PRIVACY POLICY

Patrón Spirits International AG
6380 S. Valley View Blvd., Suite 210
Las Vegas, Nevada 89118

This privacy policy (the “Privacy Policy”) sets forth a description of practices related to personal data privacy and security of Patrón Spirits International AG and its successors, parents, subsidiaries, affiliates and related companies or other companies under common control that we have now or may operate in the future (the “Company,” “we,” “our,” or “us”).

The Company provides to its employees, distributors, retailers, consumers and other business partners a master class, Academia Patrón (“AP”), which provides educational resources regarding the Company’s products. The singular term “Website” includes (1) the AP website and all related websites and all related devices or applications that collect personal information from you that we have now or in the future operate that link to this Privacy Policy, web pages within each such website, device, or application; and (2) any equivalent, mirror, replacement, substitute, or backup website, device, or application and web pages that are associated with each such website, device or application.

In addition to this Privacy Policy, we have established Terms and Conditions that set forth the general rules and policies governing your use of the Website. A copy of the Terms and Conditions can be found here.

The Company is committed to protecting your personal data. We provide this Privacy Policy to explain the type of information we collect on the Website and how that information is used.

Please note: The laws and regulations in different countries impose different (and even conflicting) requirements on the Internet and data protection. The servers that make the Website available worldwide are located in the USA. Please note that any information you provide will be transferred to the USA, as further described below.

By using the Website and/or providing us your personal information, you signify your acknowledgement of this Privacy Policy. If any term in this Privacy Policy is unacceptable to you, do not provide us your personal information or use the Website.

I. INFORMATION WE COLLECT ABOUT YOU AND HOW WE COLLECT IT

Access to Website

You may access and use the Website and the services available on the Website only if you are at least the minimum legal age to purchase alcoholic beverages in the jurisdiction in which you are located. In order to confirm that you are of legal age, you will provide us with your date of birth and country of residence. We do not knowingly collect any further information from individuals who are under the minimum legal age in their countries of residence. If you believe we might have any information from or about a child under the age of 16, please contact the data controller (contact information provided below).

You also may provide information to be published or displayed on public areas of the Website, or transmitted to other users of the Website or third parties. These posts and contributions are posted and transmitted to others at your own risk. We cannot control the actions of other users of the Website with whom you may choose to share your posts and contributions.

Registration Information

When you register with the Website, you will be asked to provide the Company with personal information related to your coursework or the event you will attend. This may include your name, email, address, and information about your place of work. The Company will use this information to provide a personalized certificate upon completion of the Master Class, to communicate with you regarding event details, to track details of course completion, and/or in the aggregate for internal reporting on Website usage by region. You can elect to receive information and updates on our products and services, as well as those of our subsidiaries, affiliates, and parent companies and any of their related businesses, as well as those of our third-party partners. We use your return email address to answer the email that we receive, and we may use your return email address to send you other information. Such addresses are not used for any other purpose.

Cookies and Other Tracking Devices

The Company uses cookies on the Website. Cookies are small text files that are stored on the hard drive of your computer or on your mobile device when you visit our Website. Cookies include information such as language preferences, so that such information does not have to be re-entered when visiting the Website again. Some cookies ensure that the graphics of the Website are displayed correctly, and other cookies ensure that the Website runs smoothly. We use cookies to make your future activities go faster or to enhance your experience on the Website by recalling information that you already made available to us.

Some of our business partners also use such data to provide us with aggregated data in an anonymous form regarding the use of our Website.

We use cookies to: track, report, retarget (i.e., behavioral ad retargeting/remarketing), and communicating with users who opt-in to email communications; personalize our site /application (or “app”) to you. For example, to try to ensure that language and region displays are correctly configured for you; improve our site / app. For example, knowing how our users navigate our site / app and use its features allows us to streamline the user experience, speed up searches, identify bugs, make enhancements and, ultimately, get you to the right page and product faster; estimate our audience size and usage pattern; collect aggregated information in an anonymous form about the websites from which users have travelled to our site / app; store information about any preferences that you set, so we can do things like greet you personally and speed up your log-in when you come back to our site / app; and identify which of your device(s) you use to access our site / app or any account that you have registered on it.

The cookies we use: may persist on your device between visits to our site / app, so that, for example, we can identify you when you visit again; and may be provided either by us or by third-party service providers (such as analytics and search engine providers).

If you don’t want the Website to store cookies on your computer, you can use the opt-out tools provided below or adjust the corresponding browser settings (please also see Section V regarding disclaimers):

Internet Explorer: http://windows.microsoft.com/en-US/windows-vista/How-to-manage-cookies-in-Internet-Explorer-9 Chrome: http://support.google.com/chrome/bin/answer.py?hl=en-GB&hlrm=nl&answer=95647 Firefox: http://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences?s=cookies&r=5&as=s Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

When you deactivate cookies, please note that some graphics may not be displayed correctly or that you may not be able to use some applications.

