We know that you care about your personal data and how it is used, and we want you to trust that SBFZA uses your personal data carefully.

This privacy notice applies to SUNTORY BEVERAGE & FOOD SOUTH AFRICA (SBFZA). Please read it carefully as the privacy notice sets out how and why we collect, store, use and share personal data generally and your rights in relation to your personal data including details of how to contact us and supervisory authorities if you have a complaint.

1. WHO ARE WE AND HOW TO CONTACT US
2. DEFINITIONS
3. SCOPE OF THE PRIVACY STATEMENT
4. HOW AND WHY WE PROCESS YOUR PERSONAL DATA
5. HOW WE SHARE YOUR PERSONAL DATA WITH THIRD PARTIES
6. HOW WE USE COOKIES
7. HOW WE SECURE YOUR PERSONAL DATA
8. HOW LONG WE KEEP YOUR PERSONAL DATA
9. YOUR RIGHTS REGARDS TO THE PROCESSING OF YOUR PERSONAL DATA AND HOW YOU CAN EXERCISE THEM
10. QUESTIONS AND CONCERNS
11. PRIVACY STATEMENT UPDATES

Suntory Beverage & Food South Africa Limited ("SBFZA") is an affiliate of Suntory Beverage & Food (SBF) Limited and part of the Suntory Group. This website is operated by Suntory Beverage and Food South Africa Limited and therefore the operator of your personal data.

Contact information:
Suntory Beverage & Food South Africa Limited
SA Registration Number: 2014/046246/10
WeWork, 173 Oxford Road, Rosebank, 2196, Johannesburg, South Africa.
T +27(0)800 061 013
Information Officer:
Rory Mathew Brennan
Tel: +27 0800 061 013
Email: Rory.Brennan@Suntory.com

Suntory Beverage & Food South Africa Limited (also referred in this notice as ‘’SBFZA, ‘’We’’ or ‘’us’’) takes privacy very seriously and are committed to ensure that you are informed about the manner in which we collect, use and share your personal data.
In this privacy notice, Personal data refers to any information directly or indirectly relating to you as an individual ("Personal Data").

"Affiliate" means, with respect to a party, an entity that (directly or indirectly) controls, is controlled by or is under common control with, such party, where control refers to the power to direct or cause the direction of the management policies of another entity, whether through ownership of voting securities, by contract or otherwise;

"Controller" means the entity which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;

"Data Protection Laws" means all applicable laws and regulations relating to the processing of personal data and privacy including, not limited to, the Promotion of Access to Information Act No. 2 of 2000 (POPI Act), the Data Protection Act 2018; the UK GDPR; the EU GDPR; the Privacy and Electronic Communications (EC Directive) Regulations 2003; and the Data Protection (Charges and Information) Regulations 2018;

"Data Subject Request" means a Data Subject's request to exercise that person's rights under Data Protection Laws in respect of that person's Personal Data, including, without limitation, the right to access, correct, amend, transfer, obtain a copy of object to the processing of, block or delete such Personal Data;

"Data" means any data, including Personal Data, whether in physical or electronic form, including but not limited to documents, databases, records, intellectual property and confidential information (as defined elsewhere in this Agreement), created by or made available to Supplier in the course of providing services to any SBFZA entity and/or any of its Affiliates;

"Personal Data" means any information relating to an identified or identifiable natural person made available to Supplier in connection with the Services; an identifiable natural person (each a "Data Subject"), is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to the physical, physiological, mental, economic, cultural or social identity of that natural person;

"Processing" or "Process" means any operation or set of operations which is performed by or on behalf of Supplier as part of the Services upon Personal Data or other SBFZA entity Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

"Processor" means the entity which Processes Personal Data on behalf of the Controller.

"Regulator" means the Information Regulator, the data protection authority in South Africa or other regulatory, governmental or supervisory authority with authority over all or any part of (a) the provision or receipt of the Services, ( b) the Processing of Personal Data in connection with the Services or (c) Supplier's business or personnel relating to the Services;

"Security Incident" means any Personal Data Breach (as defined in the Data Protection Laws) or other incident that has resulted, or is reasonably likely to result, in any accidental, unauthorised or unlawful destruction, loss, alteration, disclosure of, access to or encryption of (a) SBFZA entity Data or (b) other information under Supplier's control where such incident has the potential to harm any SBFZA entity' business, clients, employees, systems or reputation;

"Services" means the services to be provided by Supplier to SBFZA;

"Subcontractor" means a third-party subcontractor engaged by or on behalf of Supplier that will Process any SBFZA entity Data as part of the performance of the Services;

"Suntory Group" means Suntory Holdings Limited ("SHD") and entities which SHD directly or indirectly controls.

