PRIVACY NOTICE

The Coca-Cola Company and its affiliates respect your privacy. They want you to be familiar with how they collect, use and disclose information directly or indirectly relating to you as an individual ("Personal Data"), and the rights that you have in this regard.

This privacy notice (the "Privacy Notice ") describes how NV Coca-Cola Services SA, a company with registered office at Chaussée de Mons 1424, 1070 Brussels ("CCS", "we", "our" and "us") processes your Personal Data collected in relation to:

• the Coca Cola mobile application (the “App”). The App enables you to watch videos, read interesting news, submit comments, photos and videos, take part in raffles, contests and sweepstakes, collect points and win prizes, coupons and discounts from a variety of brands and stores, and use many other interesting features on your smartphone or other mobile devices and much more. The additional features of the App include taking quizzes, listening to music playlists, playing games and participating in on the spot contests. The App also allows you to receive information about live events, virtual events, and deals, promotions, special offers taking place near you.

CCS is the data controller (within the meaning of the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the "General Data Protection Regulation") responsible for the processing of your Personal Data described in the Privacy Notice.

In order to participate to special offers, loyalty programs, prize draws and other offers/promotions proposed on the App, you will have to be a registered user. In this context, the privacy notice available here (the "Registration Privacy Notice"): will apply to you, in addition to this Privacy Notice. We thank you to read this Registration Privacy Notice carefully as well.

The App is not intended for use by individuals under the age 13 (or under the age of consent in your country to form a binding agreement if the age of consent to form a binding agreement differ in your country). Please note that only individuals who are at 16 (or the age of consent for processing of personal data if the age of consent for processing of personal data differ in your country) can lawfully consent to the processing of their personal data. This means that individuals under the age of 16 (or under the age of consent for processing of personal data if the age of consent for processing of personal data differ in your country) cannot participate to the activities listed in section 4 when these are grounded on consent, such as receiving marketing communications and personalized push notifications based on location, and we will not process their personal data.

You can contact us by using the contact information provided in section 8 of this Privacy Policy.

The Personal Data we collect and process about you

If you are a registered user, the Personal Data below will be linked to those collected and processed in the context of the Registration Privacy Notice. When you use the App, we collect and process the following Personal Data:

• First name and last name
• Username and password
• Photo and video
• Email address
• Postal address and shipping address
• Country of residence
• Telephone number (including home and mobile phone numbers)
• Age
• Social media public profile
• Server log file information
• Information collected through cookies, pixel tags and other technologies
• Personal Data related to your interactions with our marketing communications (e.g. if you open them or not, if you click on them or not)
• Location data
• Voice recording
• User Generated Content (UGC)
• IP address
• Universal Time Coordinated (UTC)
• Social media profile
• Preferences and interests' information
• Promotion pin code
• Consumption habits
• Information pertaining to your use of the App (e.g. how many times and for how long do you interact with the App, what videos you have watched, what raffles or contests you have participated in, from which website you came, how many times you clicked on an item)
• Information about the device(s) you use to access to and interact with the App (e.g. this enables us to know if you are using a computer, a tablet or a smartphone, your screen resolution, your operating system, your Wi-Fi connection, your internet browser and your IP address)
• Behavioral Data: Information derived from the combination of the Device ID and the System events that may be used to identify behavioral trends and patters and send you marketing communications related to the events you have participated to
• Participation Data: Personal Data pertaining to your participation to the promotion, prize, poll, sweepstake, instant win promotion, contest and other types of promotions (e.g. type of promotion, date and time of participation to the promotion, outcome of the participation to the promotion, information required for your prize fulfillment, such as t-shirt and/or shoe size)

Sensitive Personal Data

We do not collect and process Personal Data pertaining to your:

• racial or ethnic origin
• political opinions
• religion or philosophical beliefs
• health or medical condition
• criminal background
• trade union membership
• genetic or biometric data
• sexual life or orientation

(referred to as "Sensitive Personal Data").

We ask that you not send us, and not to disclose, any Sensitive Personal Data through the Coca Cola App or otherwise to us.

