Basic information about Data Protection
Jointcontrollers
PurposeLegitimate
participation
Addressees
RightsAdditionalinformation

MAHOU, S.A.; CERVECERA INDEPENDIENTE, S.A. andAGUAS DE SOLÁN DE CABRAS, S.A.
More info
To offer you personalised experiences and content based on yourinterests
More info· Performance of the contract· ConsentMore info
Data Processors inside and outside the EU
More info
Access, rectify and delete data, as well as other rights, asexplained in the additional information
More info
You can consult detailed additional information in the Privacy
Policy*****Privacy Policy
I.- Who is the Controller of your data?
This privacy policy (hereinafter the “Privacy Policy”) applies to all data of a personal nature that
the User provides to MAHOU, S.A., CERVECERA INDEPENDIENTE, S.A., both located at Calle
Titán 15, 28045, Madrid, and AGUAS DE SOLÁN DE CABRAS, S.A., located at Paraje de Solánde Cabras s/n, 16893 Beteta (Cuenca) (hereinafter jointly known as “Mahou”) through online
forms or when making a purchase on its web page (hereinafter the “Website”).
For the purposes of this Privacy Policy, “User” is understood to mean any physical person
interested in the products and services that Mahou offers through its Website.
When necessary, Mahou, as Controller, shall request the User’s explicit consent to this Privacy Policy
and to any other aspect that requires the User’s prior authorisation before any personal data is provided.
Users can contact us by sending an electronic mail to consultasprivacidad@mahou-sanmiguel.com
with any inquiries or questions they may have in relation to data protection.
II.- For what purposes do we process your personal data?
The User is hereby informed that Mahou will process the personal data they submit through contact
forms and account registration on the Website for the purposes indicated below, as long as there arelegal grounds for each type of processing as explained further on:(a) To guarantee that the User is able to access and use the Website.

(b) To manage the relationship of the User with Mahou, including management of the purchases theUser makes in the Mahou store, as well as of the User’s participation in contests, promotions andwebsites, computer applications and/or spaces on Mahou’s social media (hereinafter the“Content”). (These purposes include but are not limited to verification that the User meets therequirements for receiving the prize associated with the promotion or contest and making
delivery of same.)(c) To gather statistics and conduct market studies, including analysis regarding the behaviour ofusers in the context of their browsing and the creation of user profiles through the integrationand joint processing of the information collected through the cookies and similar technologies of
any Content with the information about users existing in Mahou databases or which can beobtained from any social media, including but not limited to Facebook, Instagram, YouTube,Twitter, LinkedIn,, or other Content, all for the purpose of learning more about the User,conducting market studies and offering users more personalised promotional content andactivities.
(d) To inform The User by any means, including the sending of commercial communications to
the electronic mail address provided by the User in relation to Mahou products and services
similar to those acquired by the User.
(e) Engaging in promotional activities regarding other products and services, both of Mahou and of
third parties, including the sending of electronic commercial communications to the electronic
mail address provided by the User or which Mahou has obtained through the User’s browsing
information, in the event that the latter consents to this.
III.- What are the legal grounds for processing your personal data?
 The legal basis for processing the data for purposes (a) and (b) is performance of thecontract for provision of the service and/or purchase of the corresponding
products.
 The legal basis for processing the data for purposes (c), (d) and (e) is the consent requested of
the User. Withdrawal of this consent in no way conditions performance of the service
provision contract.
In the event that the User is interested in accessing particular services that require prior registration,
including but not limited to participating in contests, sweepstakes, promotions, fora, surveys, making
purchases and other Mahou activities, or in participating in the services Mahou offers, as well as sending
videos, images and other types of materials, receiving information about promotions or contacting
Mahou, the User must fill out the forms requesting personal data or other means for adherence by theUser to the particular services offered through the Content in each case. The provisions of this Privacy
Policy notwithstanding, the privacy policy established in each case and communicated to the User by
Mahou when the User fills out the forms for registration, surveys, contest or promotion rules and/or any
other conditions of the particular services shall be applicable on a preferential basis. This policy shall beapplied in those cases in a complementary manner (in all matters which do not conflict with it, in whichcase the provisions established in the specific case for these promotions/services/contests will prevail).
Mahou, at the time you provide your personal data, will collect and process those that are essential for
registration, access to the personal space of the User and contact with the Mahou Customer Service team.
Should the User choose to acquire one of Mahou’s products or services, or participate in its promotions
and/or contests, Mahou will collect and process the necessary data (including first name, surnames, street
address, electronic mail address, etc.) to manage the purchasing process and in order to provide any otherservice. The User acknowledges and accepts that failure to provide certain data of a personal nature may
prevent Mahou from providing all the services associated with those data. Under no circumstances will
Mahou transfer or utilise these data for a purpose other than expressly indicated here. During the processof registering and completing the contact form, the User shall be informed of the non-compulsory
nature of some of the data for provision of Mahou’s services.