This privacy notice sets out the conditions under which SBFZA will process your personal data:

(1) When you visit this website,
(2) when you contact us on the different contact forms in our website, by email or by phone call.
(3) when you apply for a job via the email address in our website,
(4) when we manage our website,
(5) when we comply with our legal obligations,
(6) when we need to protect our interests,
(7) when you visit our offices.

Personal data that you provide	Purpose	Type of personal data	Legal basis
When you contact us on our different communication channels (web contact form, email or phone call)	To manage, track and respond your inquiries and questions, receive your comments, feedback and/ or fulfil your requests	Subject, comment, title, first name, last name, email address. The reason for your contact and any additional information that may be considered personal data and that you choose to share with us through our web forms, phone call, postal mail, or on our internet social media accounts.	Our legitimate interest
When we comply with our legal obligations	To comply when this is required by legal proceedings or public authorities, and we reasonably believe that disclosing your personal data is strictly necessary to comply with those obligations.	Personal identifiers: first name, family name, email address, phone number. Any information that may be considered personal data and that you choose to share with us through our web forms, phone call, postal mail, or on our internet social media accounts.	Our legal obligation
When we need to protect our interests	To lawfully enforce our terms and conditions, protect our operations or those of any of our affiliates, protect our rights, privacy, safety, or property, and/or that of our affiliates, and allow us to pursue available legal remedies or limit the damages that we may sustain.	Personal identifiers: first name, family name, email address, phone number. Any information that may be considered personal data and that you choose to share with us through our web forms, phone call, postal mail, or on our internet social media accounts.	Our Legitimate interest
When you apply for a job in SBFZA*	To process your application within the recruitment process	All personal data contained in the candidate's resume.	Your consent
Personal data that we collect or generate about you:	Purpose	Type of personal data	Legal basis
When you visit our website - Use of cookies	1. Non-essential cookies: To measure your engagement with this website and provide you with content adapted to your interests (e.g. to know how you use our Sites, when do you use them, how often, using what device, how long you stay on them, on what items you click) we use cookies. The use of these cookies also helps us to know the Sites' users better, and adapt our Sites to the identified preferences of the users, but also more generally improve our products and services.**	A file with your contact history, to be used for enquiry purposes, so that we may ensure that you are satisfied with the services which we are providing to you; Browser and device information: IP address, MAC address, Google Ad ID, Identity For Advertisers (device ID); Server log file information; Activity / Engagement Personal Data (e.g. data and time of activity on relevant Sites, number of times a Site is visited, which items are clicked).	Your consent
	2. Essential cookies: We use essential cookies to enable our website to function properly and improve its use and functionality.	IP address, device type, software, etc	Our legitimate interest
When we manage our website	For the correct administration, changes or restructuration of this website, to diagnose server problems, to prevent any potential disruptions or cyberattacks on our systems and networks and to update our security solutions.	IP address, device type, software, etc	Our Legitimate interest
When we comply with our legal obligations	To comply when this is required by legal proceedings or public authorities, and we reasonably believe that disclosing your personal data is strictly necessary to comply with those obligations.	A file with your contact history, to be used for enquiry purposes, so that we may ensure that you are satisfied with the services which we are providing to you; Browser and device information: IP address, MAC address, Google Ad ID, Identity For Advertisers (device ID); Server log file information; Activity / Engagement Personal Data (e.g. data and time of activity on relevant Sites, number of times a Site is visited, which items are clicked).	Our legal obligation
When we need to protect our interests	To lawfully enforce our terms and conditions, protect our operations or those of any of our affiliates, protect our rights, privacy, safety, or property, and/or that of our affiliates, and allow us to pursue available legal remedies or limit the damages that we may sustain.	A file with your contact history, to be used for enquiry purposes, so that we may ensure that you are satisfied with the services which we are providing to you; Browser and device information: IP address, MAC address, Google Ad ID, Identity For Advertisers (device ID); Server log file information; Activity / Engagement Personal Data (e.g. data and time of activity on relevant Sites, number of times a Site is visited, which items are clicked).	Our Legitimate interest

*Job applicants
When you click in the Global Career link in our website to apply for a job, you will be redirected to the Suntory Holdings Limited website, and therefore your interactions will be governed by the terms displayed in the referred site. When you apply to a job position in any SBFZA affiliate, you will be provided with the applicable SBFZA Privacy Notice.

**For more information on how we use cookies, please refer to ap. 6 below.

Children personal data

We take children privacy seriously therefore we do not process children’s personal data.

In accordance with best practice and international standards, our services do not address anyone under the legal age. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact us. If We become aware that We have collected Personal Data from anyone under the legal age without verification of parental consent, We take steps to remove that information from our servers.

