In accordance with Art. 21 GDPR, you have the right to object to the processing of personal data at any time. We will then no longer process the personal data for direct marketing purposes or any related profiling. We will also not process your personal data for other purposes following an objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims (cf. e.g., Art. 21 para. 1 GDPR, so-called “limited right to object”). In this case, you must state grounds for the objection arising from your particular situation. You may also object, on grounds relating to your particular situation, to the processing of your personal data carried out for scientific or historical research purposes or statistical purposes pursuant to Art. 89 para. 1 GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest (cf. Art. 21 para. 6 GDPR). We will also draw your attention to the right to object separately in the individual sections (e.g., by the note: “You have a right to object”), provided this right exists. There you will also find further information on exercising your right to object. In order to keep the following privacy policy clear, we refer at various points via links to information and privacy notices located on external websites (cf. also section “Social Networks & External Links” in this privacy policy). We make every effort to keep the links listed in this privacy policy up to date. However, due to the constant updating of websites, it cannot be ruled out that links may not function correctly. Should you notice such a link, we would be pleased if you would inform us so that we can implement the current link. 2) Controller The controller within the meaning of Art. 4 No. 7 GDPR for the processing of personal data is: Splendid Drinks AG 17, rue de Flaxweiler L-6776 Grevenmacher Luxembourg Phone: +3 52 / 28 26 16-0 Email: info@splendid-drinks.com 3) Contact Person for Data Protection For questions regarding the processing of your personal data, as well as your rights regarding data protection, please contact: Boris Reibach, LL.M. Scheja und Partner Rechtsanwälte mbB Adenauerallee 136 53113 Bonn Phone: +49 (0) 228 227226-0 Fax: +49 (0) 228 227226-26 www.scheja-partner.de Encrypted contact form: https://www.scheja-partner.de/kontakt/kontakt.html 4) Log Files Every time you access our website, we automatically collect data and information from your device’s system and store it in so-called server log files. This data consists of information relating to an identified or identifiable natural person (here: website visitor). The data is automatically transmitted by your respective browser when accessing our website. This includes the following information:

• The time of accessing our website (request to the host provider’s server),
• URL of the website from which you accessed our website,
• the operating system you are using,
• type and version of the browser you are using,
• IP address of your computer.

The purpose of this processing is to ensure the accessibility of our website from your device and to enable a correct display of our website on your device or in your browser. Furthermore, the data serves us to optimize our website and to ensure the security of our systems. An evaluation of this data for marketing purposes does not take place. The legal basis for processing is Art. 6 para. 1 lit. f) GDPR. We have a legitimate interest in presenting a website optimized for your browser and enabling communication between our server and your terminal device. For the latter, the processing of your IP address is particularly necessary. The processed information is only stored for as long as necessary for the intended purpose or as required by law. The recipient of the data is our server host, who acts on our behalf within the framework of a data processing agreement. Right to Object You have a right to object. You can send or communicate your objection to us at any time (e.g., by email to datenschutz@splendid-drinks.com). The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide it could mean that you cannot use our website or cannot use it to its full extent. 5) Cookies Our website uses cookies. Cookies are text files that are stored on your device to, for example, make the use of a website more convenient or to recognize the user’s device and store settings or similar. Inputs and settings on a website can be stored in cookies so that you do not have to enter or set them again with each new visit to a website. Cookies contain a so-called cookie ID, which allows an allocation of the device in which the cookie was stored. In detail, we use the following cookies:

• Cookies containing a randomly generated, specific identification number that makes you or your device identifiable during your visit to our website. These cookies are automatically deleted at the end of your visit.
• Cookies containing a randomly generated, specific identification number that makes you or your device identifiable on our website. You can find the storage duration either in the overview below or determine it via your browser by displaying the cookies (usually by clicking on the “i” next to the address bar, e.g., in Firefox or Google Chrome).

In particular, the following cookies are set by us and by services we use:

Cookie	Provider/ Service	Expiration Time	Description
_ga	Google Analytics	2 years	Used for statistical recording by Google Analytics.
_gat	Google Analytics	One minute	Limits the data collected by Google Analytics in case of high traffic.
_gid	Google Analytics	Two days	User identification