Do Not Track

We may, and we may allow third party service providers and other third parties to use cookies or other technologies on our Website that collect information about your browsing activities over time and across different websites following your use of the Services. Do Not Track (“DNT”) is an optional browser setting that allows you to express your preferences regarding tracking across websites. We currently only respond to DNT signals relating to tracking/profiling (e.g., targeted advertising cookies).

Below you will find a detailed list of the first-party and third-party cookies that we could use on our Website:

FIRST PARTY COOKIES

Name of Cookie Purpose Duration
_mayo_session Remembers if a user has signed in so they are not required to go through the process again. Cookie does not expire, but becomes invalid after 2 weeks when the remember_user_session token expires.
gate Denotes whether a user is over 18. 1 day (unless user clicks “remember me” when verifying age, then 6 months).
remember_user_session Token used to remember a user after logging in. Expires after 2 weeks and user must login again.

THIRD PARTY COOKIES

Name of Cookie Purpose Duration
_ga Used to distinguish users. 2 years
_gid Used to distinguish users. 24 hours
_gat Used to throttle request rate. If Google Analytics is deployed via Google Tag Manager, this cookie will be named _dc_gtm_. 1 minute

II. HOW WE USE AND SHARE THE INFORMATION COLLECTED

The processed personal information is limited to the data that is necessary for carrying out the purpose for which such personal information is collected. We use information collected from you in the following ways:

We use information collected for internal user activity and marketing analysis, for example, to assess trends amongst our consumers or to measure the amount of traffic to the Website, based on our legitimate interest in improving our marketing analysis and promoting the Company’s position in the market. We also share non-personal information with others, such as advertisers, in an aggregated, anonymous form, which means that the information will not contain any personally identifiable information about you.

We use your personal information in order to communicate with you about our products and services and those of our subsidiaries, affiliates, and parent companies and any of their related businesses, and those of our third-party partners based on our legitimate interest in communicating with our customers about their requests or, where required, based on your specific consent.

We arrange for selected companies who provide services such as marketing and promotion to send you information that may be of interest to you if you have elected to receive such information, based on your specific consent. In such circumstances, your personal information will be disclosed to these organizations who will agree to be bound by the terms of this Privacy Policy. We will obtain your permission (e.g., opt-in consent) before we send you any such communications.

In the event of a sale, merger, consolidation, change in control, transfer of substantial assets, reorganization, or liquidation, we may transfer, sell, or assign to third parties information concerning your relationship with us, including, without limitation, personally identifiable information that you provide and other information concerning your relationship with us, based on our legitimate interest to conduct and develop our business.

We only transfer your personal information to third parties under confidentiality obligations for the performance of services provided to us, including third-party providers of services related to the operation and management of the Website, or in connection with the administration and support of the activities noted above (e.g., the administration of a marketing campaign). Third-party providers of services will only receive personal data according to the purposes of the service agreement concluded with us.

We may disclose your personal information if permitted by law or required to do so by law or where we believe such action is necessary in order to protect or defend our interests or the interests of our customers or users of the Website.

Your personal data will be processed based on our legitimate business interests described above and only as long as our legitimate interests are not overridden by your interests or fundamental rights and freedoms or if you have given your consent to a specific data processing activity, as set out above. The Company ensures that its internal governance procedures clearly specify the reasons behind decisions to use personal information for alternative processing purposes. Prior to using personal information for a purpose other than the one for which it was initially collected, data subjects will be informed about such a new purpose.

We have put in place all appropriate physical, electronic, and managerial procedures to safeguard the personal data and other type of information we collect. We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, with such risk analysis including an analysis of the risk compromising the rights of a data subject, costs of implementation, and the nature, scope, context and purposes for data processing.

The measures include, as appropriate: encryption of personal data where applicable/appropriate; the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. The Company will only grant access to your personal data to the following categories of recipients: (i) subsidiaries, affiliates and related companies or other companies under common control that we have now or in the future operate; (ii) service providers (for example, the website service provider) and (iii) marketing agencies who carry out marketing on behalf of the Company with your consent. The Company will only grant access to your personal data on a need-to-know basis, and such access will be limited to the personal data that is necessary to perform the function for which such access is granted.

III. YOUR RIGHTS AS A EUROPEAN DATA SUBJECT WITH REGARD TO YOUR PERSONAL DATA

If your personal data is collected within the European Union, you may at any time exercise certain rights you may have under applicable law and regulations, including the following rights:

The right to request access to your personal data, which includes the right to obtain confirmation from us as to whether or not personal data concerning you is being processed, and where that is the case, access to the personal data and information related to how it is processed.

The right to rectification or erasure (“right to be forgotten”) of your personal data, which includes the right to have incomplete personal data completed, including by means of providing a supplementary statement, and certain rights to request that we erase your personal data without undue delay.

