1. Who we are
Kompania Piwowarska S.A. (“KP”, “we”, “us” and equivalent phrases) is a Polish joint stock company with its registered office at 53 Emilia Plater Street, 00-113 Warsaw, Poland, a subsidiary of Asahi Breweries Europe Ltd. We collect and process several categories of personal data from you as a user of the www.kp.pl website (hereinafter referred to as the “website”), in view of which, in accordance with European Union data protection law, we are the data controller with respect to such data.
Your privacy is important to us, and this Privacy Notice describes our policies and practices regarding the collection and use of your personal information – what data we collect, why we collect it and what we do with it, and outlines your privacy rights.
Please read carefully the contents of this notice, which describes our handling of your personal information.
2. how we collect your personal information
Personal data may be collected or accessed in a number of ways, including:
- directly from you (from the data you entered into the form on the Website);
- from our observations of your navigation on our website (cookies, IP address, site navigation, etc.);
2.1 Information received directly from you
We are required by law to ensure that visitors to our Website are over the age of 18, so your first interaction with the Website is to enter your date of birth. This information is stored via a cookie that is maintained for the duration of your session, unless you choose for the Website to remember it for a longer period of time.
Our website uses forms to register for the promotional campaigns we sometimes organize. They contain fields such as your name, email address, and cell phone number. We use them to confirm your participation in the campaign in accordance with the campaign regulations, which can be consulted on the Website, and, if you become a winner, to contact you and send you the prize or to settle it. In the latter case, we may ask you for additional information, such as your home address (for the purpose of delivering the prize). The legal basis for such processing is consent and the conclusion and performance of a contract to which you are a party, as well as a legitimate purpose. We may also need to ask for additional tax information, in case we are legally required to file a tax return in connection with your prize. We keep data on non-winners for the period necessary to resolve any complaints and claims, but no longer than 10 years, and data on winners for 6 years.
We do not use your data to send marketing communications unless you consent to such communications. Even in such cases, we ensure the availability of an easy-to-use option to unsubscribe (withdraw consent) at any time, either in the communication itself or by contacting us as indicated in Section 8.
Our Website also allows you to send us a message using the contact form. Data entered into the contact form is processed in accordance with our legitimate interest to respond to your inquiry and/or to maintain records of your complaint, request and the like. Such data is retained for a maximum period of 10 years.
What happens if you don’t give us your data
If you do not provide us with your date of birth when you first visit our Website, you will not be able to access any content on the Website. This is a legal requirement.
Besides, you can visit the Website without entering any personal information. However, if you wish to participate in a promotional campaign through the Website, you will not be able to do so without providing all the required information. We have set the required fields to ask for the minimum amount of information needed so that we can identify you and be able to contact you if necessary, and we do not condition your participation in the campaign on your consent to receive marketing information. It is additional and optional. If you become a winner and we ask you for additional information in order to deliver your prize or file a tax return for your prize, failure to provide such information will result in your disqualification, as we will not be able to deliver your prize or file your tax return, as the case may be.
2.2 Using the website
The website collects certain information automatically and stores it in log files. The information may include Internet Protocol (IP) addresses, the region or general location where your computer or device accesses the Internet, your browser type, operating system and other information about your use of the site, including your browsing history. We use this information in designing our site to better meet the needs of our users. We may also use your IP address to diagnose problems with our server and manage our website, analyze trends, track visitor movements and collect a variety of demographic information that helps us determine visitor preferences. Our website also uses cookies and web beacons, which you can read about below.
2.2.1 Cookies, beacons and other technologies
We use cookies and similar technologies on our Website. Cookies are small text files placed on your computer or mobile device when you access websites. Proprietary cookies (first party cookies) are placed by the domains you visit at any given time. External cookies (third party cookies) are placed by domains other than the domains of the sites you visit.
Web beacons are transparent electronic images that are used to collect information about site usage, send email responses and tracking.