You can display all cookies set by us on the respective website and further information about them (e.g., storage duration) at any time via your browser. The purpose of processing cookies directly set by us is to design the use of our website conveniently for you and to offer the possibility to save settings. Further descriptions of purposes can be found with the respective services. The legal basis for the processing of cookies is Art. 6 para. 1 lit. a) and lit. f) GDPR. We have a legitimate interest in presenting a website that stores your personal settings and facilitates your visit to our website. You have a right to object. In your browser settings, you can restrict or completely prevent the setting of cookies. You can also arrange for the automatic deletion of cookies when closing the browser window. You can learn how to delete cookies in the most common browsers and change cookie settings here, among other places: Google Chrome: Website Mozilla Firefox: Website Microsoft Internet Explorer: Website The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide it could mean that you cannot use our website or cannot use it to its full extent. Other services used by us may also use cookies. We point out the use of cookies separately for the individual services. 6) Information on Google Services We use various services of Google Ireland Limited (“Google”) on our website. This is an affiliated company of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Further information on the individual specific services of Google that we use on this website can be found in the subsequent privacy policy. By integrating Google services, Google collects information (including personal data) and processes it. It cannot be ruled out that Google also transmits the information to a server in a third country. Insofar as Google transmits information to a third country within the scope of a data processing agreement (e.g., when using Google Analytics), the Standard Contractual Clauses apply, cf. https://privacy.google.com/businesses/processorterms/ No. 10.2). Google’s server locations can be viewed at https://www.google.com/intl/en/about/datacenters/locations/. We ourselves generally cannot influence what data Google actually collects and processes. However, Google states that, in principle, the following information (including personal data) among others can be processed:

• Log data (in particular the IP address)
• Location-related information
• Unique application numbers
• Cookies and similar technologies

Information on the types of cookies used by Google can be found at https://policies.google.com/technologies/types. If you are logged into your Google account, Google may add the processed information to your account depending on your account settings and treat it as personal data. Google states the following on this: “When you’re not signed in to a Google Account, we store the information we collect with unique identifiers tied to the browser, app, or device you’re using. This helps us do things like maintain your language preferences across browsing sessions. When you’re signed in, we also collect information that we store with your Google Account, which we treat as personal information.” (https://policies.google.com/privacy?hl=en). You can prevent a direct addition of this data by logging out of your Google account or by configuring the corresponding account settings in your Google account. Furthermore, you can change your cookie settings (e.g., delete, block cookies, etc.). Further information can be found in Google’s privacy policy, which you can access via the link above. 7) Use of Google Analytics

We use Google Analytics on our website. Google Analytics uses so-called “cookies”, text files that are stored on your device and enable an analysis of the use of the websites visited by you. Google Analytics also uses so-called web beacons (invisible graphics). Through these web beacons, information such as visitor traffic on websites can be evaluated. The information generated by cookies and web beacons about the use of our website (including the users’ IP address) is transmitted to a Google server, possibly in the USA or other third countries, and stored there. This information may be passed on by Google to contractual partners of Google. Information on the existing transmission of data to third countries, the use of Standard Contractual Clauses, and further information on Google services can be found in this privacy policy under the section “6) Information on Google Services”.

The following data types are processed by Google:

• Online identifiers (including cookie identifiers)
• Internet Protocol addresses (anonymized only)
• Device identifiers

In addition, you will find further detailed information on the processed information at https://policies.google.com/privacy?hl=en as well as at https://privacy.google.com/businesses/adsservices/ We only use Google Analytics with activated IP anonymization (“anonymize IP”). As a result, your IP address is shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Furthermore, we have concluded a data processing agreement with Google for the use of Google Analytics (Art. 28 GDPR). Google processes the data on our behalf to evaluate your use of the website, to compile reports on website activity for us, and to provide us with other services related to website and internet use. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the data on Google’s behalf. Within the scope of data processing, Google is authorized to commission subcontractors. A list of these subcontractors can be found at https://privacy.google.com/businesses/subprocessors/. Google Analytics enables us to determine which persons and groups of people visit our website and how they interact with our website. The processing of the data pursues the purpose of understanding the success of various campaigns, optimizing our website and online sales, presenting interest-based content to our visitors even beyond our shop, improving our productivity, and analyzing user behavior on our website so that we can react to the market quickly and effectively. The legal basis for the processing of personal data described here is your consent pursuant to Art. 6 para. 1 lit. a) GDPR. Right of Withdrawal You have the right to withdraw your consent at any time without giving reasons, without affecting the lawfulness of processing based on consent before its withdrawal. To do this, you can either deactivate Google Analytics in our consent tool “Usercentrics” (found via the green button (Privacy Chip) in the right corner of the website, under “Analysis”) or install an add-on via https://support.google.com/analytics/answer/181881?hl=de that prevents tracking via Google Analytics (Note: only available for Google Chrome). The processed information is stored for 12 months and automatically deleted after this retention period expires. For further detailed information on data handling in connection with Google Analytics, please refer to Google’s privacy policy: https://support.google.com/analytics/answer/6004245 The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide it could mean that you cannot use our website or cannot use it to its full extent.

