PRIVACY POLICY
1. General
In this Privacy Policy, we explain to you how we collect and process your personal data when you use our website. We process your personal data in line with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). You may use most of our website without having to provide us with any personal data in return. Certain services or actions require you to provide us with personal data so that we can offer the requested service. Any fields marked with an asterisk on the website are mandatory. If you do not provide us with this information, we will not be able to offer you the service or product. Furthermore, we gather certain information whenever you visit our website. Hereinafter, we inform you about the key aspects of data processing on our website.
Personal data means any information relating to an identified or identifiable person. This mainly includes any details that enables drawing conclusions about your identity, such as your name, phone number, address, e-mail address or IP address. The term ‘personal data’ does not cover any statistical data that we collect, for example, when you visit our website and cannot be associated with you.
2. Controller
The controller responsible for the processing of your data in the form described below is the company
Brau Union Österreich AG
Poschacherstraße 35
4020 Linz
datenschutz@brauunion.com
FN 77559 h
If you have any questions or concerns regarding data protection or want to exercise your rights in relation to your data, please sent e-mail to datenschutz@brauunion.com.
3. Data Processing on Our Website
3.1 Accessing our Website / Access Data
General: if you visit our website, your web browser automatically transfers data to our web servers. This data is processed by our web servers and automatically retained in log files.
Purpose: data processing of this access data is required to enable visiting the website and to ensure the long-term operability and security of our website.
Data categories: technical data (pseudonymised IP address, HTTP header fields)
Legal basis: our legitimate business interest is to provide a secure and operational website. Any data is hence processed under point (f) of Art. 6(1) GDPR.
Retention period: the log files will be automatically erased after 14 days. If we need the log files for any longer period (e.g. due to a specific security incident), however, this retention period may be prolonged, where appropriate.
Recipients: processor (web host)
3.2 Age Query
General: before you are given access to our website, you have to confirm that you have already turned 15 years old.
Purpose: data processing is required, since, for statutory reasons, access to our website is basically only reserved to persons aged 16+ and we do not allow any persons under 16 years of age to access our website.
Data categories: personal data (age)
Legal basis: any data is processed in compliance with a legal obligation under point (c) of Art. 6(1) GDPR.
Retention period: the data will be erased after 30 days, unless there is any other reason for keeping it or we are required by law to keep this data.
Recipients: processor (web host)
3.3 Registrations, User Account, Provisions in Connection with the “BRAUUNION.PLUS / eazle“ Online Shop
General: as customer of Brau Union Österreich AG, you have the option of registering in our shop (brauunionplus.at) to purchase products and to use various other services (e.g. media database, map generator and the like). To do so, you have to create a user account. If you do not create a user account, you will not be able to place any orders. The information provided as well as the orders placed by you can be viewed by you in your user account at any time. You may delete the user account at any time without giving reasons.
Purpose: if you want to create a user account, we process your data to enable you to perform ordering transactions and to ensure that we can handle such transactions whilst, in particular, being able to process the purchase order as well as to handle payment and to perform delivery of the desired product or service. Processing your data enables us, in particular, to guarantee adequate sales administration, to contact you as well as to prepare invoices and delivery notes etc.
Data categories: personal data (form of address, title, first name and surname); contact data (address, phone number, e-mail address), date of birth as well as, where appropriate, first name and surname as well as address of the contact person; ordering data (date, time, subject-matter of service, price, duration, etc.); payment information; other data (password, display name, operating data, member number).
Legal basis: our legitimate business interest is to provide the functions of a user account. Any data is hence processed under point (f) of Art. 6(1) GDPR.
Retention period: we retain your data as long as you have a user account with us or as long as this is required to provide the respective services. Your user account will be automatically deleted after a period of inactivity of 2 years. If you or we delete your user account, we will erase your data as well, unless we are required by law to keep it (data on your purchase orders must usually be kept for 7 years) or we need the data to assert/defend any claims.
Recipients: processor (web host), partner agencies, especially advertising agencies
3.4 Sending Press Mailing Lists, Newsletters, Other Marketing Information
General: on some of our websites, you may sign up for our press mailing list, our newsletter or any other marketing information. You will then receive our latest media releases as well as information about our products and offers automatically by e-mail. If you are already our customer, you receive our press mailing lists, our newsletters or any other marketing information automatically based on the existing business relationship (usually under sect. 174(4)(1.) TKG (Austrian Telecommunications Act) 2021) as well.
Purpose: if you sign up for a press mailing list, a newsletter or any other marketing information, we process your data to send you the corresponding information.