We collect your Personal Data as follows:

• a. through the App: we collect your Personal Data when you download, access and use the App
• b. using cookies and similar technologies (such as pixel tags, web beacons, clear GIFs): we collect your Personal Data when you interact with the App, by using technologies such as web-beacons and similar technologies, that will permit us, for example, to find nearby products for you, get you real-time offers, and more; to provide you personalized marketing communications; to combat fraud; to analyze and improve how our products perform; to collect install data (device ID, traffic source, battery level, carrier, device model) to track media investment; and to fulfill other legitimate purposes. You can accept and reject these technologies (except when necessary for the proper functioning of the App) by adjusting your Mobile phone settings or your privacy preferences on your Profile settings, as explained in Section 4.
• c. through the Sites: We may collect Personal Data through the Sites, e.g., when you create an account in connection with our central Consumer Interaction Database.
• d. offline: we collect your Personal Data when you are not using the App, for example when you participate to Coca Cola events or when you contact customer service
• e. Subject to applicable data privacy law, the Personal Data you provide through the App may be combined with Personal Data and other Information that you provide to us (via online or offline means), or that we may otherwise obtain online or offline.
• f. when you actively provide Personal Data to us: we collect your Personal Data when you actively provide them to us, for example when you register to create an account, or post comments, photos and videos on the App, or record your voice in the context of your participation to a promotion, or chat with users
• a. To achieve the purposes described in this Privacy Policy, we combine together your Personal Data that are collected through the App, via cookies and similar technologies, when you are offline, and that you voluntarily provide. We also combine these Personal Data with other Personal Data that we have obtained from you when you used other Coca-Cola services, websites and/or applications.
• g. from your camera: The App may include functionality that permits you to use live video streams from your device camera, if you have affirmatively activated the camera for use with the Sites. This functionality is used to provide you with an enhanced interactive experience. We and our service providers do not collect, capture, or record the video-stream information or any information about faces in the video stream—the information stays on your device and is removed when you turn off the browser or app. However, we and our service providers may collect other information about how you use the functionality, such as how often and how long you use it.

• a. Respond to your inquiries and requests:

• • To respond to your inquiries, complaints and suggestions regarding the App, that you send us via customer service or other communication channels.

    Legal basis for processing: our legitimate interests to handle, adequately and in a timely manner, customers' inquiries, complaints and suggestions regarding the App.

• b. Inform you about changes to the Coca Cola App's terms and conditions and to this Privacy Notice:

• • To send you information about the changes to the App’s terms and conditions and to this Privacy Notice.

    Legal basis for processing: our legitimate interests to inform you well in advance of those changes taking effect.

• c. Marketing communications:
• • To send you or have our commercial partners (individually a "Commercial Partner" and collectively "Commercial Partners") send you direct marketing communications by email and push notifications. Direct marketing communications inform you about promotions or other similar activity, about Coca-Cola and affiliated brands' products and services (or those of our Commercial Partners), and ask you to complete questionnaires and surveys, among others. Direct marketing communications sent by our Commercial Partners may either be:
  • Fully handled and managed by our Commercial Partners. In such circumstances, the relevant Commercial Partner in charge of each direct marketing communication will act as data controller for the processing of your Personal Data. This processing will be subject to a data privacy notice, distinct from this Privacy Notice, established by such Commercial Partner
  • Handled and managed jointly by us and our Commercial Partners. In such circumstances, we and the relevant Commercial Partner will act as joint controllers for the processing of your Personal Data. We will enter into appropriate joint-controllership agreement with relevant Commercial Partner and the essence of this agreement will be made available to you.

  Legal basis for processing: your consent.

  You have the opportunity to accept or refuse to receive direct marketing communications by using the privacy dashboard id.coke.com of the App (you just have to activate the relevant toggle button if you want to receive marketing communications, and deactivate it from your Profile Settings).

  You can withdraw your consent to receive direct marketing communications, by clicking on the link "Unsubscribe" at the bottom of every marketing email, or by deactivating the toggle button on the privacy dashboard id.coke.com of the App. You can also let us know that you wish to withdraw your consent by email, by calling us or writing to us using the contact information listed in section 8 of this Privacy Notice.

• d. Personalization of marketing communications:

• We may tailor our marketing communications to you (including personalization of ads displayed on our digital properties and third-party websites (desktop and mobile) and mobile applications) based on (i) your profile information, (ii) how you interact with our App (e.g. logging in, entering a promotion, winning, quiz participation, uploading content) and / or (iii) your interactions with our marketing communications (e.g. if you open them or not, if you click on them or not, if you watch them or not, if you engage with them or not).

  Legal basis for processing: your consent.

  You have the opportunity to accept or refuse personalization of marketing communications, by using the id.coke.com accessible on the App (you just have to activate the relevant toggle button if you want to receive marketing communications, and deactivate the toggle button if not).

  You can withdraw your consent to have your marketing communications personalized by acceding to the id.coke.com and deactivating the toggle button. You can also let us know that you wish to withdraw your consent by email, by calling us or writing to us using the contact information listed in section 8 of this Privacy Notice.

