Privacy Policy
for personal data processed in connection with this website

LAST REVISION: 02.04.2019

1. General Privacy Policy

The following Privacy Policy (the "Privacy Policy") incorporates our policy on the processing of your personal information that we collect through this website (the "Website").

Personal data is information that directly or indirectly refers to you as an individual ("Personal Information").

a. Coca-Cola Services NV, a company located at Chaussée de Mons 1424, 1070 Brussels in Belgium, is the controller and owner of the data collection (as defined by the Swiss Federal Data Protection Act, hereinafter "DPA") and is responsible for the processing Your personal data in connection with the Valser website (mentioned as "we", "us" and "our").

b. You may choose to view this Privacy Policy by clicking on the "Privacy Policy" link at the bottom of each webpage, on the social media page, and the app download page. You should carefully review this privacy policy.

c. You can navigate our pages and get to know many great things when you are on the pages, sharing content and participate in other site features. To learn how we use your personal information when you sign up for an account, please refer to this privacy policy. This privacy policy applies to all users of our pages, regardless of whether you are logged in.

2. What personal data do we collect about you?

a. Your personal information that we collect and process

We collect and process the following information about you:

· Surname;

· First name;

· Gender;

· Date of birth;

· Postal address;

· Telephone number (including private and mobile numbers);

· E-mail address;

· Public social media profile: Name, Handles, Photos, "Likes", Location, other public profile information;

· User-created content in social media: Photos, texts, videos, icons, hashtags, recordings that you share on social media;

· Location information;

· IP address

· Information about your device (e.g. screen size)

· Server log file information;

· Personal activity data (e.g. dates and times of activity on the relevant pages, frequency of visits to a website, links that are clicked on).

b. We request you not to submit or disclose any sensitive information on the website or otherwise.

"Sensitive Information" means personal information that relates to sensitive aspects, such as:

· racial or ethnic origin,

· political opinions,

· religious or ideological convictions,

· Health or health status,

· Criminal background,

· Union membership,

· Sexual orientation.

3. How do we collect your personal information?

We collect your personal information as follows:

· About the pages: We collect your personal data from the pages.

· Offline: We collect your personal information offline, if you, for example, contact our customer service.

· Use of cookies: We collect your personal information when you navigate the pages by using cookies. Our collection and processing of your personal data via cookies is subject to the Cookie Policy, which you should read carefully. You may accept or decline cookies (other than necessary cookies in accordance with the Cookie Policy) by checking or unchecking the relevant boxes in the Preference Centre available here.

The personal information you provide us through the sites will be associated with your personal information and other information that you provide to us (online or offline) or that we otherwise receive online or offline.

4. How do we use your personal information?

We use your personal information for the following purposes:

a. Answering your inquiries/administrative interactions

· To process your requests, questions and comments and to fulfil your wishes.

Legal basis for the processing: Our legitimate and overriding interest in processing your requests.

· To provide you with administrative information, such as information about the sites, changes to our Terms and Conditions and changes to this Privacy Policy.

Legal basis for the processing: Our legitimate and overriding interest in promptly informing you about the development of our sites, the changes to our Terms and Conditions, and the changes to this Privacy Policy.

b. Data analysis to derive trends and improve Valser products and services

We collect your personal information in an aggregated form in order to understand your interaction with the website (e.g. how, when and on which device you use our website) and our marketing communications (e.g. whether you open our communications, which links you click), and to derive general consumption trends and patterns from this analysis. This analysis helps us to get to know the users of the website better and to adapt our website to the identified preferences of the users. It basically helps us to tailor Valser products and services to the general preferences of users.

Legal basis for the processing: our overriding and legitimate interest in making this website available to you and to further improve and develop this website.

c. Competitions, prize draws, surveys and other special offers/promotions

We will be offering contests, prize draws, surveys and similar special offers and promotions through the Website, which may require online registration (including your email address). If you register for a competition, sweepstake, survey or any other special offer/promotion or win something, we ask you for specific personal information to complete the steps involved in that event and to be able to inform you.

Legal basis for the processing: the fulfilment of the contract resulting from the participation in competitions, prize draws, surveys and other special offers/promotions based on the terms and conditions of the promotion.

Please read carefully the terms and conditions (including any specific privacy policy) of any contests, prize draws, surveys, or other special offers/promotions you participate in through the website, as they may contain other important information about the use of your personal information by us or a sponsor.

If these terms and conditions related to your personal information do not match those listed in this privacy policy, the former will prevail.

e. IT-Administration

· We use your personal information to identify server issues, manage website, and ensure that they work properly.

