PRIVACY POLICY

INTRODUCTION

Welcome to the Asahi Beer Asia Limited website. The website on the asahisuperdryhk.com domain (the “Website”) is operated by Asahi Beer Asia Limited (the “Company”). Any references hereinafter to “our”, “us” or “we” are to the Company.

USING OUR SITE

This website is operated by Asahi Beer Asia Limited, a member of the Asahi Group Holdings, Ltd. group of companies. All references to ‘Asahi’, ‘our’, ‘us’ or ‘we’ within this policy are deemed to refer to either Asahi Beer Asia Limited or Asahi Group Holdings, Ltd., its subsidiaries, affiliates, and/or associates which provide services to us, as appropriate. We value the privacy of those who provide personal data to us. This policy applies to our customers, personnel that work for our customers, website visitors, consumers, distributors, our suppliers (and potential suppliers), personnel of such suppliers and contractors.

It describes:

• the data identifying you that we collect;
• how we use this data;
• the legal basis or purpose upon which we process it;
• with whom it is shared; and
• how it is stored.

This policy also describes other important topics relating to your data and its privacy. Please read this privacy policy carefully to understand how we handle your personal data. By accessing or browsing our website, contacting us on social media, working with or for us, offering your goods or services to us, using any of the goods and services that we provide to you or otherwise providing your data to us (including when entering competitions or when attending our events or breweries), you confirm that you have read and understood the entirety of this privacy policy.

The Policy is comprised of the following Sections:

• Section 1: Data collection
• Section 2: Use of data
• Section 3: Purpose and legal grounds for use of your personal data
• Section 4: Cookies
• Section 5: Disclosure of personal data
• Section 6: Retention of personal data
• Section 7: Your rights
• Section 8: Direct Marketing
• Section 9: Transfers of data
• Section 10: Security
• Section 11: Third party websites
• Section 12: Changes to our Privacy Policy
• Section 13: Further questions or making a complaint

1. Data collection

We may receive some data about you directly from you. However, we may also receive data about you from third parties such as your employer or recruitment agency, retailers where you are a customer, media agencies, market research companies, our suppliers, group companies, public websites, agencies (including booking agents) and public agencies (including customs officials), which we refer to as “Third Party Sources” throughout this policy. We, or third parties on our behalf, may collect and use any of the following data about you and we refer to this as “personal data” throughout this policy:

1.1 Personal data which you give us (or which we receive from Third Party Sources)

You or your employer or recruitment agency may give us personal data about yourself by using the online forms provided on our website, completing order forms, setting up an account with us, or by contacting us by phone, e-mail or other means. This includes, for example, when you or your employer provide your personal data to us in order to receive our services. You, or our Third Party Sources may also give us personal data about you when you are or it is offering or providing services to us. The personal data which you give us (or which we receive from Third Party Sources) may include:

(a) Data about you:

• (i) your name;
• (ii) your job title;
• (iii) company name;
• (iv) e-mail address;
• (v) your telephone number;
• (vi) account information;
• (vii) your company’s address;
• (viii) your gender;
• (ix) your date of birth;
• (x) data provided when you correspond with us;
• (xi) any updates to data provided to us; and
• (xii) if you attend our sites, CCTV footage.

(b) Data about our website visitors and users of our software apps (where applicable):

• (i) if you visit our website, your IP address;
• (ii) your user name;
• (iii) your age;
• (iv) your behaviour on our website (for example, the pages that you click on) or on our software app;
• (v) payment details;
• (vi) order history; and
• (vii) if you are a user of a mobile application, your location data so that we can help you to locate our products and services and, if you are a service provider, so that we can monitor the effectiveness and efficiency of any services that you provide to us.

(c) Data about the goods or services we provide to you:

• (i) data needed to provide goods or services to you (including data on account opening forms, details of your order, order history, payment details, delivery address, delivery requirements and restrictions, trade references and tax information);
• (ii) the name you give us for personalised products;
• (iii) customer services data; and
• (iv) customer relationship management and marketing data.

