1. – INTRODUCTION
By entering your personal data, you give your consent to its incorporation into data files belonging to MAHOU, S.A. and CERVECERA INDEPENDIENTE, S.A., both with fiscal residence in Madrid, C/Titan, no. 15, and to AGUAS DE SOLAN DE CABRAS, S.A., with fiscal residence in Beteta (Cuenca), Paraje de Solán de Cabras, s/n (hereinafter denominated jointly as the “COMPANY“) who are committed to protecting your privacy and therefore place this Policy for Privacy and Protection of Personal Data at your disposition. Your consent shall apply to all of the entities that form the COMPANY. If you do not accept the terms of this policy, do not provide your personal data to any of the entities comprising the COMPANY. This policy is incorporated in and forms part of the Terms and Conditions that govern the use of the web sites, applications and/or social networking accounts of each of the entities that comprise the COMPANY (hereinafter the “Contents” or the “Content”).
We recommend that you re-read this policy from time to time, to keep up to date with its contents, including any modifications that may be introduced. When you access the COMPANY‘s contents after any changes, alterations or updates in the policy have been announced, you implicitly accept the new conditions.
2.- MINORS (PERSONS UNDER 18 YEARS OLD)
The COMPANY informs its users that persons under 18 years old may not create user accounts nor access the COMPANY‘s contents.
Minors must not provide us with any personal data. We may not, and do not wish to, collect personal data of any under-age person, nor offer any promotion, including the promotion of alcoholic beverages, to anyone too young to purchase them. If we are informed, or come to believe, that a minor has provided us with personal data, by falsifying the requirements (giving a false date of birth when accessing the web site), we will do all in our power to eliminate this personal data from our files. Parents or guardians may in any case request the COMPANY to block the account of any minor in their charge who may have registered using a false identity.
3.- COLLECTION OF PERSONAL DATA
Any user who wishes to access particular services that require a user account, participate in competitions, raffles, promotions, forums, surveys and other activities of the COMPANY, or participate in the services offered by the COMPANY, or submit videos, images or other material, receive information on promotions or contact the COMPANY, must fill out the forms requesting personal data or comply with the requirement of other means of gaining access to particular services, as applying to the Contents in each case. Notwithstanding the above, precedence shall be given in all cases to the data treatment conditions applying to each case as established and communicated to the user by the corresponding entity within the COMPANY at the time that the user filled out the registration forms or surveys or was informed of the rules of a competition or promotion and/or the conditions of particular services. In these cases, the contents of this policy shall be understood as complementary to said conditions (except when they are contradictory, in which case, the particular conditions applying to said promotions/services/competitions shall prevail).
The COMPANY does not check the truthfulness of the data provided, and consequently, each case shall be handled on the basis of the data provided by the user, whether or not it be true. The COMPANY requests any user whose personal data changes to communicate the changes, in order to keep the user data up to date.
4.- PASSWORD ACCESS
When users wish to participate in games, competitions, raffles, promotions and other services offered by any of the entities that constitute the COMPANY, it may be necessary to create a user account, as indicated in each case, and obtain a “user name” and a “password”, to identify the user when he/she wishes to participate. Once the user’s account has been created, the same user name and password may be used on all platforms. This means that users do not need to create a separate user name and password for each of the Contents of each of the entities that constitute the COMPANY; by creating a user account for any Content provided by any of the entities, the user obtains a user name and password that can be used to participate in the games, competitions, raffles, promotions and other services offered by all of the entities that constitute the COMPANY in any of their Contents, unless otherwise indicated by one of these entities.
5.- WHO HAS ACCESS TO YOUR PERSONAL DATA?
An optimal execution of the service that Mahou offers through the present website may require that Mahou’s trustworthy providers access the User’s personal data as data processors, to the extent that it is strictly necessary for the provision of the services contracted with them. Such data processors operate under a service contract in the terms, conditions and guarantees contained in the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
In addition, Mahou carries out the corresponding controls, inspections and audits in accordance with said GDPR to verify that such data processors strictly comply with the contracts signed to for this purpose and the applicable regulations.
By accepting this Privacy Policy, the User understands that some of the aforementioned service providers are located in countries outside the European Economic Area and that, therefore, they do not offer the same level of protection of personal data as in the European Union. In particular, the User understands that Mahou has concluded a services contract with Salesforce.com, Inc., located in the United States, for the provision of the service consisting on the management of Mahou’s relationships with its users and clients, as well as the provision of a platform for advertising and marketing purposes.