Data categories: contact data (e-mail address)
Legal basis: we process your data for the newsletter, the press mailing list and any other marketing information only if you have given your consent (under point (a) of Art. 6(1) GDPR, sect. 174 TKG). You may withdraw your consent to receive the newsletter, the press mailing list or any other marketing information at any time (see under clause 6 below).
Retention period: we retain your data as long as you have not withdrawn your consent to receive the newsletter, the press mailing list or any other marketing information.
Recipients: processor (web host), partner agencies, including, in particular, advertising agencies and sales partners
3.5 Contacting / Customer Service
General: you have various options to contact us (for example using our contact form, by mail, e-mail or phone).
Purpose: we process your data in order to handle your request and to communicate with you.
Data categories: personal data (form of address, first name and surname); contact data (address, phone number, e-mail address); data on your request (content of the request, data and time of the request)
Legal basis: our legitimate business interest is to handle customer requests. Any data is hence processed under point (f) of Art. 6(1) GDPR.
Retention period: we retain your data as long as this is necessary to handle your request. In the field of customer service, we basically retain your data for a period of one year, commencing at the time your request has been answered conclusively, unless we are required by law to keep this data or we need the data to assert/defend any claims.
Recipients: processor (web host)
3.6 Direct Marketing
General: if you register with us or make a purchase in our online shop, we also use your contact data to send you further information relevant for you on our products and services by e-mail or mail. In doing so, we may connect information about purchase orders and objects in your order basket, your online searches and views in our “BRAUUNION.PLUS / eazle” online shop, your customer requests and the contact history. If you have given us your consent to this effect, we will also provide you with information about products and services of other Heineken companies.
Purpose: this information enables us to tailor our marketing measures to your personal preferences.
Legal basis: our legitimate interest under point (f) of Art. 6(1) GDPR (own direct marketing) or your consent under point (a) of Art. 6(1) GDPR (direct marketing for Heineken companies). You may object to any promotional use of your data at any time using a corresponding link in the e-mails or by giving notice to the contact data set out above (e.g. by e-mail or letter).
Retention period: we retain your data as long as you have a user account with us, unless we are required by law to keep this data or we need the data to assert/defend any claims.
Recipients: processor (web host), partner agencies, including, in particular, advertising agencies and printing houses as well as delivery service providers
3.7 Participation in Sweepstakes, Surveys and Other Promotions
General: we process your personal data in the context of performing sweepstakes, competitions, other promotions and surveys you have participated in.
Purpose: we process your data as part of sweepstakes, competitions and promotions for the purpose of performing the sweepstake, competition or promotion and the prize notification. If you participate in one of our surveys, we use your data for market and opinion research. In principle, we evaluate the data in anonymised form for internal purposes. Detailed instructions, where appropriate, can be found in the terms and conditions of participation for the respective sweepstake, competition, promotion or survey.
Data categories: name, date of birth, address, e-mail address, phone number, additional data provided by you in the respective survey
Legal basis: legal bases of processing are points (a) and (b) of Art. 6(1) GDPR. You may withdraw your consent to participate in sweepstakes, surveys, competitions and other promotions at any time (see under clause 6 below).
Retention period: we retain your data as long as this is necessary to handle the sweepstake, promotion, survey or competition or we are required by law to retain this data.
Recipients: processor (web host), external agencies for handling sweepstakes/surveys/competitions/promotions
4. Cookies
We use cookies on our website. This enables us to ensure the operability of our website and to create analyses about the use of our website. Cookies are text files which are stored in or by the web browser on the user’s computer system. If a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a distinctive sequence of characters that enables unique identification of the browser the next time the website is accessed.
We use the “Real Cookie Banner” consent tool to manage the cookies used and similar technologies (tracking pixels etc.) and relating consents. Details on how “Real Cookie Banner” works can be found at devowl.io/knowledge-base/real-cookiebanner-data-processing. Legal bases for the processing of personal data in this context are points (c) and (f) of Art. 6(1) GDPR (legitimate interest is to manage the cookies used and similar technologies and the relating consents).
4.1 Operability of Our Website
The following cookies are required to ensure the operability of our website:
4.1.1 Google Tag Manager
Provider: Google Ireland Limited
Purpose: Google cookie to control the advanced script and event handling
Runtime: 2 years
4.1.2 Borlabs Cookie
Provider: Brau Union Österreich AG
Purpose: saves the visitors’ setting selected in the Cookie Box of Borlabs Cookie
Runtime: 1 year
Further information on these cookies can be found in our Cookie Information on our website.
4.2 Teads Pixel
Our website uses Teads True Visit / Teads Pixel, a website analysis and campaign analysis service of Teads SA, 5 rue de la Boucherie, L-1247 Luxembourg. The system is used to ensure that any and all processing operations of the arising data are carried out via the locally closest server, which means that no data will be transferred to the USA. Teads gathers the following technical data: current URL, auctid parameters, device, browser, OS.