(d) Data about services that we receive from you or your employer (including breweries, bars, wholesalers, restaurants, media contacts, transport suppliers, warehouses, fulfilment centres, technical support equipment providers and engineers, brand ambassadors and other contractors):

• (i) your website;
• (ii) your photo and video footage if you are a collaborator or brand ambassador, or a potential collaborator or brand ambassador;
• (iii) CVs, pitch and tender data; and white paper data;
• (iv) supplier due diligence data (for example for wholesalers of alcohol);
• (v) work contact data (phone number, postal address, mailing address, email address);
• (vi) proof of identification and address;
• (vii) visa or work permit documentation;
• (viii) emergency contact data;
• (ix) work place accident data and medical or health data (relevant to your work for us and/or provided by you to Asahi, for example, medical assessments);
• (x) work hours (overtime and shift work, hours worked and department standard hours);
• (xi) details of compensation, expense claims and bank details;
• (xii) drug and alcohol testing and health assessment data;
• (xiii) court, tribunal and inquiry proceedings; and
• (xiv) data required to access company systems and applications (such as system ID).

(e) If you use our photo booth at one of our breweries or events, your photo and the photo timestamp.

(f) If you choose to use social media in order to contact us or find out about our products or services, your profile data (including your preferences and interactions with us on Facebook, Instagram and Twitter) and data which you post on message boards which are relevant to our business.

(g) If you attend our events, your photograph and event video footage (we will also give you notice of this at the event).

Some of the personal data that we collect about you or which you or third parties (including your employer or recruitment agency) provides to us about you may be sensitive categories of data. Sensitive categories of data may include data about your physical and mental health. Please note that we need certain types of personal data so that we can provide services to you or so you, or our Third Party Sources, can provide services to us. If you do not provide us with such personal data, or if you ask us to delete it, you may no longer be able to access our goods and services or provide goods and services to us.

1.2 Personal data we collect about you or that we obtain from our Third Party Sources

(a) Each time you visit our website we may automatically collect any of the following data:

• (i) technical data, including the Internet protocol (IP) address used to connect your computer to the internet, domain name and country which requests data, the files requested, browser type and version, browser plug-in types and versions, operating system and platform;
• (ii) data about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time), time and length of visits to certain pages, page interaction data (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, traffic data, location data, weblogs and other communication data and data provided when requesting further service or downloads.

(b) If you contact us on social media, we will collect certain data about you from your social media page and through your interactions with us or with data about our products and services.

(c) If you are a journalist or work for an institution/trade association in our industry, we may collect data about you from public sources.

(d) If you are a customer or a supplier (or a potential customer or supplier) or work for one of them (including as a consultant), we may obtain data about you from your company’s website.

(e) If you are working for us or visiting one of our sites (for example, a brewery) we may also collect personal data about you on CCTV.

2. Use of data

We, or our Third Party Sources acting on our behalf, collect, use and store the personal data listed above for the following purposes:

2.1 Visiting our website or, if you are a consumer, using one of our software apps

• (a) to allow you to access and use our website or the app (including to ensure you are of legal drinking age in Hong Kong);
• (b) to provide technical support;
• (c) to provide you with the information and services that you request from us;
• (d) to ensure the security of our services, our website and our app;
• (e) to store information about your preferences, and to allow us to customise our website and the app according to your individual interests;
• (f) to recognise you when you return to our website;
• (g) if you are an app user, to recognise your location to enable the app to function by notifying you of bars nearby, to monitor app usage and beer consumption, to carry out market research and understand your preferences and experience at venues selling our products (such as a hotel, bar or restaurant);
• (h) to enable you to participate in our competitions and promotions;
• (i) to process orders which you place for goods or services from us; and
• (j) for improvement and maintenance of our website and the app and preparing reports or compiling statistics in order to improve our goods and services. Such details will be anonymised as far as is reasonably possible and you will not be identifiable from the data collected.

