1. INTRODUCTION and IDENTIFYING the CONTROLLER of your personal data This privacy policy applies to HEINEKEN’s mobile application called ‘The Boring Mode’ which is for use by consumers in the European Union, the United Kingdom, and Brazil (the "App"). The HEINEKEN company in your country and Heineken International B.V. (“we”, “us” or “our”) are part of the HEINEKEN group and each company acts as an independent data controller in respect of the personal data that it collects and processes when you use the App. Personal data is any information about an individual from which that person can be identified. When we mention “we”, “us” or “our” in this privacy policy, we are referring to the relevant company responsible for processing your personal data and we have indicated in section 2 which company has access to and processes the different types of personal data. We respect your privacy, and we are committed to keeping your personal data secure and managing it in accordance with our legal responsibilities under applicable data protection laws. Please read this Privacy Policy carefully as it contains important information on our processing activities. If you have any questions, we can be contacted via boringmode@heineken.com, or via the contact details listed on the Heineken website of the HEINEKEN company in your country. 2. WHAT personal data we collect, what our LEGAL basis for processing your personal data is, and HOW we use your personal data A. Age Verification Data (The HEINEKEN company in your country) Before you can use the App, you will need to pass the ‘age gate’ and provide your date of birth to verify that you are of legal drinking age. If based on the date of birth provided you are of legal drinking age, the App will store this information as ‘yes’ or ‘no’ in your phone’s memory – i.e., your actual date of birth is not processed. Lawful basis for processing: to comply with a legal obligation. Retention period: 1 month. B. Customer Service Data (Heineken International B.V. and The HEINEKEN company in your country) If you have a question or other remark about the App, you can contact us via boringmode@niteco.se, or via the contact details listed on the Heineken website of the HEINEKEN company in your country. We will process your email address, your request, complaint or question, our response, and any other interaction with you (together “Customer Service Data”). Lawful basis for processing: Necessary for our legitimate interest to conduct and manage our business, to enable us to give you the best service and to protect, promote and grow our business. Retention period: 12 months after your request, complaint or question is resolved. 3. WHO do we share your personal data with? We may need to share personal data with third parties to help us provide our services and products to you and to run the App. These third parties are: HEINEKEN group companies for the purpose of storing personal data processed via the App, due to shared IT systems; LePub agency (part of Publicis) for the purpose of developing and maintaining the App; Niteco Vietnam for the purpose of developing and maintaining the App; service providers such as solicitors and accountants; courts, parties to litigation and their professional advisers where we reasonably deem it necessary in connection with the establishment, exercise, or defence of legal claims; Law enforcement bodies to comply with a legal obligation or court order; and A purchaser or parties interested in purchasing any part of our business (and professional advisors. 4. International transfers Third parties we share data with may be based outside the UK or the EEA. Whenever we transfer your personal data out of the UK or the EEA, we take steps to ensure that the same level of protection is afforded to it by ensuring one of the following safeguards is put in place: - We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission and/or your local Supervisory Authority; and - Where we use certain service providers, we may use specific contracts approved by the European Commission and/or your local Supervisory Authority, which give personal data the same protection it has in Europe (or the United Kingdom). 5. How SECURE is my personal data? We will take appropriate technical and organizational measures (‘TOMs’) to protect the personal data we process in connection with the App from misuse or accidental, unlawful, or unauthorised destruction, loss, alteration, disclosure, acquisition, or access. Such TOMs are consistent with applicable privacy and data security laws and regulations. 6. How LONG will my personal data be used for? We will only retain your personal data to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. You can ask us to delete your App account including your personal data at any time in the ‘profile’ section in the App. We will complete the deletion process within fourteen working days of receipt of your request. We will take reasonable steps to destroy or de-identify personal data we process if it is no longer needed for the purposes set out above or after the expiration of the defined retention term. Further retention details for specific aspects of your personal data are noted in Clause 2. 7. Cookies The App uses cookies and other cookie-like techniques. For more information on what techniques, we use and how we use them, please review our separate Cookie Policy. 8. Camera Functionality When using the App, you can interact with the ‘Snap’ button to take photos and store them on your phone. To that end, your phone will prompt you to authorize access to the camera, and photo library. If you grant permission, the App will create a dedicated ‘The Boring Phone Mode’ album within your photo library. You can always revoke this permission in the settings of your phone. For the avoidance of doubt, please note that we will not access, or otherwise share, copy or use, any media stored on your phone. 9. Children's Privacy The App is not intended for use by individuals under the age of 18 (or the applicable legal drinking age). We do not knowingly collect personal data from individuals under the age of 18. 10. What are my RIGHTS? Under data protection laws, you have various rights which are set out below. The rights available to you depend on our reason for processing your personal data. You are not required to pay any charge for exercising your rights, although we may charge a reasonable fee if your request is unfounded, repetitive, or excessive. a) Right of access. You have the right to ask us for copies of your Personal Data. This right always applies. There are some exemptions, which means you may not always receive all the information we process. b) Right to rectification. You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. c) Right to erasure. You have the right to ask us to erase your Personal Data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it, or where you have successfully exercised your right to object to processing. d) Right to restriction of processing. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it; e) Right to object to processing. You have the right to object to processing of your Personal Data where we are relying on a legitimate interest or conducting direct marketing. f) Right to withdraw consent. Where we are relying on consent to process your Personal Data, you may withdraw it at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent. g) Right to data portability. This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent. You also have the right to make a complaint at any time to your local Supervisory Authority. We would, however, appreciate the chance to deal with your concerns before you approach your local Supervisory Authority so, please contact us in the first instance using the details at the start of this policy. 11. Updates We will keep this privacy policy under review and make updates from time to time. Any changes to this privacy policy will be posted in the App and to the extent reasonably possible, will be communicated to you. This version was last updated in August 2024.