The right to restrict or object to processing your personal data, which includes restricting us from continuing to process your personal data under certain circumstances (e.g., where you contest the accuracy of your personal data, where the processing is unlawful, where your personal data is no longer needed for the purposes of processing, or where you have otherwise objected to processing related to automated individual decision-making).

The right to data portability, which includes certain rights to have your personal data transmitted from us to another data controller.

Where data processing is based on your consent, you have the right to withdraw consent at any time.

The right to lodge a complaint with a supervisory authority.

In some countries, the right to give us instructions about how to handle your personal data in the event of your death.

Any requests related to the above rights may be made by filling out our Form or sending an email to privacy@patronspirits.com.

Data collected based on our legitimate business interests will be retained for as long as permitted by law. Any first-party cookies used will be erased after thirteen (13) months, unless your consent is renewed.

Unless otherwise required by law, the Company will, in any event, erase personal data when it is no longer necessary in relation to the purposes for which was collected or otherwise processed; when you withdraw your consent (where lawfulness of processing was based on your consent) and there is no other legal ground for the processing; when you object to the processing and there are no overriding legitimate grounds for the processing; when your personal data has been unlawfully processed; and when it is necessary to comply with legal obligations.

V. THIRD-PARTY WEBSITES

The Website and Privacy Policy may contain links or references to other websites that are outside of our control. Please be aware that this Privacy Policy does not apply to these websites. Additionally, the Website includes functionality that may allow for the integration with third-party websites, such as Twitter, Facebook, or other social networks, that allow you to share information, rich media, and other content, including your information, with such third-party websites, and you may be permitted to export information concerning your use of the Website to such third-party websites. Some of those third-party services provide us with your information to enhance and personalize your use of the Website. If you submit your credentials (e.g., username and password) for a third-party website or service during your registration for the Website or in connection with updating your user profile, we may receive your information from such third-party website or service. The Company encourages you to read the privacy statements and terms and conditions of linked or referenced websites you enter. These third-party websites may send their own cookies and other tracking devices to you, log your IP address, and otherwise collect data or solicit personal information. THE COMPANY DOES NOT CONTROL AND IS NOT RESPONSIBLE FOR WHAT THIRD PARTIES DO IN CONNECTION WITH THEIR WEBSITES, OR HOW THEY HANDLE YOUR PERSONAL INFORMATION. PLEASE EXERCISE CAUTION AND CONSULT THE PRIVACY POLICIES POSTED ON EACH THIRD-PARTY WEBSITE FOR FURTHER INFORMATION.

VI. ACCESS TO, MODIFICATION OF, AND CORRECTION OF YOUR PERSONALLY IDENTIFIABLE INFORMATION

You may opt-out of marketing communications at any time. Following registration, you may request that we provide you the information we hold about you, update your information, or ask us to remove your information (including, for example, to opt-out of marketing), or to correct any inaccuracies in such personal data by sending an email to academia@patronspirits.com. We will use reasonable efforts to deal with your request within a reasonable time.

VIII. YOUR CALIFORNIA PRIVACY RIGHTS

Residents of the State of California have the right to request from certain businesses with whom the California resident has an established business relationship a list of all third parties to which the business, during the immediately preceding calendar year, has disclosed certain personally identifiable information for direct marketing purposes. We are only required to respond to a customer request once during any calendar year. To obtain this information, you should send a request to academia@patronspirits.com with the subject heading “California Privacy Rights.” In your request, please attest to the fact that you are a California resident and provide a current California address for our response. Please be aware that not all information sharing is covered by the California Privacy Rights requirements, and only information on covered sharing will be included in our response.

IX. WHERE WE STORE YOUR PERSONAL DATA AND INTERNATIONAL DATA TRANSFERS

The personal data that we collect from EU users will may be transferred to and stored at a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. We will ensure that when personal data is transferred to countries that have different standards of data protection, appropriate safeguards to adequately protect the personal data are implemented to enable such data transfers in compliance with applicable data protection laws. We have implemented Data Transfer Agreements based on EU model clauses to cover international data transfers and EU users can obtain a copy of these agreements by contacting the Company, at privacy@patronspirits.com

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

X. REVISIONS TO OUR PRIVACY POLICY

We reserve the right to change the Privacy Policy at any time. Please review the contents of the Privacy Policy frequently, as the Company may amend them from time to time to reflect changes in its services and policies relating to data privacy. Amendments will become effective when posted on the Website. The Company will provide notice of any changes in the Privacy Policy via the Website. It is your responsibility to monitor and review any updates to the Privacy Policy. Your continued use of the Website, or online services provided by the Company, after such posting will be deemed your acknowledgement of these changes to the Privacy Policy.

XI. DATA CONTROLLER & CONTACT INFORMATION

The Company entities responsible for the collection and use of your personal information (the data controllers) for the purposes described in this Privacy Policy are listed below and can be contacted for any clarification or additional information you may need in order to fully understand this Privacy Policy:

XII. EFFECTIVE DATE OF POLICY

This Privacy Policy is effective and was last updated on February 19, 2019.