1. General

This Privacy Notice applies to our mobile application (the “App”) dedicated to the connected Blade device (the “Device”) for consumers in the European Union where we, HEINEKEN International, located at Tweede Weteringsplantsoen 21 H, 1071 ZA Amsterdam, and its Affiliates will collect certain (personal) information. Please read this Privacy Notice carefully as it contains important information to help you understand our practices regarding any personal information that you give to us or that we collect otherwise in the context of the Website (‘Personal Data’). HEINEKEN International (‘we’ or ‘us’) is the controller of the Personal Data collected and processed.

We respect your privacy, and we are committed to keeping your Personal Data secure and managing it in accordance with our legal responsibilities under applicable data protection laws.

2. What Personal Data We Collect and How We Use your Personal Data

We receive or collect (Personal) Data, as described in detail below, when we provide our connected Blade services, including when you access, install the Device or the App, or use our services. We may use this (Personal) Data to perform the services requested by you as a contractual necessity, to operate, provide, improve, customise, support and market our services based on our legitimate interest, or to comply with a legal obligation to which we may be subject. If you do not want us to collect and process your (Personal) data, you may not be able to use some of the connected Blade services.

We have specified the Personal Data we collect, the purposes for which we use the Personal Data and how long we will generally retain your Personal Data:

Account Data

you can choose to create an account in the App to benefit from our services and to have an overview of the historical use of your Blade. When you create an account, we will ask you to provide us with an email address, password, company name, phone number, country and date of birth (which we need for our age compliance requirements).

Creating an account is necessary in order to be able to access the historical information about the usage of your Blade. In addition, it ensures that only the account holder has access to the registered information of your Blade. You can use your account to securely login to the App.

We will retain your account details for as long as you actively use your account, with a maximum of 7 years. When you have not made use of our Connected Device for more than 2 years, we will automatically delete your Account data. If you want your Account data to be deleted earlier, you can request so via the “Privacy Settings” section in your App. Please note that this deletion process is permanent.

To use the Blade you are not required to have an account. Creating the account is at your request. Therefore, we consider the processing of your Account Data to be necessary for the performance of the contract to which you are party and lawful under Article 6(b) Regulation (EC) 5419/16.

Blade technical Data

We collect certain sensor and device-specific information of your Blade, such as your unique user Blade ID, the connection with the Wi-Fi and the power. The App also records your Blade’s time of use and battery level; the lifespan of the Keg and the temperature of your Blade. Furthermore, ambient temperature, keg pressure, current volume, tapping cycle, several operating parameter statuses and events based on measurements / switch changes are measured.

This data enables us to connect your Blade with the app, track your Blade’s effectiveness, battery level and alert you when the Blade needs maintenance or problem solving. It allows you to perform self-diagnosis of the problem, and the App presents you with the possible solution.

During the set-up of your connection, you are requested to share your Blade technical data to optimize our technical support. We will be able to provide you with more efficient and proactive technical support if we know the location of your connected Blade. It also allows us to analyse the customer support we provide on an aggregated basis. This analysis gives us insight into whether the technical support process works efficiently so we can improve, where possible.

We will retain Blade technical data for as long as you actively use your account, with a maximum of 7 years. When you have not made use of our Connected Device for more than 2 years, we will automatically delete your Account data and technical blade data will be anonymized. Also, you can at any time withdraw your consent trough the “Privacy settings” section in the App.

The processing of Blade technical data is based on your consent, i.e. provided on a voluntary basis; such basis is lawful under article 6 (a) of Regulation (EC) 5419/16. Where we process your Blade technical data based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before withdrawing your consent.

Blade usage data

When you connect your Blade, we receive certain usage data. This includes information about your interaction with the services, including the type of kegs you use, how much volume your Blade produced daily, monthly and yearly, and how well your Blade is performing in comparison to other connected Blades (passives, low performers, medium performers, high performers).

This usage data can also be used for marketing purposes when you have consented to this purpose during the set-up of your connected Blade – or later via the ‘privacy settings’ section in our App. If you have consented for the marketing purposes, we will use your usage data to help optimize our products and to receive commercial messages from our marketing and sales departments. If your connected Blade has been provided to you via one of our distributors, your distributor will also acquire access to your Blade usage data for marketing purposes when you have consented for marketing purposes.

