ASAHI GROUP
Privacy Policy for EEA Personal Data (For Staff Members)This Privacy Policy applies to the corporate group made up of Asahi Group Holdings, Ltd.,
with its headquarters located at 23-1, Azumabashi 1-chome, Sumida-ku, Tokyo, 130-8602
Japan (“AGH”), and its subsidiary companies located in Japan (the “Group Companies,”
and the corporate group, the “Asahi Group”. Each company of the Asahi Group is referred
to as an “Asahi Group Company”.).
This Privacy Policy applies to all Personal Data related to the following persons in the EUthat is processed by Asahi Group Companies: officers and employees, prospective
employees, interns, prospective interns, and those persons who carry out work on thepremises of AGH and its subsidiary companies (“Internal Contractors”. Hereinaftercollectively referred to as “Staff Member(s)”).
In this Privacy Policy, EU refers to the following 27 member states of the European Union(subject to future fluctuations in the number of member states):
Belgium, Bulgaria, Czech Republic, Denmark, Germany, Estonia, Ireland, Greece, Spain,
France, Croatia, Italy, Cyprus, Latvia, Lithuania, Luxembourg, Hungary, Malta, The
Netherlands, Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland, and Sweden;
provided, however, that the definition of EU in this Privacy Policy also includes the United
Kingdom, Iceland, Norway, and Liechtenstein.
In addition, in this Privacy Policy, the General Data Protection Regulation 2016 and thedata protection laws in the United Kingdom are collectively referred to as the European
Data Protection Laws.
Please read this Privacy Policy carefully to understand how your Personal Data ishandled.
Contents:
Section 1:

Acquisition of Personal Data

Section 2:

Use of Personal Data

Section 3:
Legal bases for use of your Personal Data under the European Data
Protection Laws
Section 4:

Disclosure of Personal Data

Section 5:

Retention of Personal Data

Section 6:

Your rights

Section 7:

Transfers of Personal Data

Section 8:

Security

Section 9:

Third party websites

Section 10: Changes to Asahi Group’s Privacy Policy
Section 11: Further questions or making a complaint
1.

Acquisition of Personal Data

1.1

An Asahi Group Company may acquire any of the following information from you(“Personal Data”) and any such company may use that Personal Data:

1

(a)

(b)

(c)

(d)

Attribute information about you:(i)

your full name (including first name, maiden name and surname);(ii)

date of birth/age;(iii)

home address;(iv)

proof of identification and certificate of residence, etc.;(v)

social insurance number/labour insurance number/social security andtax number (including what is called “my number” in Japan);(vi)nationality;(vii)

home telephone number;(viii)

e-mail address;(ix)

gender;(x)

marital status;(xi)

race/ethnicity;(xii)

religious beliefs;(xiii)

information recorded on your driver’s licence;(xiv)

details of character and physical description;(xv)

blood type; and(xvi)leisure activities and interests.

Personal Data of your family/next of kin:(i)emergency contact details;(ii)

names;(iii)

contact information;(iv)

social insurance number/labour insurance number/social security andtax numbers (including what is called “my number” in Japan);(v)

whether there are any dependents and (if any) the details of thosedependants; and(vi)

co-insured family members’ details and beneficiaries of your life
insurance or other benefits.

Documentation required under EU immigration laws:(i)citizenship details;(ii)national identification number;(iii)

other documents required to show your right to live in your current
country and to work for your employer there; and(iv)

details required for residency, work permit and/or visa processes.