2.2 Receiving goods and services from you

• (a) to enable us to receive and manage services from you (including supplier due diligence, payment and expense reporting and financial audits);
• (b) for health and safety records and management;
• (c) to assess your working capacity (for example, to assess whether you are under the influence of drugs or alcohol and thereby pose a danger to yourself and to others);
• (d) to confirm information on CVs and performance reference checks, to assess you or your employer’s suitability to work for us; and
• (e) for equal opportunities monitoring.

2.3 Providing goods and services to you

• (a) to provide relevant goods or services to you or your employer (including, to confirm and process orders, for administration of your account with us, customer loans, tax and export, billing and debt collection purposes and the collection of bottles (where applicable));
• (b) to deal with any enquiries or issues you have about our goods and services, including any questions you may have about how we collect, store and use your personal data, or any requests made by you for a copy of the data we hold about you;
• (c) to send you certain communications (including by email or post) about our goods and services such as service announcements and administrative messages (for example, setting out changes to our terms and conditions and keeping you informed about our fees and charges);
• (d) to allow you to attend our events or participate in competitions and to send you photos that you have permitted us to take of you;
• (e) for health and safety and quality assurance;
• (f) to carry out statistical analysis and market research; and
• (g) if you have consented or, otherwise, if permitted under applicable Hong Kong laws, for business development and marketing purposes, to contact you (including by email or post) with information about our products and services which either you request, or which we feel will be of interest to you (including newsletters), subject to the direct marketing provisions set out in Section 8.

2.4 Internal corporate operations

For internal corporate reporting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, research and development, and to identify and implement business efficiencies.

2.5 Compliance and legal obligations

To comply with any procedures, laws and regulations which apply to us—this includes compliance with statutory obligations in Hong Kong or requests from local government, regulatory, or law enforcement authorities.

2.6 Legal rights

To establish, exercise or defend our legal rights—this may include where we reasonably consider it necessary to protect our operations or interests.

2.7 Site Security

If you visit one of our sites (including a brewery), for CCTV monitoring and ensuring the security of our staff and visitors, and our and their property.

2.8 Social Media monitoring

If you contact us on social media, to monitor your interactions with us and our brand online for market research and for planning future marketing campaigns.

2.9 Media and PR

If we use your photograph or video footage from an event, to amplify the event to a broader audience and for internal presentation purposes, where we have your consent or as otherwise permitted by law.

2.10 Technical and Maintenance tracking

If you are a user of our maintenance tracker app, CM/SpinApp, to identify your location when you are providing maintenance services on our draft beer equipment and to manage the service requirements of customers.

2.11 Journalism and Press

If you are a journalist, to contact you to invite you to write a news article about our products and services; to invite you to events, send you promotional material and for press releases.

3. Purpose and legal grounds for use of your personal data

3.1 We process your personal data in accordance with the PDPO. The legal grounds and purposes for using your personal data as set out in this privacy policy are as follows:

• (a) our use of your personal data is necessary to perform our obligations under any contract with you (for example, to fulfil an order which you place with us, to comply with the terms of use of our website or software app which you accept by browsing our website or by downloading our software app and/or to comply with our contract to provide services to or receive services from you or your employer); or
• (b) our use of your personal data is necessary for complying with our legal obligations (for example, providing information to the Inland Revenue Department or other competent authorities in Hong Kong); or
• (c) where use of your personal data is otherwise directly related to our legitimate business purposes, including to:
  • (i) run, grow and develop our business;
  • (ii) operate our website and our mobile app;
  • (iii) select appropriately skilled and qualified suppliers;
  • (iv) ensure a safe working environment for our staff and visitors;
  • (v) carry out market research and business development;
  • (vi) provide goods and services to our customers, make and receive payment, provide customer services and to know the customer that we are providing services to;
  • (vii) place, track and ensure fulfilment of orders with our suppliers; and
  • (viii) manage internal group administrative purposes, as described in section 5.1 below.