We will retain Blade usage data for as long as you actively use your account, with a maximum of 7 years. When you have not made use of our Connected Device for more than 2 years, we will automatically delete your Account data and usage data will be anonymized. Also, you can at any time withdraw your consent trough the “Privacy settings” section in the App.

If at any time you will decide to use the Blade usage data for monitoring your staff’s performance, please note that we or your distributor is at no time the data controller for this processing and purpose. You will be the data controller, and therefore are responsible to put in place all obligations brought about by applicable privacy laws and regulations. This includes, but is not limited, to you informing your staff about the monitoring of their performance and what criteria you see to assess their performance.

The processing of Blade usage data for marketing purposes is based on your consent, i.e. provided on a voluntary basis; such basis is lawful under article 6 (a) of Regulation (EC) 5419/16. Where we process your Blade usage data based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before withdrawing your consent.

Blade location data

We will collect your Blade location data if you have allowed access to us. Your location data will only be used when you have consented or if the connected Blade has been put at your disposal to our discretion or your distributor’s discretion.

During the set-up of your connection, you are requested to share your Blade location data to optimize our technical support. If you share your location data for the technical support purpose, we are able to remotely read-out the status of your Blade. We will therefore be able to provide you with more efficient and proactive technical support if we know the location of your connected Blade.

The Blade location data can also be used in order to optimise the marketing route and strategy of the sales representatives, when you have provided us with your consent to use your location data for marketing purposes. It will allow us to understand your business better, and we can provide you with improved commercial options in relation to type of kegs, or HEINEKEN appliances/devices. If your connected Blade has been provided to you via one of our distributors, your distributor will also acquire access to your Blade location data for marketing purposes when you have consented for marketing purposes.

We will retain Blade usage data for as long as you actively use your account, with a maximum of 7 years. When you have not made use of our Connected Device for more than 2 years, we will automatically delete your Account data and location data will be anonymized. Also, you can at any time withdraw your consent trough the “Privacy settings” section in the App.

The processing of Blade location data is based on your consent, i.e. provided on a voluntary basis; such basis is lawful under article 6 (a) of Regulation (EC) 5419/16. Where we process your Blade location data based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before withdrawing your consent. We process your Blade location data on the basis of a legitimate interest and to be lawful under article 6(f) Regulation (EC) 5419/16 when we have put the connected Blade at your disposal, as we need to check whether the connected Blade is actually used according to our contractual agreement.

Cookie data

We use cookies, tags or similar technologies to operate, provide, improve, understand and customise our connected Blade services. Cookies allow us to recognise your mobile device/computer and collect your Personal Data, including your unique user Device number, the IP address of your mobile device/computer, the type of internet browser or operating system you use, session and usage data, or service-related performance information, which is information about your use of the App.

For further information about the use of cookies or other similar technologies used in this App, please read our Cookie Notice, which you can find under the privacy settings of the App.

Transactional information

If you pay for our services or products (e.g. kegs), we may receive information and confirmations, such as payment receipts, including from distributors or other third parties processing your payment.

You can choose to make use of services or products via the connected Blade and therefore pay for these services. Therefore, we consider the processing of your Transactional data to be necessary for the performance of the contract to which you are party and lawful under Article 6(b) Regulation (EC) 5419/16.

Customer support

When you connect your Device, in order to make optimal use of your connected Blade, we ask you to share Blade location, usage and technical data in order to optimize our technical customer support. We will be able to provide you with better and more efficient customer support, if you allow us access to your Blade technical data and Blade location data. Furthermore, we will be able to push over-the-air software updates when you opt to connect your Blade, and give us access to your Blade’s location, usage and technical data.

Of course, we will still be able to provide you with customer support if you do not allow us access to your Blade location, usage and technical data. In that case, you may provide us with information related to your use of our connected Blade services, including your interaction with us, and how to contact you so we can provide you customer support. We operate and provide our services, including providing customer support, and improving, fixing and customising our services. We also use your information to respond to you when you contact us.

The processing of Blade location, usage and technical data for technical/customer support purposes is based on your consent, i.e. provided on a voluntary basis; such basis is lawful under article 6 (a) of Regulation (EC) 5419/16. Where we process your data based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before withdrawing your consent.