Compensation/employment information:(i)current/former titles and positions, etc. held with Asahi Group
Companies (including how long in position, supervisor, work location,
Staff Member number, promotions, training records, overall work
history, languages spoken, disciplinary actions, grievances, eligibility
to receive retirement allowances, transfers);

2

1.2

(ii)

search results of identification information databases, including
employment searches, directorship searches, bankruptcy searches,
media searches and criminal record checks;(iii)

current and historic compensation from Asahi Group Companies(base salary, bonus, pension contributions);(iv)

work contact information (phone number, postal address, e-mailaddress);(v)

performance reviews and personnel information (including career
design and career development plans);(vi)

status of work place accidents, drug and alcohol testing results,
sickness and other reasons for absence and medical or healthinformation (relevant to your employment and/or provided directly
by you, for example, medical assessments and occupational healthreports);(vii)

work hours (overtime hours, hours worked, department standard
hours, and status of shift work);(viii)

previous employment references;(ix)

your photo (including for your ID card used to enter or exit
premises);(x)

details of applications such as travel bookings and payee details forsettlement of travel expenses;(xi)

records of communications in writing, by electromagnetic media, orby phone.

(xii)

bank account details for payment of compensation and salary;(xiii)

tax information related to compensation and salary; and(xiv)

IDs related to compensation and salary processing.

(e)IDs, etc. required to access company systems and applications.

(f)Talent management/resume/CV information: details contained in an
application and resume/CV or otherwise provided by you, including previous
employment background, professional qualifications, references, careerdevelopment and skills analysis, training, departmental changes,
performance and calibration details. Stress check data and personality
profiling data is also acquired. However, this data is not used to make any
automated decisions about you.

(g)

Details of directorship positions or of any shares that you may hold.

(h)

CCTV footage.

(i)

Results of searches of identification information (including employment
searches, directorship searches, bankruptcy searches, media searches, andcriminal record checks).

Sources of Personal Data: An Asahi Group Company may acquire some Personal
Data directly from you. In addition, your Personal Data may also be acquired fromthird parties, such as recruitment agencies, corporations or other similarorganizations with whom you used to be affiliated, public agencies, as well as AGH
and its subsidiary companies in/outside Japan, or from publicly-available sources,
such as social networking services.

3

1.3

Special categories of data: Some of the Personal Data that an Asahi Group Company
acquires about you, your family and benefit beneficiaries may be special categoriesof data. “Special categories of data” are Personal Data that relate to such mattersas any of the following: racial or ethnic origin; political opinions; religious orphilosophical beliefs; any trade union membership; physical or mental health;biometric data (including photos where used for identification purposes); sexual life
or orientation; criminal convictions or offences (actual or alleged).

2.

Use of Personal Data

2.1

Use of your Personal Data

An Asahi Group Company may acquire, use and store your Personal Data for the following
reasons:(a)to operate, support and centralise human resources administration andmanagement (including but not limited to recruitment, compensation andsalary administration, Staff Member administration, education management,
work performance management and review, expense settlement, benefits
management and termination of employment);(b)

to support you in your work;(c)candidate profiling and suitability assessment;(d)health and safety records;(e)understanding any occupational health matters that may impact yourperforming your work;(f)security vetting, criminal records checks, credit checks and residence
procedures (where allowed by applicable laws and regulations);(g)

confirming details on resumes, CVs and covering letters, providing reference
letters and performance reference checks;(h)Staff Member management and promotions;(i)monitoring Staff Member communication and internet usage (only for the
purpose of compliance with applicable laws and regulations or internal rulesof the Asahi Group Company) in accordance with internal IT-related rules;(j)equal opportunities monitoring in terms of Staff Member allocation,compensation, salary and the like;(k)provision of Staff Member information to customers, agencies and business
partners in the course of the provision of goods or services;(l)taxation and registrations with authorities with respect to Staff Members;(m)

CCTV monitoring and other security of company facilities;(n)ensuring adequate insurance coverage for business risks of the Asahi Group
Company;(o)compliance with any internal rules, laws and regulations which apply to the
Asahi Group Company;(p)establishing, exercising or defending the legal rights of the Asahi Group
Company; and(q)otherwise, for the lawful operation of the Asahi Group Company’s business.

4

2.2

Use of the Personal Data of your family and next of kin

In addition, an Asahi Group Company may process Personal Data about your family andnext of kin for the purposes of provision of benefits or to contact them in an emergency.
If you disclose information about your family in written, electromagnetic, or phone
communications, the Asahi Group Company may also have access to this information on
its systems. An Asahi Group Company may process Personal Data of your family and nextof kin only for the purposes set out in section 2.1 or for purposes specifically permitted
under applicable laws and regulations.
2.3

Use for other purposes

If processing Personal Data of your family/next of kin for any purpose other than those set
out in section 2.2, this Privacy Policy will be updated in accordance with section 10.
3.

