of sale and sharing and limit use of sensitive personal information requests within 15 business days.

Appealing a Denial of a Rights Request

You may appeal a denial of your privacy right requests by either:

• Calling us at +1 855 380 9577.
• Visiting  “Make a request”.

Within 45 days of receipt of an appeal, we will inform you in writing of any action taken in response to the appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may submit a complaint to the Attorney General of your state.

Authorized Agents

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, please contact us at privacy@beamsuntory.com or at +1 855 380 9577. 

Additional Disclosure for California Residents

California law permits residents of California to request certain details about how their information is shared with third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please contact us at privacy@beamsuntory.com or at +1 855 380 9577.

Contact Information

If you have any questions or comments about this US Addendum, the ways in which Beam Suntory collects and uses your information described in this US Addendum or in the Privacy Notice, your choices and rights regarding such use, or wish to exercise your rights under applicable law, please do not hesitate to contact us at privacy@beamsuntory.com or at+1 855 380 9577.