Combined Data

We may combine your personal data, including account data, Blade technical data, usage data, location data, transactional data and customer support data, either for aggregated business insights purposes or for personalised and marketing purposes.

The combined data is analysed and used to provide you with connected Blade services such as a personalised Blade usage routine in your venue; and to help us improve the content, functionality and usability of the App, Device and connected Blade services, as well as to develop new products and services.

We consider the processing of your Combined data for aggregated business insight purposes to be based on a legitimate interest of us to improve our content, functionality and usability of the App, Device and connected Blade services, as well as to develop new products and services, and to be lawful under article 6(f) Regulation (EC) 5419/16.

The processing of combined data for personalised and marketing purposes is based on your consent, i.e. provided on a voluntary basis; such basis is lawful under article 6 (a) of Regulation (EC) 5419/16. Where we process your data based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before withdrawing your consent.

How We Share Your Personal Data

• HEINEKEN International B.V. and its affiliates will act as data controller.

• If your Blade device is distributed via one of our distributors, this distributor will gain similar access to your (personal) data, as provided to HEINEKEN. Your distributor will act as a data controller in relation to the (personal) data that the distributor processes. If you want to contact your distributor, please find their contact details on enclosed documentation when you receive the connected Blade.

• Evalan B.V., develops, creates, manages and optimizes IoT-systems. Evalan will act as data processor and ensures that the IoT-system, the App, is secured and streamlined. [Sarphatistraat 638, 1018 AV Amsterdam, info@evalan.com]

• Microsoft Azure, a public cloud computing platform that will act as data processor by providing simple and reliable data storage in the cloud.

These parties may be located in the European Union or other countries in the European Economic Area or elsewhere in the world. Personal Data is stored by us inside the EEA and we will ensure an adequate level of protection. We require service providers to use appropriate measures to protect the confidentiality and security of the Personal Data.

We may also need to provide Personal Data to law enforcement bodies in order to comply with any legal obligation or court order.

Security of Personal Data

We will take appropriate technical, physical and organizational measures to protect the Personal Data collected through App from misuse or accidental, unlawful or unauthorized destruction, loss, alteration, disclosure, acquisition or access, that are consistent with applicable privacy and data security laws and regulations. However, no internet-based site can be 100% secure and we cannot be held responsible for unauthorised or unintended access that is beyond our control.

Our Website may contain links to other websites. We are not responsible for the privacy practices, content or security used by such other websites, which shall not be governed by this Privacy Policy. We advise you to always carefully read the privacy policies on these other websites.

Retention of your Personal Data

We will retain your Personal Data for as long as legally required or for as long as necessary to provide you with any requested services or for any of the other purposes listed in this Privacy Policy. The specific retention term are listed in this Privacy Policy for each of the relevant purposes. We will take reasonable steps to destroy or de-identify Personal Data we hold if it is no longer needed for the purposes set out above or after the expiration of the defined retention term.

Children's Privacy

The App and the Device is not intended for use by individuals under the age of 18 (or the applicable legal age for using the Blade). We do not knowingly collect Personal Data from individuals under the age of 18.

Your choices and rights

If you would like to submit a request to access, rectify, erase, restrict or object to the processing of personal data that you have previously provided to us, or if you would like to submit a request to receive an electronic copy of your personal data for purposes of transmitting it to another company (to the extent this right to data portability is provided to you by applicable law), you may contact us at bladeplus@heineken.com. We will respond to your request consistent with applicable law.

In your request, please make clear what personal data you would like to access, rectify, erase, restrict or object to its processing. For your protection, we may only implement requests with respect to the personal data associated with your account, your email address or other account information that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.

Updates

We will keep this Privacy Policy under review and make updates from time to time. Any changes to this Privacy Policy will be posted on our Website page and to the extent reasonably possible, will be communicated to you.

Contact

If you wish to exercise any of your rights listed in paragraph 7. above, you can contact us at bladeplus@heineken.com. Please note that we may request proof of identity. If you have any other question, objection to our use of your Personal Data or a complaint about this Privacy Policy or about our handling of your Personal Data, you can mail at bladeplus@heineken.com. You also have the right to file a complaint with your local data protection authority.

The most recent version of this privacy notice is dated: 15-12-2019