Legal bases for use of your Personal Data under the European Data
Protection Laws

3.1

An Asahi Group Company needs to have legal basis under the European Data
Protection Laws to use any of your Personal Data set out in this Privacy Policy. An
Asahi Group Company is considered to have legal basis if its use of your Personal
Data comes under any of the following:(a)for the performance of its obligations under its contract with you (forexample, to pay you compensation or the like or to provide you with abenefit);(b)for complying with its legal obligations under applicable EU laws or theapplicable laws of each EU country as your employer (including as yourprospective employer) (for example, providing your Personal Data to
HMRC); or(c)where neither (a) nor (b) apply, if it is in the legitimate interests of the Asahi
Group Company or the legitimate interests of a third party (for example, toensure a safe working environment, to ensure the reliability of Staff
Members, or to maintain personnel records).

3.2

Where an Asahi Group Company cites its legitimate interests or the legitimate
interests of a third party as the legal basis for using Personal Data under theEuropean Data Protection Laws, the details of those legitimate interests are
explained in the relevant parts of this Privacy Policy.

3.3

An Asahi Group Company processes special categories of Personal Data (forexample, for the results of drug and alcohol testing, health assessment results,
racial/ethnic origin, religious beliefs or criminal background checks), only:

3.4

(a)

in certain instances where it is reasonably necessary to process that Personal
Data in order for the Asahi Group Company to comply with the legal
obligations applicable to that Asahi Group Company as an employer or to
exercise specific rights that it has as an employer; or(b)where you have given the Asahi Group Company your explicit consent.

If an Asahi Group Company has asked for your consent to acquire and use certain
types of Personal Data, you may withdraw your consent at any time by contacting
the relevant contact points set out in section 11.2.

5

4.

Disclosure of Personal Data
Disclosure to Asahi Group Companies

4.1

Your work contact information will be made available to Staff Members, customers,
and business partners of Asahi Group Companies. This information includes yourname, position, workplace telephone numbers, work addresses and e-mailaddresses, department, job title, photo, and other similar details.

4.2

Your Personal Data may be shared between Asahi Group Companies where it isconsidered that it is in the legitimate interests of those Asahi Group Companies to
do so for internal administrative purposes (including corporate strategy,
compliance, auditing and monitoring, research and development, and quality
assurance).

4.3

If any of AGH and its subsidiary company provides goods or services to, or receives
provision of services from, one another (such as information technology systems,
human resources services and Staff Member monitoring), your Personal Data may
be shared between the relevant company.

4.4

An Asahi Group Company may also process your Personal Data (such as system orapplication access data and logs) for the purpose of monitoring your behaviour,
either as a data controller or as a data processor.

4.5

Access to your Personal Data is limited to those Staff Members who need to processthat Personal Data, and in this case such Staff Members may include yoursupervisor, persons delegated by that supervisor to be in charge of performance ofwork, and Staff Members in the management department.
Disclosure to third parties

4.6

An Asahi Group Company will share your personal data with the following third
parties:(a)the legal and regulatory authorities of each country or territory;(b)

accountants, auditors, lawyers and other professional advisors; and(c)any of the following corporations or other similar organizations or companies
contracted to provide services:(i)compensation, salary, and benefits providers;(ii)

pension providers;(iii)

insurance companies, including those providing medical insurance
and group income protection;(iv)

providers of human resources services, such as pre-employment
checks and for Staff Member monitoring;(v)

recruitment agencies;(vi)

parties requesting a Staff Member reference;(vii)

travel agencies and transport providers;(viii)

medical institutions and the like conducting occupational healthassessments and medical professionals undertaking drug and alcohol
testing;(ix)

information technology systems and support providers, including
email archiving, electric power companies, telecommunication
services companies, back-up and disaster recovery and cybersecurity service providers; stress check providers and other6

outsourcing providers, such as companies providing off-site storage
and companies providing cloud services.
(d)
4.7