Legal basis for the processing: Our legitimate and overriding interest in managing our IT systems and networks to ensure their proper functioning.

f. Transactions

If you make a transaction through the website, such as the purchase of merchandise from Valser and affiliated brands, we collect the payment information you provide for that transaction, along with other personal information, such as the address to which the purchased products are shipped. We use your personal information to process the transaction and your purchase.

Legal basis for the processing: The processing of your personal data to conclude transactions is based on the execution of your purchase agreement.

g. Compliance with our legal obligations

· To comply with our legal obligations, legal processes, or dispositions of governmental agencies, which may include mandatory dispositions by governmental authorities outside your country of residence, if we are required by law to do so, and if it is essential to disclose your personal information in order to comply with such obligations, legal procedures or dispositions.

Legal basis for the processing: Compliance with our legal obligations.

g. Lawful protection of our interests

· To properly enforce our Terms and Conditions in order to protect our activities or those of our affiliates, to protect our rights, privacy, safety or property and/or that of our affiliates, and to enable us to use available remedies.

Legal basis for the processing: Protecting our legitimate and overriding interests in order to protect our business.

h. Corporate Activities/Mergers and Acquisitions

· To restructure, merge, dispose of, enter into a joint venture, assignation, transfer or other disposal of any or all of our business activities, assets or stock (including in connection with bankruptcy or similar proceedings).

Legal basis for the processing: Our legitimate and overriding interests in implementing our corporate strategy.

5. Which profiling do we do?

a. We use your personal information to automatically generate a score and profile using the Google UID. This scoring and profiling is done to achieve the following purposes described in Part 4 of the Privacy Policy: (i) data analysis relating to your activity on the website and (ii) data analysis using your public social media profile and shared content.

b. This profiling has no legal implications for you and does not affect your experience on the website. There is no monitoring or tracking of your individual behaviour, activities or movements, in any way whatsoever. It is used only to help us understand the preferences and behaviours of our site users in general, and to improve the website, Valser products, and Valser services with the help of this analysis.

6. To whom are your personal data disclosed?

Your personal information is disclosed to the following recipients:

a. Valser Mineralquellen GmbH, Camp 519, 7132 Vals, Switzerland

b. Coca-Cola Schweiz GmbH, Brüttisellen

c. Voice Kienast, Zurich, a company that helps us manage our services.

d. Coca-Cola  HBC Schweiz AG, a company that helps us manage our services.

e. [Kju:] digital solutions, Vienna, Austria, a company that helps us manage our services.

f. Adobe Managed Services, hosting our IT systems and system support;

g. APIGEE Edge-Plattform, hosting our IT systems and system support;

h. Amazon Web Services (AWS) EC2, hosting our IT systems and system support;

i. CI&T, hosting our IT systems and system support

j. EPAM responsible for CID programming

k. ExactTarget, supports our IT system and perform data analysis for the purposes described in the Privacy Policy;

l. Gigya, hosting our IT systems and system support;

m. Google, supports our IT system and perform data analysis for the purposes described in the Privacy Policy;

n. ICP, Content Management Services for DMeX

o. Livefyre, hosting our IT systems and system support;

p. Janrain, hosting our IT systems and system support;

q. MicroStrategy, hosting our IT systems and system support;

r. Qualtrics, hosting our IT systems and system support;

s. SalesForce, hosting our IT systems and system support;

t. SessionM, hosting our IT systems and system support;

u. WordPress, hosting our IT systems and system support;

v. If necessary or appropriate, to the relevant authorities, affiliates and third parties: (a) to comply with our legal obligations; (b) to respond to binding requests from public and governmental authorities, which may include public and governmental authorities outside your country of residence; (c) to enforce our terms and conditions; (d) to protect our business and that of our affiliates; (e) to protect our rights, privacy, security or property and/or the security or property of our affiliates; and (f) to enable us to use available remedies.

7. Websites of third parties/service providers

This Privacy Policy does not affect the processing and privacy practices of any third party, including third parties that operate any website linked to these sites, and we are not responsible for the data used by such third parties. The inclusion of a link to another website on our sites does not mean that we or our affiliates support the linked webpage.

Please note that the sites may contain links, in particular, to e-commerce websites, including e-commerce websites carrying Valser branding. This Privacy Policy does not apply to any e-commerce websites that have Valser branding and that may be linked to these sites. Any personal information you provide through the e-commerce website is the subject of the privacy policy of that e-commerce website and not this privacy policy. We have no control over the use of personal information collected through the e-commerce website and are not responsible for it.