SBFZA only shares your personal data in the cases and for the purposes listed and described below:

1. As a global business, we may share your Personal Data within the Suntory Group, its subsidiaries and affiliates when this is required to achieve any of the purposes described above. When we do this, we ensure that the processing of your data by the affiliates will be carried out under the conditions described in this Privacy Statement.
2. We may also share your Personal Data with third parties service providers outside of the group to operate and maintain our services (see table in ap. 4). These third-parties service providers act as our processors for the following purposes. Rest assured that when engaging these third parties, appropriate contractual agreements (Data Processing Agreements) are put in place between us and the third-party provider:
   1. With our business partners (for example, this could include our partners from whom you or your company or your organisation purchased our Products. Personal Data will only be transferred to a business partner who is contractually obliged to comply with SBFZA data protection standards and the applicable data protection legislation);
   2. With third party agents and contractors for the purposes of providing services to us (for example, the SBFZA’s accountants, professional advisors, IT and communications providers and debt collectors). These third parties will be subject to SBFZA data protection standards, internal policies and procedures when processing your personal data, they will only use your Personal Data as described in this Privacy Policy and as expressly instructed by SBFZA;
3. If we are legally required to disclose your personal data, for example, to comply with any legal obligation (including, without limitation, in order to comply with tax reporting requirements and disclosures to regulators), or to establish, exercise or defend legal rights;
4. If we sell our business or assets, your personal data will be used by us or shared with Suntory Group for internal reasons, primarily for business and operational purposes. As we continue to develop our business, we may sell or purchase assets, subsidiaries or business units. In such transactions, your personal data generally is one of the transferred business assets but remains subject to the promises made in any pre-existing Privacy Notice (unless, of course, you consent otherwise).
5. If we are acquired by a third party, your personal data will be disclosed to such entity as part of the due diligence process and will be transferred to such entity as one of the transferred assets. Also, if any bankruptcy or reorganization proceeding is brought by or against us, all such personal data will be considered an asset of ours and as such it is possible they will be sold or transferred to third parties.

5.1 International data transfers

SBFZA is an affiliate of SBF and part of the Suntory Group, a global company with operations, customers, and partners spread all around the world.

To achieve the purposes described in this privacy notice, we may transfer some of your Personal Data to third parties across international borders. As a result, your Personal Data may be transferred to locations outside of your country.

If your data is transferred to a country or territory located Sout Africa, we will ensure that your personal data is transferred and processed with the same level of protection as it is the case when processed locally under the POPI Act. This will be done in one of the following ways.

You can obtain more details of the protection given to your Personal Data when it is transferred outside the country by contacting us in GDPR.info@suntory.com.

We may place small text files called ‘cookies’ on your device when you visit our website.

Cookies are small pieces of text that contain a personal identifier allowing us to associate your Personal Information with a certain device.

They are provided by most websites and stored by your web browser on the computer, phone, or other device that you are using. Cookies serve many purposes. They can help a website remember your preferences, learn which areas of the website are useful and which areas need improvement, and provide you with targeted advertisements or personalized content. Sometimes, cookies are enabled when pixels are placed on a website. Pixels are also referred to as web beacons, clear gifs, and tags. They enable websites to read and place cookies.

We may use the following types of cookies on Our website:

1. Essential cookies, or 'functionality cookies' which are crucial to a user’s experience of a website, enabling core features functions on our website.
2. Non-essential cookies, which can be:
   1. Analytical or performance cookies: these cookies allow us to recognise and understand how you interact with our websites, so that we can make the most out of them. For example, we may monitor how many times you visit our websites, which pages you go to, traffic data, location data and the originating domain name of your internet service provider. This information helps us to build a profile of our users and improve the way our websites work.
   2. Functionality cookies: these cookies improve the functionality of our websites, such as by ensuring our videos play smoothly, but they also allow us to acknowledge when you have revisited our websites so that we can remember your preferences (such as your choice of language or region).
   3. Targeting cookies: these cookies allow us to learn more about you based on the pages you have clicked on and the links you have followed, so that advertisements you see online can be tailored to be more relevant to your interests.
   4. Social media cookies: these cookies allow you to to connect with and use social media options that are integrated into our websites (e.g. the functionality to share content).

Manage your cookies

Your web browser can be set to allow you to control whether you will accept or reject cookies, or to notify you each time a cookie is sent to your browser. Such browser settings are typically found in the "options", "tools" or "preferences" menu. You may also consult the browser's "help" menu. If your browser is set to reject cookies, websites that are cookie-enabled will not recognize you when you return to the website, and some website functionality may be lost.

Consent for cookies

We will ask for your consent to place cookies or other similar technologies on your device, except where they are "strictly necessary" (i.e. essential) for us to provide you with a service that you have requested.