AGH’s subsidiary companies not located in JapanAn Asahi Group Company will also disclose your Personal Data to third parties:(a)in cases such as the following where it is in that Asahi Group Company’s
legitimate interests to do so to run, grow and develop its business:(i)

if that Asahi Group Company sells or buys certain business or assets,
it may disclose your Personal Data to the prospective seller or buyerof such business or assets;(ii)

if substantially all of the assets of that Asahi Group Company or anyof its affiliates are acquired by a third party, in which case Personal
Data held by that Asahi Group Company or its affiliates will be one of
the transferred assets;(b)

if that Asahi Group Company is under a duty to comply with any lawful
request from government, administrative agency or law enforcement agency
officials of any country or territory (as may be required to meet national
security or the law enforcement requirements of any country or territory),
or to prevent illegal activity;(c)

to contact you, to respond to any claims from you, to protect the rights ofthat Asahi Group Company or a third party, for safety, or to prevent any
illegal activity; or(d)to protect the rights, property, and safety of Staff Members, customers,
business partners or other stakeholders of that Asahi Group Company.

Restrictions on use of personal data by third parties
4.8

Any third parties with whom your Personal Data is shared are limited (by theEuropean Data Protection Laws and the laws of each EU country, and by contract)in their ability to use Personal Data for any purposes other than to provide services
for an Asahi Group Company. Each Asahi Group Company will ensure that any third
parties with whom your Personal Data is shared are subject to privacy and security
obligations consistent with this Privacy Policy, and with the European Data
Protection Laws and the laws of each country.

4.9

Save as expressly detailed above, each Asahi Group Company will never share, sellor rent any of your Personal Data to any third party without notifying you and/or
obtaining your consent. Where you have given your consent for an Asahi Group
Company to use your Personal Data, but later change your mind, you should contactthat Asahi Group Company and it will stop doing so.

5.

Retention of Personal Data

5.1

Each Asahi Group Company acquires and retains Personal Data on current, former
and prospective Staff Members in order to comply with applicable labour-related
laws and regulations (such as processing compensation and salaries for Staff
Members, acquiring CVs/resumes of prospective recruits, and maintaining accurate
benefits records.

5.2

Each Asahi Group Company retains your Personal Data for the period of timenecessary to use or otherwise process that Personal Data. The period of time that
Personal Data is retained is determined based on the purposes of use and the7necessity to retain it under applicable laws and regulations. For example, in Japan,salary and wage records must be kept for seven years.)
5.3

Each Asahi Group Company currently retains Personal Data for as long as requiredor permitted under applicable laws and regulations or for as long as reasonably
considered necessary to establish, exercise or safeguard its legal rights.

6.

Your rights

6.1

You have certain rights in relation to your Personal Data. If you would like further
information in relation to these or would like to exercise any one of them, pleasecontact the relevant contact points set out in section 11.2. If it is permitted under
the European Data Protection Laws or under the laws of each EU country, you havethe right to request that an Asahi Group Company:(a)provide you with access rights to any of your Personal Data;(b)update any of your Personal Data which is out of date or incorrect;(c)delete any of your Personal Data;(d)restrict the way that your Personal Data is processed;(e)provide or not provide your Personal Data to a provider of services;(f)provide you with a copy of any of your Personal Data which is held about
you; or(g)consider any valid objections which you have to the use of your Personal
Data.

6.2

Each Asahi Group Company will consider all such requests and provide a response
within a reasonable period (and in any event any time period required by EU laws
or the laws of each EU country). Please be aware, however, that certain Personal
Data may be exempt from such requests in certain circumstances.

6.3

If an exception applies, the relevant Asahi Group Company will tell you this when
responding to your request. An Asahi Group Company may request you to provide
information necessary to confirm your identity before responding to any request
you make.

6.4

If you have any questions or concerns about the use of your Personal Data by an
Asahi Group Company, please contact the relevant contact points set out in section
11.2.