In some cases, we may use a third party payment service to process purchases and/or receive donations made through these sites. In these cases, your personal information may be collected by this third party and is subject to their privacy policy, rather than this privacy policy. We have no control over the use or disclosure of your personal information by these third parties and are not responsible for them, and these third parties or websites are not supported by us. We make no representations regarding the accuracy, completeness, timeliness and adequacy of information in the privacy statements of these third parties. You are responsible for carefully reading the privacy statements on third party websites before you use them.

8. Third party advertising

Please note that our online and e-mail advertisers may use Pixel Tags, Web Beacons, Clear GIFS or other site-related techniques to help us conduct our online and email advertising campaigns and to increase the effectiveness of such campaigns. If a provider, for example, has set a cookie on your computer, the provider may use Pixel Tags, Web Beacons, Clear GIFS or other techniques to recognize the cookie while you visit the sites and to know which of our online advertisements has directed you to our sites, and the provider may provide us with other information that is useful to us. Please note that we may associate this other information provided by our providers with your personal information that we collected earlier.

9. What are your rights related to the processing of your personal information, how can you exercise them and how can you contact us?

a. Your rights regarding the processing of your personal data

You have the right:

· to be informed about your personal information processed by us

· to receive a copy of your personal information that we keep;

· to ask us to complete your personal information or to update/correct any inaccurate personal information;

· to demand that we stop processing your personal information for direct marketing purposes.

· to ask us to communicate your specific personal information or to transmit it, or to transfer it to a responsible person.

Under certain circumstances, you also have the right:

· to ask us to delete your personal information; and

· to limit our processing of your personal information.

b. The exercise of your rights

If you wish to exercise any of the above rights, you may contact us using one of the options below.

· You can send us an e-mail to the following address: info@valser.ch

· You can call us at: 0848 80 8000

· You can write us at the following postal address: Coca-Cola Schweiz GmbH, Stationsstrasse 33, 8306 Brüttisellen

c. Right to contact the relevant data protection authority

You have the right to contact the relevant data protection authority, in particular the Federal Data Protection and Information Commissioner, if you consider that the processing methods are of such a nature as to infringe your personal rights and the rights of a large number of people.

d. Contact details of our data protection officer (DSB)

You can contact our Data Protection Officer (DSB) at the following address: info@valser.ch

10. How long do we store your personal information?

a. We want to store your personal information correctly and keep it up to date. We will delete your personal information when we no longer need it for business purposes.

b. We will store your personal information used for the purposes of this Privacy Policy for a maximum of 2 years, except for cases where it is required by law to store your personal data for a longer or shorter period.

c. To know how long we keep cookies in your devices, please refer to our [Cookie Policy].

11. Use of pages by minors and warnings for parents

a. The sites are intended for persons aged 13 years and older, with the consent of their parents until the age of 18 years. We do not want people under the age of 13 to provide personal information through these sites. We reserve the right to solicit proof of parental consent at any time to allow the processing of personal data relating to minors.

For some sites or apps, there may be age restrictions on what is appropriate for a particular age group and what is legally permitted. As far as specific age restrictions apply, this is clearly indicated on each site and we can ask questions to check your age before we process the information.

12. In which cases do we transfer personal information outside the European Economic Area?

In order to fulfil the purposes stated in this privacy policy, we may transfer your personal data to countries outside Switzerland and the European Economic Area ("third countries"), like the US, where we believe that they do not provide an adequate level of protection within the meaning of Article 6 of the Swiss Federal Data Protection Act (DPA).

If we transfer your personal information to third countries that do not provide an adequate level of protection, our data transmission will be subject to the following reasonable safeguards in relation to the DPA, in order to ensure that your personal information is adequately protected:

- Standard data protection clauses, adopted by the EU Commission (click here for access to the decision of the EU Commission on standard contractual clauses for the transfer of personal data in third countries); and

- Switzerland-US Privacy Shield for transmission to companies in the United States (click here for the Switzerland-US Privacy Shield).

To obtain relevant information regarding the transfer of your personal data to third countries (including the relevant transfer mechanisms), please contact our data protection officer at this address info@valser.ch

13. Applicable Law

This Privacy Policy is governed by the laws of Switzerland.

14. Updates to this Privacy Policy

a. You can find out when this Privacy Policy was last changed by checking the "LAST REVISION" entry on the first page.

b. All amendments considered to this Privacy Policy will be communicated to you well in advance, before the changes actually take effect.

You may print, download or store a copy of this Privacy Policy (and the revised versions) for your records.