In these cases, Mahou has adopted the appropriate measures and guarantees established in accordance with the GDPR, including data transfer agreements based on the Standard Contractual Clauses approved by the European Commission. For more information on international transfers of personal data and the above guarantees, you can contact Mahou by the means established in the following section.
In addition to the abovementioned, the User understands that Mahou may communicate personal data to the extent it is obliged by law, with Public Administrations and, where appropriate, also to others bodies such as the State Security Forces and the Judicial bodies.
6.- DATA CESSION AND COMMUNICATION
Anyone who registers in one of the Contents of the entities that constitute the COMPANY grants consent to his/her data being shared between the entities that constitute the COMPANY and that are identified above in section 1 of this policy, for the purposes indicated above in section 5.
The COMPANY may cede or communicate data, according to the terms of article 11.2.c of the Law of Data Protection (LOPD), to comply with its obligations to public administrative bodies when required to do so by the law in force, and, when required, to other bodies such as the State security forces and the justice system.
If the user does not agree with the cession of data as described above, he/she should abstain from participating in the corresponding service, promotion or competition.
7.- OTHER DATA RECIPIENTS
The COMPANY advises the user that it is only responsible for, and only guarantees the confidentiality, security and treatment of data according to the terms of this policy in the case of personal data provided by the user via the COMPANY‘s Contents, and bears no responsibility whatsoever for the treatment and subsequent use of personal data by the COMPANY‘s third-party service providers who may collect said data in the course of their provision of services or of their activity.
In addition, the COMPANY accepts no responsibility for data treatment by third parties that set up hyperlinks to the COMPANY‘s Contents, nor by third parties to which the COMPANY remits users via hyperlinks in the COMPANY‘s Contents.
The user accepts and consents to his/her data being processed by Salesforce.com, Inc., acting as the COMPANY‘s data processor, and whose fiscal residence is The Landmark at One Market Street, San Francisco, CA 94105, USA. The main purpose of this service is to manage the COMPANY‘s relationships with its users and customers, and to provide a platform for publicity and marketing.
8.- DATA QUALITY
The COMPANY advises users that, except in the case of legally constituted and accredited representation, no user may use another person’s identity or provide another person’s personal data; users may only provide their own personal data and this must be suitable, pertinent, up to date, exact and truthful. In this regard, the user is exclusively responsible for any direct or indirect damages caused to third parties or to the COMPANY by his/her use of another person’s personal data or by providing false, erroneous, out of date or inappropriate data. Similarly, a user who provides personal data of a third person is obliged to inform the latter according to the terms of article 5.4 of Organic Law 15/1999, dated the 13th of December, on Protection of Data of a Personal Nature (“LOPD”, Ley Orgánica de Protección de Datos), which deals with cases in which data is not obtained from the person him/herself, and/or of the consequences of not informing this person or not obtaining his/her consent. Should a user decide voluntarily to provide personal data of another person to the COMPANY (for example, an e-mail address or telephone number) with the intention of remitting or recommending the COMPANY‘s Contents, the user undertakes to first inform the other person of the intention of providing his/her data to the COMPANY and to obtain that person’s consent to the processing of said data and the transmission of communications according to current legislation, failing which, the user is solely responsible.
9.- UPDATING INFORMATION
The user is the only source of persona data, and the COMPANY recommends that, in order to maintain the data up to date at all times, according to the principles of the Law of Data Protection (“LOPD”), the user should communicate any modifications in the personal data via the address C/Titan, 15, 28045 Madrid, or by selecting the corresponding option in the “Contact us” section of the Contents, when such exists. We remind users that, in order to update their data, they must prove their identity by providing a photocopy of their Identity Card or equivalent document,.
10.- THE RIGHT OF ACCESS, RECTIFICATION, CANCELLATION AND OPPOSITION TO PERSONAL DATA
The COMPANY informs users that they have the rights of access, rectification, cancellation and opposition to the treatment of their personal data by means of a signed written request addressed to any of the entities that constitute the COMPANY at the following address: Dpto. Asesoría Jurídica, c/ Titán 15, 28045, Madrid. To this end, the user should send said written request, indicating the right he/she wishes to exercise, his/her name and surname, and the address to which the replies should be sent, accompanied by a copy of his/her Identity Card or other valid document as proof of identity (photocopy of passport). In the case of a representative, the right of representation must be demonstrated by a valid document. Users may also exercise their rights by sending a photocopy of both sides of their Identity Card (or of their passport) via the “Contact us” form, when such exists. Because of the centralized manner in which the COMPANY handles its data, the use of the right of cancellation of personal data addressed to any of the entities that constitute the COMPANY shall also entitle the remaining entities to cancel the data in their own files.