7.

Transfers of Personal Data

7.1

If an Asahi Group Company provides any Personal Data about you to any third party
established in a country or a service provider outside the EU, that Asahi Group
Company will take adequate safety management measures with respect to your
Personal Data in accordance with this Privacy Policy. These measures include, but
are not limited to, entering into approved standard contractual arrangements with
them.

7.2

If you make an enquiry to contact points set out in section 11.2, an Asahi Group
Company will provide you with further details on the protective measures set out
above.

8

8.

Security

8.1

Each Asahi Group Company is committed to protecting Personal Data from loss,
misuse, disclosure, alteration, unavailability, unauthorised access and destruction
and takes all reasonable precautions to safeguard the confidentiality of Personal
Data, including through use of appropriate organisational and technical measures.
Organisational measures include physical access controls to the premises of each
Asahi Group Company, Staff Members training and locking physical files in filingcabinets. Technical measures include such measures as the use of encryption,
passwords for access to the systems of each Asahi Group Company, and the use ofanti-virus software.

8.2

In the course of provision of your Personal Data, your Personal Data may betransferred over the internet. Although each Asahi Group Company makes every
effort to protect the Personal Data provided by you, the transmission of information
over the internet is not necessarily secure. As such, you understand and accept thateach Asahi Group Company cannot guarantee the security of your Personal Datatransmitted over the internet and that any such transmission is at your own risk.
Once an Asahi Group Company has received your Personal Data, it will use strict
procedures and security features to prevent unauthorised access to it.

8.3

Where you have been given (or where you have chosen) a password which enables
you to access Asahi Group systems or any portal or account, you are responsible
for keeping this password confidential. Please do not share a password with anyone.

9.

Third party websites
You may, from time to time during your work, access links to or other websites
operated by third parties (e.g. training providers, industry news sources andbulletins). Please note that this Privacy Policy only applies to the Personal Data thatan Asahi Group Company (or any of its service providers) acquires from or about
you and no Asahi Group Company can be responsible for Personal Data acquired
and stored by third parties. Third party websites have their own terms andconditions and privacy policies, and you should read these carefully before you
submit any Personal Data to these websites. Asahi Group Companies do not endorse
or otherwise accept any responsibility or liability for the content of such third party
websites or third party terms and conditions or privacy policies.

10.

Changes to Asahi Group’s Privacy Policy
This Privacy Policy does not form part of any Staff Members’ contract and the Asahi
Group may amend this Privacy Policy from time to time. Any changes made to thisPrivacy Policy in the future will be posted on this page.

11.

Further questions or making a complaint

11.1

If you have any queries or complaints about the acquisition, use or storage of your
Personal Data, or if you wish to exercise any of your rights in relation to your
Personal Data, please contact the relevant contact points below. The Asahi Groupwill investigate and respond to any such enquiry or complaint regarding the use or
disclosure of your Personal Data.

11.2

You may also make a complaint to the local data protection authority in the EU
country where the relevant Asahi Group Company is based or where the relevant

9Asahi Group Company monitors your behaviour. Alternatively, you may seek aremedy through local courts if you believe your rights have been breached.
Contact details:
The contact details for Asahi Group Companies are as follows. You can make anenquiry to either (a) or (b) using the following details:(a)Contact details for representative of Asahi Group Companies established inEurope:Name of representative:
Address:

Asahi CE & Europe Services s.r.o.

Ovocný trh 1096/8, Staré Město, 110 00 Praha 1, Czech
Republic

Enquiries to (FAO): Legal Director
E-mail address:(b)

personaldataprotection@eu.asahibeer.com

Contact details for point of contact established in Japan
Asahi Group Holdings, Ltd. HR
Address:
8602

23-1, Azumabashi 1-chome, Sumida-ku, Tokyo 130-

TEL:

+81-3-5608-5372

E-mail address:

Official mailbox for AGH HR

The practices described in this Privacy Policy statement are current Personal Data
protection policies, as of April 1, 2023.

10