The User may voluntarily provide additional information in certain sections of the Mahou
website. The decision to provide this information corresponds exclusively to the User. However,Mahou recommends that the User not provide more information than is necessary for the purposesof the services he or she is using.
Furthermore, Mahou may process geolocalisation data in order to properly provide the services it offers
through the website, including (1) location of stores, (ii) calculation of shipping costs, and (iii)
personalisation of the service. In this case, a notification will be sent allowing the User to accept or reject
this functionality.
IV.- For how long will we retain your personal data?
Mahou will retain users’ personal data for the duration of the contractual relationship with the User and,in any case, for a maximum period of seven years from the date of the User’s last interaction with Mahou,
notwithstanding any retention that may be necessary for the filing, exercise or defence of potential claims
and/or provided that this is permitted by the applicable laws. Once the abovementioned period has ended,
the Company agrees to cease processing all your data and to duly block them in the corresponding
Company databases.
V.- Who has access to your personal data?
Optimal provision of the service that Mahou offers through its web page may require that trusted thirdparty vendors have access to the User’s personal data, such as processors, under its control and to theextent that is strictly necessary for provision of the services contracted with same. These processors
operate under a service contract in the terms, conditions and guarantees contained in the GDRP, withMahou carrying out the corresponding controls, inspection and audits in this area to check that theseprocessors strictly comply with the contracts entered into for this purpose and all applicable regulations.
By accepting this Privacy Policy, the User understands that some of the abovementioned controllers arelocated in countries outside the European Economic Area (EEA) and that, therefore, they do not offer thesame level of protection of personal data as the EEA. In particular, the User understands that Mahou hasentered into a contract with Salesforce.com, Inc, which is responsible for processing in the United States,for provision of the service consisting of managing the Mahou’s relationships with its users andcustomers, as well as providing a platform for advertising and marketing purposes.
In these cases, Mahou has adopted adequate measures and guarantees in this area in compliance with theEuropean Regulation on Data Protection, including transfer agreements based on standard contractual
clauses approved by the European Commission. For further information on international transfers of
personal data and the aforementioned guarantees, contact Mahou as described in the next section.
In addition to the above, the User understands that Mahou may transfer or disclose personal data to meetits obligations to Public Administrations in cases where it is required to do so in accordance with the laws
in force at any given time and, if applicable, also to other bodies such as state security forces and corps
and to judicial bodies.
VI.- What rights do users have?
Mahou informs the User regarding the possibility of freely exercising his or her rights of access,rectification, objection, erasure, portability and limitation of processing, as well as to rejectautomated processing of personal data by sending a written and signed request to the following address:
Legal Affairs Dept., c/ Titán 15, 28045, Madrid or through the Customer Service form. To this end, theUser must send this written communication indicating his or her request or the right being exercised, firstname and surname(s) and the address for notifications, together with a copy of their nationalidentification document or other valid document (photocopy of passport) accrediting their identity. Proxy
representation must be proven by a valid document. Likewise, the User can also exercise his or her rights
by sending a photocopy of both sides of his or her national identification document (or passport) throughthe “Contact us” form, if one exists.