11.- CANCELLING THE PROMOTIONAL E-MAIL SERVICE
The user has the right to oppose the use of his/her data for promotional purposes via the transmission of commercial messages, and to revoke at any time the consent granted for this purpose by simply notifying the entity of the COMPANY that he/she does not wish to continue receiving commercial messages, without this affecting the user’s right to opposition. Users may communicate their opposition by filling out the corresponding form in the “Contact us” section, when such exists, or in the manner indicated in each commercial message.
12.- “COOKIES”
The owner of this Content informs users that “cookies” may be used when a user accesses the Content. More information regarding our use of “cookies” may be found here.
13.- PROHIBITIONS
With regard to any personal data that is published in the COMPANY‘s Contents, we inform users that this data is part of one or more data files that belong to and are the responsibility of the COMPANY, and they may not be freely processed or reproduced by other users of the Contents unless authorisation and informed consent has previously been obtained from the person in question.
Personal data published in the COMPANY‘s Contents may consist of any information on any support that concerns physically-identifiable persons, such as a name, surname, IP address, post code, e-mail address, photographs, images of events and parties celebrated by the COMPANY, data identifying prize winners or victors in competitions, promotions or services organised or sponsored by the COMPANY, data published by users or any other information. Consequently, any personal data may only be used by the user of the Contents in order to participate in the services and Contents in the way established in the usage policies of the Contents and in the Privacy Policy, for personal purposes and within the framework of current legislation, with no lucrative or commercial objectives of any nature. Any other uses, apart from those indicated above, are expressly forbidden, including the incorporation of images or data into files or processes, and/or the creation of data bases containing personal data and/or sending publicity or cessions to third parties, without the prior informed consent of the corresponding user. The COMPANY shall bear no responsibility for the use of personal data that other users of the Contents may make in violation of this policy.
When users participate in the COMPANY‘s activities, competitions or promotions and these involve users of certain Contents contributing any type of file, opinion, etc., the COMPANY advises users that the following activities are forbidden:
• Publishing information or making comments or insinuations that incite or promote violence, intolerance, racism, abuse, hatred, menaces, physical or psychological harm, sexual or other harassment or any other acts contrary to law and order;
• Publishing information or making comments or insinuations that are false or deceitful, hurtful, debasing, menacing, offensive, abusive, obscene or defamatory;
• Using information published by another user without respect for the intellectual property rights of the legitimate owners of these rights.
• Using a false identity (impersonating another person, or using the account, user name or password of another person). Users must not give their password to a third person, nor allow a third party to access their account.
Users may only publish information or images belonging to them, and are personally responsible for these. When the information or images affect other persons, the prior express consent of these persons must have been obtained.
Users must always remember that the COMPANY is committed to protecting personal honour and privacy. Article seven of Act 1/1982, dated the 5th of May, on Civil Protection of the Right to Honour, Personal and Family Privacy and Personal Image establishes the following acts as illicit and forbidden offences against the person:
• Installation in any location of listening devices, cameras, optical devices or any other means of recording or reproducing a person’s private life.
• The use of listening devices, optical devices or any other means to discover a person’s private life, manifestations or private correspondence not addressed to those using the aforesaid means, and their recording, copying or reproduction.
• Disclosure of events related to a person’s or family’s private life that affect their reputation or good name, and the revelation or publication of the contents of letters, memoirs or other personal documents of a private nature.
• Revelation of a person’s or family’s private data obtained via the professional or official activity of the person who reveals the data.
• Capturing, reproducing or publishing a person’s image, whether in places or moments corresponding to the person’s private life or otherwise, via photographs, filming or any other procedure, except in those cases expressly permitted by law.
• The use of a person’s name, voice or image for advertising, commercial or similar purposes.
• Imputation of actions or manifestations of value judgements via actions or expressions that in any way attack anyone’s dignity, diminish their good name or threaten their self-esteem.
• The use of a crime by a person condemned by a firm penal sentence to achieve public notoriety or obtain financial benefit, or the divulging of false information on criminal acts, when this is harmful to the dignity of the victims.