3.2 We may use your sensitive categories of data where you have provided your explicit consent (which you may withdraw at any time after giving it, as described below) or where permitted under Hong Kong law.

3.3 If we rely on your consent for us to use your personal data in a particular way, but you later change your mind, you may withdraw your consent by contacting us at https://www.instagram.com/asahisuperdry_hk/ and we will stop doing so. However, if you withdraw your consent, this may impact your ability to provide services to us or for us to provide services to you.

4. Cookies

4.1 Some pages on our website and mobile apps use cookies, which are small files placed on your internet browser when you visit our website, mobile apps or use our apps. We use cookies in order to offer you a more tailored experience in the future, by understanding and remembering your particular browsing preferences.

4.2 Where we use cookies on our website, you may block these at any time. To do so, you can activate the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies), you may not be able to access all or parts of our website or to use all the functionality provided through our website.

4.3 For detailed information on the cookies we use and the purposes for which we use them, please refer to our cookies policy available on our website. By continuing to use our website, mobile apps and/or our services, you are agreeing to our use of cookies as described in our cookies policy.

5. Disclosure of personal data

5.1 We may share your personal data with any company that is a member of our group, which includes our ultimate parent company based in Japan, for internal administrative purposes (for example, ensuring consistent and coherent delivery of services to our customers, corporate strategy, compliance, auditing and monitoring, research and development and quality assurance). We may also share your personal data with our group where they provide products and services to us, such as information technology systems.

5.2 We will share your personal data with the following categories of third parties:

• (a) our service providers and sub-contractors, including but not limited to payment processors, suppliers of technical and support services, insurers, logistic providers, and cloud service providers;
• (b) your employer or recruitment agency;
• (c) retailers, where you are a customer;
• (d) public agencies (including customs officials and other government bodies);
• (e) occupational health assessment providers and medical professionals undertaking drug and alcohol testing (where applicable);
• (f) companies that assist us in our marketing, advertising and promotional activities; and
• (g) analytics and search engine providers that assist us in the improvement and optimisation of our website and our software apps.

Any third parties with whom we share your personal data are bound by contract to maintain confidentiality and use your personal data strictly for the purposes specified by us. We will always ensure that any third parties with whom we share your personal data are subject to privacy and security obligations consistent with this privacy policy and the PDPO.

5.3 We will also disclose your personal data to third parties:

• (a) to run, grow and develop our business:
  • (i) if we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets;
  • (ii) if substantially all of Asahi’s or any of its affiliates’ assets are acquired by a third party, in which case personal data held by Asahi will be one of the transferred assets;
• (b) if we are under a duty to disclose or share your personal data in order to comply with any statutory or legal obligation in Hong Kong, or any lawful request from Hong Kong government or law enforcement officials;
• (c) in order to enforce or apply our terms and conditions or any other agreement or to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent any illegal activity; or
• (d) to protect the rights, property, or safety of Asahi, our staff, our customers or other persons. This may include exchanging personal data with other organisations for the purposes of fraud protection and credit risk reduction.

5.4 We may also disclose and use anonymised, aggregated reporting and statistics about users of our website and apps or our goods and services and from interactions with us and our brands on social media for the purpose of internal reporting or reporting to our group or other third parties, and for our marketing and promotion purposes. None of these anonymised, aggregated reports or statistics will enable our users to be personally identified.

5.5 Save as expressly detailed above, we will never share, sell or rent any of your personal data to any third party without notifying you and, where necessary under the PDPO, obtaining your opt-in consent.

6. Retention of personal data

We keep your personal data for no longer than necessary for the fulfillment of the purposes for which the personal data is processed, or as required to comply with applicable Hong Kong laws and to establish, exercise or defend our legal rights. Once personal data is no longer required, we will take all reasonably practicable steps to erase or permanently anonymise it.