Like cookies, local storage technology allows websites to store information on a computer or mobile device. Local storage is usually permanent, and unlike cookies, data in local storage is not automatically transferred across the Internet each time the website that stored the data visits.
A mobile ad display ID is a unique identifier (ID) placed by the operating system of a mobile device. This ID is made available to applications installed on the device that may contain ads. Most devices allow apps to access the mobile ad ID by default. However, you can change your device settings to prevent your device from sharing this ID with apps. Take a look at the “Help” section of your operating system for more information on how to handle mobile ad display IDs. On Android, ad means Android Display Ad ID, and on iOS devices it means Display Ad ID (IDFA).
We refer to cookies, beacons, local storage and mobile ad display ID collectively as “cookies and similar technologies.” Most cookies fall into one or more of the following categories:
(a) Absolutely Necessary: These types of cookies are necessary to provide the specific services requested by website visitors. Without them, the websites cannot function or provide the requested services. We provide a detailed overview of our Website’s absolutely necessary cookies below:
- Host (cookie category)
Kp.pl - Name (cookie ID)
age-remembered - Domain placing cookie
Kp.pl - Purpose of cookie
This cookie is associated with the user age verification gateway - Storage time
30 days
(b) Performance measurement: these cookies collect information about how users use the Website, such as which pages are most popular, which method of linking pages is most effective, and whether users encounter website error messages. These cookies enable us to provide a quality user experience and to measure the audience of the Website. The information collected by these cookies does not identify users. Their purpose is to improve the performance of our Website.
The website uses Google Analytics, a website audience analysis service offered by Google, Inc. (“Google”). Google Analytics uses cookies to analyze how users use the Website. The information generated by the cookies about your use of the Website (including your IP address) will be transmitted to Google and stored on servers in the United States. Google will use this information for the purpose of evaluating your use of the Website, compiling reports on website activity for website operators and providing other services related to website activity and Internet usage. Google may also transfer this information to third parties where required to do so by law or where such third parties process the information on Google’s behalf. Google does not associate your IP address with any other data it stores. You can opt out of cookies by selecting the appropriate settings in your browser, but note that you may then not be able to use the full functionality of this website.
We provide a detailed overview of our Website’s analytical cookies below:
- Host (cookie category)
Google.com - Name (cookie ID)
_ga - Domain placing cookie
Google.com - Purpose of cookie
This cookie is associated with Google Universal Analytics which is a significant upgrade to Google’s most widely used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a customer ID. It is included in every page request on the site and is used to calculate user, session and campaign data in site analytics reports. - Storage time
2 years (from last update)
(c) Optimization: These cookies remember your choices to make it easier for you to use the websites.
We provide a detailed overview of our Website’s optimization cookies below:
- Host (cookie category)
Kp.pl - Name (cookie ID)
Protocol - Domain placing cookie
Kp.pl - Purpose of cookie
This cookie is to allow you to process changes between secure (https) and non-secure (http) domains (protocols). - Storage time
Session
(d) Targeted advertising cookies: These cookies collect information about your browsing patterns to tailor advertising to you and your needs. They are also used to limit the number of times an ad is displayed, and to measure the effectiveness of advertising campaigns. They may also be placed by third-party social media sites to allow you to interact with them (e.g., sharing Facebook Like and Share buttons); they collect data about users’ interests and are used by third-party social media to display ads to their users when they log in to their services.
We provide a detailed overview of our Website’s advertising cookies below:
- Host (cookie category)
Facebook.com - Name (cookie ID)
datr - Domain placing cookie
Facebook.com - Purpose of cookie
This cookie is saved when a web browser accesses facebook.com. The file enables it to recognize suspicious login attempts and thus provide greater security to users. For example, it is used to signal failed login attempts or the creation of multiple accounts used to send spam. - Storage time
2 years (from last update)
- Host (cookie category)
Youtube.com - Name (cookie ID)
APISID - Domain placing cookie
Youtube.com - Purpose of the
cookie These are popular YouTube cookies used in several of their services. It stores user preferences and can be used to personalize ads in Google searches - Storage time
2 years (from last update)
Other technologies: There may be QR codes on our promotional materials, packaging and stationary locations. These are used to quickly access our websites, contest forms or informational materials.