8) Use of Google Web Fonts We use external fonts, so-called Google Fonts from Google, on our website. The integration of web fonts takes place via an interface (“API”) to Google services. By integrating web fonts, Google may collect information (including personal data) and process it. It cannot be ruled out that Google also transmits the information to a server in a third country. Information on the transmission of data to third countries, the use of standard clauses, and further information on Google services can be found in this privacy policy under the section “6) Information on Google Services“. We ourselves do not collect any data within the scope of providing Google Fonts. By integrating Google Fonts, we pursue the purpose of being able to display uniform fonts on your device. The legal basis for the processing of personal data described here is Art. 6 para. 1 lit. f) GDPR. Our required legitimate interest lies in the great benefit offered by a uniform presentation of fonts. By enabling a uniform display, we keep the design effort lower than if we had to respond to font standards of different operating systems or browsers with our own graphically adapted websites. Furthermore, Google has, among other things, a legitimate interest in the collected (personal) data in order to improve its own services. Right to Object You have a right to object. You can send or communicate your objection to us at any time (e.g., by email to datenschutz@splendid-drinks.com). The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide it could mean that you cannot use our website or cannot use it to its full extent, and the appearance of the website may change. Further information can be found in Google’s privacy policy, which you can access here:

• google.com/fonts#AboutPlace:about
• https://developers.google.com/terms/
• google.com/policies/privacy/

Information on Google’s privacy settings can be found at https://privacy.google.com/take-control.html?categories_activeEl=sign-in 9) Contacting Us You have the opportunity to contact us by phone or email. If you contact us via this option, your phone number or email address and the information resulting from the respective message text will be processed by us. The purpose of processing your phone number or email address is to process the contact request and to be able to contact the enquirer to answer the request. The legal basis for the processing of personal data described here is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest is to offer you the opportunity to contact us at any time and to be able to answer your inquiries. The personal data will be deleted as soon as they are no longer necessary to achieve the purpose of their collection. Right to Object You have a right to object. You can send or communicate your objection to us at any time (e.g., by email to datenschutz@splendid-drinks.com). The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide it could mean that you cannot use the option to contact us. 10) Applications We also offer you the opportunity on our website to apply for job vacancies and send us your application by email. If you contact us via this option, your email address and the information resulting from the respective message text as well as the application itself will be processed. The purpose of processing your email address is to process the application and to be able to contact the applicant to answer the request. The purpose of processing the personal data resulting from the application documents sent by you is to be able to determine a suitable applicant. The legal basis for processing your email address is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest is to offer you the opportunity to contact us at any time and to be able to answer your inquiries. The legal basis for the processing of personal data resulting from the application is Art. 6 para. 1 lit. b), Art. 88 para. 1 GDPR, § 26 para. 1 BDSG-new. The application email and the transmitted documents will be kept until a decision has been made for or against the applicant and will be deleted thereafter. Insofar as we base the processing of your data on our legitimate interest, you have a right to object: Right to Object You have a right to object. You can send or communicate your objection to us at any time (e.g., by email to datenschutz@splendid-drinks.com). The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are also not obliged to provide the personal data. However, failure to provide it could mean that you cannot use our form. 11) Social Networks & External Links In addition to this website, we also maintain presences in various social media, which you can reach via corresponding buttons on our website. If you visit such a presence, personal data may be transmitted to the provider of the social network. It is possible that, in addition to storing the data specifically entered by you in this social medium, further information may also be processed by the provider of the social network. Furthermore, the provider of the social network may process the most important data of the computer system from which you visit it – for example, your IP address, the processor type used, and browser version including plug-ins. If you are logged into your personal user account of the respective network while visiting such a website, this network can assign the visit to this account. The purpose and scope of data collection by the respective medium, as well as the further processing of your data there and your rights in this regard, can be found in the respective provisions of the respective controller, e.g., under: Facebook: https://de-de.facebook.com/about/privacy/ We also point out that our website contains further links to external third-party websites, whereby we have no influence on the processing of data on these third-party websites. 12) Data Security We secure our website and other systems through technical and organizational measures against loss, destruction, access, modification, or distribution of your data by unauthorized persons. However, despite regular controls, complete protection against all dangers is not possible. 13) Withdrawal You have the right to withdraw consent once given at any time with effect for the future, without affecting the lawfulness of processing based on consent before its withdrawal. 14) Data Subject Rights In principle, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to object (Art. 21 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 f. GDPR)
• Right to data portability (Art. 20 GDPR)

For inquiries of this type, please contact datenschutz@splendid-drinks.com. Please note that for such inquiries, we must ensure that it is indeed the data subject. Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority. Automated decision-making does not take place on our website. Status: 04.03.2020