• e. Promotions, special offers, loyalty programs, prize draws and other offers/promotions:
• To allow you to participate to promotions, special offers, loyalty programs, prize draws and other offers/promotions (e.g. for sending you reminder emails, transferring your Personal Data to fulfilment partners). Personal Data that must be provided to register to an offer/promotion usually comprise your email address, user ID and password.

Legal basis for processing: The processing of your Personal Data for this purpose is based on performance of the relevant promotion terms and conditions.

• f. Data analytics to derive trends & improve Coca-Cola products and services:
• We collect your Personal Data to measure your engagement with the App (e.g. to know how you use our App, when do you use our App, using what device) and derive consumption trends and patterns from this analysis. This helps us to know the App's users better and adapt our App to the identified preferences of the users, but also more generally Coca-Cola products and services.
Legal basis for processing: your consent

You have the opportunity to accept or refuse this collection and use of Personal Data for the purpose of performing data analytics to derive trends and improve our App and more generally Coca-Cola products and services by setting your privacy preferences on your Profile settings. You just have to activate the relevant toggle button if you want to have your Personal Data processed for the purpose of allowing us to perform data analytics to derive trends and improve our App and more generally Coca-Cola products and services, and deactivate the toggle button if not. The toggle button is deactivated by default.

You can withdraw your consent to the above mentioned purpose by acceding this page id.coke.com and deactivating the relevant toggle button. You can also let us know that you wish to withdraw your consent by email. Once you withdraw your consent, we will stop the processing for the concerned purpose.

• g. Personalized push notifications based on your location
• We collect information about your geolocation to send you personalized push notifications for location-based promotions and discounts.

Legal basis for processing: your consent

You have the opportunity to accept or refuse this collection and use of Personal Data for the purpose of sending you personalized location-based push notifications by setting your privacy preferences on your Profile settings. You just have to activate the relevant toggle button if you want to have your Personal Data processed for the purpose of sending you personalized location-based push notifications, and deactivate the toggle button if not. The toggle button is deactivated by default.

You can withdraw your consent to the abovementioned purpose by acceding this page id.coke.com and deactivating the relevant toggle button. You can also let us know that you wish to withdraw your consent [by email, by calling us or writing to us using the contact information listed in section 8 of this Privacy Notice]. Once you withdraw your consent, we will stop the processing for the concerned purpose.

• h. Technical functioning of the App
• We collect and use your Personal Data to technically administer the App and ensure that it functions properly. In particular, we collect device state information when the App crashes (such as unique device identifiers, physical location of the device at the time of the crash) to identify the cause of the crash and do what is necessary so that it does not happen again.

Legal basis for processing: our legitimate interests in ensuring that the App properly functions from a technical / IT point of view.

• i. Compliance with our legal obligations:
• To comply with our legal obligations, legal proceedings or government authorities' orders which can include orders from government authorities outside your country of residence, when we reasonably believe that we are legally required to do so and when disclosing your Personal Data is strictly necessary to comply with the said legal obligations, proceedings or government orders.

Legal basis for processing: compliance with our legal obligations.

• j. Lawful protection of our interests:
• To lawfully enforce our terms and conditions, protect our operations or those of any of our affiliates, protect our rights, privacy, safety or property, and/or that of our affiliates, and allow us to pursue available legal remedies or limit the damages that we may sustain.

Legal basis for processing: our legitimate interests to lawfully protect our organization.

• k. Mergers, acquisitions and other corporate operations:
• To perform any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings), and in that context transfer your Personal Data from our organisation to another organisation.

Legal basis for processing: our legitimate interests to conduct the corporate strategy.

• l. Fraud detection
• We process you profile information, information pertaining to your use of the App and information about the device(s) you use to access to and interact with the Services, to identify if any fraudulent installations of the App are being committed.

Legal basis for processing: our legitimate interests to protect our organization against fraud

Your Personal Data are disclosed to the following recipients:

• a. To your local entity of Coca-Cola Company which helps us in the management of our App.
• b. Endava, which helps us with the development of the App.
• c. CCH (Coca-Cola Hellenic) which conducts geo-targeted promotion.
• d. eBest which is our local fulfillment agency for reward distribution.
• e. Mixcode, which collects, verifies and manages the promotional pincodes entered by users and users' identifiers, allowing the concerned promotion, offer or similar event to take place.
• f. Google: we use Google BigQuery (i) for cloud storage of Personal Data, (ii) to aggregate Personal Data originating from different sources, (iii) to allow us to analyze the App's usage and users' engagement (e.g. how people use our App, when, with what device), and (iv) to allow us to derive trends and patterns from this analysis.
• g. Firebase, which processes your Personal Data for the purposes of analyzing the App's usage and users' engagement (e.g. how people use our App, when, with what device), [deriving trends and patterns from this analysis to personalize push notifications, and delivering push notifications to the App's users].
• h. Janrain, which hosts our record system containing consumer profiles.
• i. Epam, which operates and handles the Consumer Interaction Database
• j. Amazon Web Services, which provides cloud computing technology.
• k. CIC contractor
• l. Crashlytics, which collects information when the App crashes (such as your device identifier, device hardware and OS information, version of the App, physical location of the device at the time of crash) to report the crash to us.
• m. MRM McCann, for the sending of email communications and for analytics operations.
• n. Appsflyer, which processes your Personal Data (i) for mobile marketing analytics and attribution (i.e. determining which channels, campaigns, partners delivered each App install) and (ii) to detect fraudulent installations.
• o. Competent authorities: we can disclose your Personal Data to the extent strictly required by the law to competent authorities.
• p. Adobe campaign, which we use to send you direct marketing communications via email or push notifications.
• q. Microsoft Azure, which we use for data lake storage and analytics.

To achieve the purposes described in this Privacy Notice, we transfer your Personal Data to countries that do not offer an adequate level of protection, such as the United States and Serbia.

Our data transfers to the countries that do not offer an adequate level of protection are subject to either of the following appropriate safeguards in accordance with the GDPR, to guarantee that your personal data are adequately protected:

- Standard data protection clauses adopted by the EU Commission under article 46 paragraph 2 of the GDPR (click here to access the EU Commission's decision on standard contractual clauses for transfers to processors established in third countries); and - EU-U.S. Privacy Shield for transfers to entities located in the United States (click here to access to the EU Commission's decision pertaining to the EU-U.S. Privacy Shield).

To obtain any relevant information regarding any transfers of your Personal Data to third countries (including the relevant transfer mechanisms), please contact our Privacy Office at this address privacy@coca-cola.com.

When using the App, you can come across links to other websites, applications and platforms that are not provided by us but by other companies. We are not responsible for such websites, applications and platforms, and this Privacy Notice does not apply to them. You should read the policies and rules that such companies have posted on their websites, applications and platforms to understand how they protect your privacy.

• a. Your rights as regards our processing of your Personal Data

• As regards our processing of your Personal Data described in this Privacy Notice, you have the right under certain circumstances:

• to be provided with a copy of any Personal Data that we hold about you, and receive information about our processing of your Personal Data;
• to require us to update or correct any inaccurate Personal Data, or complete any incomplete Personal Data
• to require that we stop processing your Personal Data (i) for personalization of marketing push notifications, (ii) for the purpose of performing data analytics to derive consumer behaviors' trends and patterns and improve our Coca-Cola products and services, (iii) for personalization of location-based push notifications, (iv) for the purpose of sending you direct marketing communications.

You also have the right, in certain circumstances:

• to object to the processing of your Personal Data
• to require us to delete your Personal Data
• to restrict our processing of your Personal Data and
• to require us to transmit certain of your Personal Data to you or to transfer or have them transferred to another data controller.
• b. Contacting us to exercise your rights

• If you wish to exercise any of your above rights, you can contact us using one of the options below.

• You can send us an email to the following address: DPO-Europe@coca-cola.com

Please specify clearly which information you would like us to provide you with, review, amend, stop processing, or delete.

You can also contact us if you have any questions or queries as regards our processing of your Personal Data, using the contact options above.

• c. Our Data Protection Officer (DPO) contact details

You can contact our Data Protection Officer (DPO) at the following address: DPO-Europe@coca-cola.com.

• d. Right to lodge a complaint to the competent data protection authority

You have a right to lodge a complaint with the relevant supervisory authority (in particular in the Member State of your habitual residence, place of work or place of the alleged infringement), if you are of the opinion that any of your Personal Data is processed in a manner constituting an infringement of the EU General Data Protection Regulation n°2016 / 679 dated 27 April 2016.

• a. We intend to keep your Personal Data accurate and up-to-date. We will delete the Personal Data that we hold about you when we no longer need it.
• b. We keep your Personal Data that we use for the purposes described in this Privacy Notice for a period of 2 years maximum, except where legal requirements imposing that we keep your Personal Data longer or less longer apply. We keep your Personal Data that we use for purposes of allowing you to participate to promotions, loyalty programs and similar programs, carrying out the promotions and similar programs until their fulfillment, for a period of 10 years maximum.

This Privacy Notice is governed by and shall be construed in accordance with the laws of Belgium and any other mandatory provisions of applicable laws in the European Union.