The user has the right to oppose the processing of his or her data for promotional purposes for thereception of commercial communications by simply notifying Mahou of his or her wishes. To do so, theUser may send his or her request using the procedure described in the previous paragraph. Likewise, theUser may cancel the reception of commercial communications in the manner provided in eachcommercial communication (for example, by means of the link included in each of them).
In addition to the abovementioned rights, the User has the right to withdraw the consent granted at
any time by means of the procedure described above. Said withdrawal of consent will not affect thelegitimacy of processing prior to its withdrawal. Mahou may continue to process the User’s data to theextent permitted by law.
Mahou reminds the user that he or she has the right to file a claim with the Spanish Data Protection
Agency.
VII.- At what age may the User access our products and services?
The Website is not aimed at persons under 18 years of age, with the exception of the website of Aguas
Solán de Cabras, S.A. In this sense, persons under the age of 18 years are prohibited from accessing theContent and from registering. By accepting this Privacy Policy, the User represents and warrants thathe or she is 18 years of age or older. If the User is under this age, he or she should not provide any data.
We cannot and do not wish to collect personal data from any person under the age of 18 years or aim any
promotion, including promotions for any type of alcoholic beverage, to persons under the legal age forpurchasing it. If Mahou has knowledge that a minor has provided personal data, having made false
declarations in the previous requirements (date of birth for accessing), we will proceed to erase these
personal data from our files. The parents or guardians may, in any case, contact Mahou to block theaccounts of minors under their care who have registered by misrepresenting their identity.
VIII.-Quality of the data
Mahou warns the user that, except in cases of legally constituted and accredited representation, no User
can use the identity of another person and disclose their personal data. The user must, therefore, at all
times keep in mind that they can only introduce personal data corresponding to their own identity and thatthese data must be suitable, relevant, current, exact and truthful. To this end, the User is the only party
responsible for any direct and/or indirect damage caused to third parties or Mahou due to use of anotherindividual’s personal data, or their own personal data when this is false, erroneous, out-of-date, unsuitable
or not pertinent. In addition, any User who discloses the personal data of a third party will be liable to thatthird party pursuant to obligation to report when personal data has not been collected from the interested
party and/or the consequences of not having informed the person and, if applicable, obtained theirconsent.
In the event that the User provides personal data of third parties, he or she undertakes to inform these
persons in advance of the intention to disclose their data to Mahou and to obtain their prior, explicit andwritten consent for said data processing and any purposes for which they might be processed, with theUser liable otherwise.
The User is the only source of information for their personal data, and therefore Mahou requests that theUser, in order to keep their data updated at all times in accordance with the principles of Regulation (EU)2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (GDRP), report any change in same by writing to c/Titán 15, 28045, Madrid or by
selecting the corresponding option in the “Contact us” section of the Content, if one exists. The User isreminded that to update their data, they must accredit their identity by providing a copy of theirnational identification or equivalent document.

IX.- Use of cookies
Our web page uses cookies to distinguish you from other users of our website. This helps us provide youwith a good experience when you browse our website and likewise allows us to improve it. You canobtain more information about the use of cookies on this website in the Cookies Policy document.
X.- Links
The Website may include hyperlinks to other sites that are not operated or controlled by Mahou.
Therefore, Mahou does not guarantee, or accept any liability for, the legality, reliability, usefulness,truthfulness and timeliness of the content of said websites or of the data processing carried out. Before
providing your personal information to these websites external to Mahou, please keep in mind that theircompliance with respect to data protection may differ from ours.
XI.- Modification of the Privacy Policy
Mahou may modify its Privacy Policy in accordance with the applicable laws at any time. In any
case, we inform you that for any modification of the Privacy Policy with a significant effect on yourprivacy and the protection of your data, should the applicable regulations so require, we will give
you the opportunity to grant your consent again.