These codes are generated and handled using an external Hovercode system(https://hovercode.com). When a QR code is scanned, the Hovercode system may collect limited technical information, such as device type, operating system, approximate location (at the city/region level), and the date and time of the scan. This data is used by KP for analytical purposes only, to measure the effectiveness of our campaigns and to better tailor content to users’ needs. The data collected by Hovercode does not directly identify a specific individual, unless the user voluntarily provides his or her data in the form to which the QR code leads
2.2.2 Your cookie choices
You can adjust your browser’s privacy settings to block all cookies; however, this may severely affect your Internet browsing experience, as some sites will not function properly. Your browser may allow you to delete all cookies when you close your browser. However, this option deletes persistent cookies that store your preferences and personalized settings on websites you visit regularly. It is possible to keep the cookies you want because your browser allows you to specify which websites can always use cookies and which can never use them.
For more information on how to delete cookies and manage cookies in different web browsers, please follow the links below:
Internet Explorer cookie settings
Firefox browser cookie settings
Chrome browser cookie settings
Safari and iOS browser cookie settings
To opt out of tracking by Google Analytics, visit http://tools.google.com/dlpage/gaoptout.
The IAB maintains the following website with information on privacy issues in connection with online advertising: http://www.youronlinechoices.com/ro/
Detailed information on how organizations use cookies is available at: www.allaboutcookies.org
3. how we share information
We will disclose your personal data only for such purposes and to such third parties as indicated below. We will take appropriate steps to ensure that your personal information is processed, secured and transferred in accordance with applicable law.
3.1 Disclosure to Asahi group companies
We may share your personal data with companies that are part of our group, including our parent company based in Japan, if we determine that it is in our legitimate interest to do so for internal administration purposes (e.g., data storage, CRM) and for audits and monitoring of our internal processes.
We may also transfer your personal data to those companies in our group that provide us with certain products and services, such as information systems.
Access to your personal data is limited to those employees who have a need to know the personal data, which may include your potential supervisors and their designees, as well as marketing, IT and security personnel. These individuals will keep the data confidential.
3.2 Disclosure of data to third parties
We will transfer the absolutely necessary part of your personal data, on a need-to-know basis, to the following categories of third parties:
(a) companies that provide us with certain products and services (data processors), such as:
(i) media agencies, including those that organize promotional campaigns and manage the Website;
(ii) Internet services: analytics, advertising (see section 2.2.1 above);
(iii) PR agencies (other entities that handle email newsletters, SMS marketing or other forms of marketing, conduct customer support or sales activities on our behalf);
(iv) providers of information systems and support services, including email archiving, telecommunications providers, backup and disaster recovery services, and cyber security services.
(b) companies involved in operating our website, as indicated in Section 2.2.1 above, when they are not providing a service to us.
(c) other parties, such as public authorities and institutions, accountants, auditors, lawyers and other external professional advisors, where their activities require such knowledge or where we are legally obligated to make such disclosure.
We will also disclose your personal information to third parties:
(a) Upon your request or order;
(b) persons with authority to act on your behalf;
(c) when it is in our legitimate interest for the purpose of conducting and developing our business:
(i) in the event that we dispose of a business or assets relating to a Website of which you are a user, we may disclose your personal information to a prospective purchaser of such business or assets to ensure uninterrupted operations;
(ii) in the event of the acquisition of KP or substantially all of its assets by third parties, where personal data held by KP will automatically be one of the transferred assets;
(d) if we are subject to an obligation to disclose or share your personal information in order to comply with legal obligations, at the reasonable request of government officials, and to meet national security requirements, to comply with the law, or to prevent illegal activities;
(e) to respond to claims, to protect our rights or the rights of third parties, to protect the safety of individuals, or to prevent illegal activity; or
(f) to protect the rights, property or safety of KP, our employees, customers, suppliers and others.