Teads will utilise this information on behalf of the operator of this website to evaluate your use of the website, especially to establish whether the website user is known or unknown and to guarantee the best exclusion reach for the website operator in this way as well as to provide the Teads True Visit services.
Teads captures cookies only based on your consent.
More detailed information on terms of use and data protection by Teads is available at https://privacy-policy.teads.com/privacy-policy/european-privacy-notice/.
Further information on Teads can be found in our Cookie Information on our website.
4.3 External Media
If you visit our websites, we will initially not share any personal data with social networks (Facebook, Twitter, Vimeo, YouTube, SoundCloud). The plugin will be enabled and any direct contact of your browser with the social network will be possible only after you have given your consent. This allows us to prevent that any data will be transferred to and retained in the network without your knowledge.
Where you have given your consent, your data is processed as follows: giving consent and hence enabling the plugin make it possible to display you embedded contents from the social networks. In this way, the social network providers may also retain and/or retrieve certain information on your terminal and use it for web and marketing analyses as well.
More detailed information on this can be found here:
- Facebook: https://www.facebook.com/privacy/policies/cookies/?entry_point=cookie_policy_redirect&entry=0
- Twitter: https://help.twitter.com/de/rules-and-policies/twitter-cookies
- Vimeo: https://www.vhx.tv/cookies#:~:text=VIMEO%20OTT%20COOKIE%20POLICY%201%20COOKIE%20BA SICS%20A,YOUR%20COOKIE%20PREFERENCES%20…%204%20SIMILAR%20 TECHNOLOGIES%20
- YouTube: https://policies.google.com/privacy?hl=en-GB
- SoundCloud: https://soundcloud.com/pages/cookies/03-2018
5. Sharing Data
We may transfer your data to Heineken companies and to external service providers (processors, accountants, tax advisors, legal counsels) for the purposes set out in this Policy.
5.1 Data Sharing with Supervisory Authorities and Courts as Well as With Other Third Parties
Were are subject to a large number of legal regulations. It may happen that we must disclose your personal data to authorities or courts upon their requests. We respond to any requests of that kind only if we are required by law to do so. In all of these cases, we always pay attention to ensure that the statutory bases are complied with and your data remains protected.
6. Data Security
We use physical, technical and administrative measures to protect your personal data retained by us against any unauthorised access, collection, use, publication, reproduction, modification or erasure. All data you provide to us are retained on secure servers. If you have a password for accessing our website or app, you are responsible for keeping the password safe and secret.
7. Data Subject Rights and Option to Lodge Complaint
You basically have a right of access, rectification, erasure, restriction of processing, data portability and objection. Where the processing of your data is based on your consent, you may withdraw this consent at any time.
Please note that these rights are mutually exclusive or complementary to some extent:
You are basically entitled to a right of access to information on the origin, categories, retention period (where possible), recipients or categories of recipients and purpose of the data processed by us on your person or your business case and to know whether any automated decision-making in terms of Article 22 GDPR exists. Furthermore, you have a right of access to information about other data subject rights and options to lodge a complaint.
If we process any data on your person that is inaccurate or incomplete, you may obtain its rectification or completion.
You may also obtain the erasure of any data unlawfully processed. Please note, however, that this applies only to inaccurate, incomplete or unlawfully processed data. If it is unclear whether the data processed on your person is inaccurate or incomplete or processed unlawfully, you may obtain restriction of processing of your data until this question has been finally resolved. We kindly ask you to note that these rights are mutually complementary, with the result that you may only obtain either rectification or completion of your data or its erasure. Even if the data on your person is accurate and complete and lawfully processed by us, you may object to the processing of this data in special individual cases reasoned by you. You may likewise object if purchase and do no longer want to receive any direct marketing from us.
Where we have received from yourself any data processed by us on your person, you may receive this data in a machine-readable format determined by us or instruct us to directly transfer this data to a third party of your choice, where this recipient enables us to do this from a technical perspective and the data transfer is precluded neither by any unreasonable expenditure nor any statutory or other duties of secrecy or confidentiality considerations on our part or of third persons. You have the right not to be subjected to any decision that is exclusively based on automated processing. We do not use any automated decision-making without your prior consent.
For any concerns you may have, we kindly as you to contact us using the contact data set out above, always asking you to provide us with proof of your identity, for example by sending and electronic copy of your ID card.
Although we take our best efforts to ensure the protection and integrity of your data, disagreements over the manner in which we use your data cannot be ruled out. If you take the view that we use you data in any inadmissible manner, you have the right to lodge a complaint with the Austrian data protection authority.
Last update: 04/04/2023