7. Your rights

7.1 Under the PDPO, you have the right to check whether we hold personal data about you and to request access to and correction of your personal data. If you would like to exercise any of these rights, please contact us at https://www.instagram.com/asahisuperdry_hk/ at any time. You have the right to request that we:

• (a) provide access to and a copy of any personal data we hold about you (Data Access Request);
• (b) update or correct any of your personal data which is inaccurate or out of date (Data Correction Request);
• (c) cease processing your personal data for direct-marketing purposes.

7.2 We will respond to your requests within the statutory period required under Hong Kong law (typically within 40 days of receiving a Data Access Request). In accordance with the PDPO, we may charge a reasonable fee for processing any Data Access Request.

7.3 We may request you provide us with information necessary to confirm your identity before responding to any request you make.

8. Direct Marketing

8.1 We intend to use your personal data (such as your name, email address, telephone number, and postal address) to send you direct marketing communications about our products, services, events, competitions, and promotions by email, software app, telephone, and post.

8.2 We will not use your personal data for direct marketing unless we have received your explicit, voluntary consent (which includes an indication of no objection).

8.3 We will never disclose your personal data to third parties for their own direct marketing purposes without obtaining your specific written consent.

8.4 Opt-out Right: If you wish to stop receiving marketing communications from us at any time, you can exercise your opt-out right free of charge by clicking the "unsubscribe" link in our emails or by contacting us at https://www.instagram.com/asahisuperdry_hk/.

9. Transfers of personal data

9.1 Your personal data may be transferred to, stored at, and/or accessed by our group companies, affiliates, or Third Party Sources located outside of Hong Kong (including Japan). This may be for the provision of our services, transaction processing, data storage, or technical support services.

9.2 Regardless of where your data is transferred, we will take appropriate contractual and operational measures to ensure that the recipient protects your personal data to a standard equivalent to the requirements under Hong Kong’s PDPO.

10. Security

10.1 Asahi is committed to protecting personal data from loss, misuse, disclosure, alteration, unauthorised access, unavailability and destruction and takes all reasonable precautions to safeguard the confidentiality of personal data, including through use of appropriate organisational and technical measures. Organisational measures include physical access controls to our premises, staff training and locking physical files. Technical measures include use of encryption, secure passwords for system access, and firewalls/anti-virus software.

10.2 While we make every effort to protect the personal data which you provide to us, the transmission of information over the internet is not completely secure. As such, you acknowledge and accept that we cannot guarantee the security of your personal data transmitted to our website and that any such transmission is at your own risk. Once we have received your personal data, we will use strict procedures and security features to prevent unauthorised access.

10.3 Where we have given you (or where you have chosen) a password which enables you to access your online account, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

11. Third party websites

Our website, mobile apps and social media pages may contain links to websites operated by third parties including partner networks and our group companies. Please note that this privacy policy only applies to the personal data that we collect through our website, apps and social media pages, and we cannot be responsible for personal data about you that is collected and stored by third parties. Third party websites have their own privacy policies, and you should read these carefully before submitting any personal data.

12. Changes to our privacy policy

We may update our privacy policy from time to time. Any changes we make in the future will be posted on this page and, where appropriate, notified to you by post or email. Please check back frequently to see any updates. By continuing to use the services and our website, or to offer/provide services to us, you confirm that you have read and understood the latest version of our privacy policy.

13. Further questions or making a complaint

13.1 If you have any queries or complaints about our collection, use or storage of your personal data, or if you wish to exercise your rights to access or correct your data, please contact privacy@asahibeer.com. We will investigate and attempt to resolve any such complaint or dispute regarding the use or disclosure of your personal data.

13.2 You also have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (“PCPD”) if you believe your personal data privacy rights have been breached. The practices described in this privacy policy statement are current personal data protection policies, as of 1 Jan 2026.