Some of these recipients (including our affiliates) may use your data in countries outside the European Economic Area. See Section 4 for more information.
3.3 Restrictions on use of personal data by recipients
All third parties to whom we have chosen to transfer your personal data in accordance with the above are subject (either by law or contract) to restrictions on the use of your personal data for the specific purposes indicated by us. We will always ensure that the third parties to whom we have decided to transfer your personal data are subject to privacy and data security obligations in accordance with the principles set forth in this Privacy Notice and applicable laws. However, for the avoidance of doubt, this does not apply if the disclosure of data is not our decision.
Except as expressly stated above, we will not under any circumstances share, sell or rent your personal information to any third party without notifying you and, where applicable, obtaining your consent.
4. transfer of information outside the European Union
Personal data may be processed by personnel operating outside the EEA working for us, other members of our group and external processors for the purposes indicated above.
When we transfer your personal data to our group members outside the EEA or to third-party processors, we will take appropriate measures to ensure that the recipients adequately protect your personal data in accordance with this Privacy Notice. These measures include:
in the case of U.S.-based service providers, signing standard contractual clauses with them approved by the European Commission or ensuring that they have joined the EU-U.S. Privacy Shield data protection program (more at https://www.privacyshield.gov/welcome); or
in the case of service providers based in other countries outside the EEA (including Japan), signing standard contractual clauses with them approved by the European Commission.
More information about the steps we are taking to protect your personal information in these cases can be obtained upon request by contacting us at any time (see section 8 below).
5. your rights
Data subjects have certain rights related to the personal data we collect. KP respects your rights and will handle your requests accordingly.
(a) Right to withdraw consent: If you have consented to the processing of your personal data, you may withdraw your consent at any time.
(b) Right of Rectification: You may request that we rectify personal data concerning you. We make every effort to ensure that personal data in our possession or under our control that is used on an ongoing basis is accurate, complete, current and relevant, based on the latest information available to us. Where appropriate, we provide self-service web portals where users can review and correct their personal information.
(c) Right to restriction: You may obtain a restriction on our processing of your personal data if:
- you question the accuracy of your personal data, for the period of time needed for us to verify that accuracy,
- processing is unlawful and you request restriction of personal data processing instead of deletion,
- we no longer need your personal data, but you need it to establish, exercise or defend legal claims, or
- you object to the processing, for as long as we verify that our legitimate reasons override your reasons.
(d) Right of access: You may request information from us about the personal data we hold about you, including information about what categories of personal data are in our possession or control, what they are used for, where we collected them, if not directly from you, and to whom they were disclosed, if applicable.
Upon request, we will provide you with a copy of your personal data in our possession. If you request further copies of your personal information, we may charge you a reasonable fee based on administrative costs.
You have the right to be informed about the safeguards we have in place regarding the transfer of your personal data to a country outside the EU and EEA, if you ask us to confirm whether we process your personal data and transfer your personal data to a country outside the EU and EEA.
(e) Right to data portability: As of May 25, 2018, you have the right to receive the personal data you have provided to us and, where technically possible, to request that we transfer the personal data (that you have provided to us) to another organization.
You are entitled to these two rights if:
- We process your personal data by automated means,
- we process your personal data on the basis of your consent or the processing of your personal data is necessary for the conclusion or performance of a contract to which you are a party;
- personal information we received from you and
- the transmission of your personal data does not adversely affect the rights and freedoms of others.
You have the right to receive personal data in a structured, commonly used and machine-readable format.
Your right to receive personal data must not adversely affect the rights and freedoms of others. This may be the case if the transfer of your personal data to another organization also involves the transfer of personal data of others (who have not given their consent).
You have the right to request the transmission of personal data to another organization if such transmission is technically feasible.