SBFZA takes all necessary technical and organisational measures to protect the confidentiality, security, and ensure the availability of your Personal Data collected via our digital media. These efforts include but are not necessarily limited to:

1. Technical measures: these cookies allow us to recognise and understand how you interact with our websites, so that we can make the most out of them. For example, we may monitor how many times you visit our websites, which pages you go to, traffic data, location data and the originating domain name of your internet service provider. This information helps us to build a profile of our users and improve the way our websites work.
2. Organizational measures: As a condition of employment, our employees are required to follow internal policies and procedures, and all applicable data protection laws and regulations. Access to sensitive Personal Data is limited to those employees who need it to perform their roles. Unauthorised use or disclosure of confidential SBFZA entity information by one of our employees is prohibited and may result in disciplinary measures.
   When you contact one of our employees about your file, you may be asked for some Personal Data. This type of safeguard is designed to ensure that only you, or someone authorised by you, has access to your file.
3. Contractual measures: All data processors we engage with are subject to an exhaustive selection process and bind to SBFZA data protection contractual clauses to ensure the processing of your personal data remains within our standards of compliance. Data processors on behalf of SBFZA are also contractually obliged to ensure that any sub-processors engaged in the processing will perform its duties within the same required data protection standards.

By rule, we will keep your data accurate and up to date for as long as we need it for the purposes described in this Privacy Statement. If the processing of your personal data is no longer necessary for any purpose, it will be either irreversibly anonymized (and the anonymized data may be retained), or securely erased.

Exception to this rule is when it is necessary to comply with our legal and regulatory obligations, resolve disputes and enforce our agreements imposing that SBFZA must keep your personal data for a longer period after the purpose of the processing was accomplished.

1. In all cases described above in which we collect, use or store your Personal Data, you may have the following rights, and, in most cases, you can exercise them free of charge.
   
   These rights include:
   
   1. Right of access: the right to request the confirmation whether your Personal Data is being processed by any SBFZA affiliate or not, and to access that personal data;
   2. Right to withdraw: when the processing of your personal data is legally based on your consent, you have the right to withdraw your consent at any time, without prejudice to the to the validity of the processing prior to the withdrawal. Please note, however, that we may still be entitled to process your Personal Data if we have a legitimate reason for doing so. For example, we may retain Personal Data if we need to comply with a legal obligation.
      You always have the option not to share any of your Personal Data with us. If you choose this option, you may be limited in the activities and features we can provide you.
      You can withdraw your consent by contacting our Information Officer:
      Rory Mathew Brennan
      Tel: +27 0800 061 013
      Email: Rory.Brennan@Suntory.com
   3. Right to rectification: the right to request the rectification of your Personal Data if it is inaccurate, outdated or incomplete.
   4. Right to erasure: the right to request that we erase your Personal Data if: (i) your Personal Data is no longer necessary for the purpose of the data processing, (ii) you have withdrawn your consent on the data processing based exclusively on such consent, (iii) you objected to the data processing, (iv) the Personal Data processing is unlawful, (v) the Personal Data must be erased to comply with a legal obligation applicable to SBFZA.
      Please note that there may be circumstances where you ask us to erase your Personal Data, but we are legally obliged or entitled to retain it;
   5. Right to object: the right to object to our processing of your Personal Data at any time, including for marketing purposes based on profiling, if the data processing is based on the legitimate interest of SBFZA, unless SBFZA can demonstrate overriding compelling legitimate grounds for it.
   6. Right not to be subject to automated decision making: you can exercise this right when your personal data is subject to a decision based solely on automated decision making (including profiling) that can significantly affect you.
      You have the right not to be subject to a decision which is based solely on automated processing, and which produces legal or other significant effects on you. In particular, you have the right to:
      • obtain human intervention;
      • express your point of view;
      • obtain an explanation of the decision reached after an assessment; and
      • challenge such a decision.
2. You can exercise any of your above rights, you can contact our Information Officer:
   • Rory Mathew Brennan
   • Tel: +27 0800 061 013
   • Email: Rory.Brennan@Suntory.com

In case you believe your personal data is processed in a manner constituting an infringement of the POPI Act, you can lodge a complaint with the Information Regulator in South Africa (https://inforegulator.org.za/).

If you have any questions or concerns about SBFZA handling of your Personal Data, or about this Privacy Notice, please contact our Information Officer using the following contact information:
Email Address: Rory.Brennan@Suntory.com

We will update this Privacy Statement when necessary to reflect customer feedback, system updates, and changes in our products and services. When we post changes to this statement, we will revise the “last updated” date at the top of this document. If the changes are significant, we will provide a more detailed notice (including, for certain services, email notification of Privacy Statement changes). We will also keep prior versions of this notice in an archive for your review.
This Privacy Statement was last updated on 01/06/2025.