(f) Right to erasure: You have the right to request us to delete the personal data we process about you. We must comply with this request if we process your personal data unless the data is necessary:
- for the exercise of the right to freedom of expression and information;
- for the performance of a legal obligation that binds us;
- for archival purposes in the public interest, for scientific or historical research, or for statistical purposes, or
- in order to establish, exercise or defend legal claims.
(g) Right to object: You may object at any time to the processing of your personal data on account of a particular situation, provided that the basis for the processing is not your consent, but our or third parties’ legitimate interests. In that case, we will no longer process your personal data unless we can demonstrate a compelling legitimate basis and our overriding interest in the processing or in establishing, exercising or defending legal claims. If you object to the processing, please indicate whether you are also requesting the deletion of your personal data, otherwise we will only limit the processing.
You can always object to the processing of your personal data for direct marketing based on our legitimate interest, regardless of the reason. If the basis of the marketing was your consent, you can withdraw your consent.
(h) Right to file a complaint: You may file a complaint with the data protection supervisory authority:
Office of Personal Data Protection
ul. Stawki 2
00-193 Warsaw
fax. 22 531 03 01
Contact is possible in the following ways:
a. by mail: 2 Stawki Street, 00-193 Warsaw
b. via electronic mailbox available at: https://www.uodo.gov.pl/pl/p/kontakt
Office hours: 8.00 – 16.00
Hotline: 606-950-000 (open weekdays 10 a.m. – 1 p.m.)
Attention:
Deadline: We will try to fulfill your request within 30 days. This deadline may be extended for special reasons relating to a specific law or the complexity of the request. In all cases, if the deadline is extended, we will inform you of the time of the extension and the reasons for it.
Limitation of access: In some situations, we may not be able to provide you with access to all or some of your personal information due to statutory provisions. If we deny your request for access, we will inform you of the reason for the denial.
Lack of identification: In some cases, we may not be able to search for your personal data due to the information indicated in your request. In such cases where we cannot identify you as a data subject, we will not be able to fulfill your request to exercise your rights as described in this section unless you provide additional identifying information. We will inform you of this and give you the opportunity to provide such additional information.
Exercise of rights: If you wish to exercise your rights, please contact us in writing (including electronically), contact information is provided in Section 8 below.
6. Security
KP strives to protect personal data from loss, misuse, disclosure, modification, unavailability, unauthorized access and destruction, and takes appropriate precautions to protect its confidentiality, including through the use of appropriate organizational and technical measures. Organizational measures include physical access control at our facilities, training for employees, and keeping records in physical form in locked cabinets. Technical measures include encryption, the use of passwords to access our systems and the use of anti-virus software.
As you provide us with your personal information, it may be transmitted over the Internet. Although we make every effort to protect the personal information you provide to us, the transmission of information over the Internet is not completely secure. Therefore, we cannot guarantee the security of the personal information you transmit to us over the Internet, and the data is transmitted at your risk. Once we receive your personal information, we will apply strict procedures and security measures to prevent unauthorized access to your information.
7. changes to our privacy notice
We reserve the right, in our sole discretion, to modify our privacy practices and to update or change this privacy notice at any time. For this reason, we encourage you to review the privacy notice frequently. This privacy notice is effective as of the date stated at the beginning of the document. We will handle your personal information in a manner consistent with the privacy notice under which it was collected, unless we receive your consent to handle it otherwise.
8. Contact information
We would like to inform you that we have appointed a Data Protection Officer. Please direct any questions regarding data protection and other requests for the exercise of rights to the following addresses:
rodo@asahibeer.pl
Kompania Piwowarska S.A.
53 Emilii Plater St.
00-113 Warsaw
We will investigate any such request and complaint regarding the use or disclosure of your personal information and attempt to resolve them.
If you are not satisfied with our response, you can also file a complaint with the Data Protection Authority. For more information, please visit https://uodo.gov.pl/.