Craft Beverages B.V. (hereinafter: “Craft Beverages”, “we”, “us”) values your privacy and the
protection of your personal data. Therefore and in accordance with the General Data Protection
Regulation (“GDPR”), we have taken measures to ensure the correct, careful and accurate processing
of your personal data. In this privacy statement we inform you on how we handle your personal data,
what your rights are and how you may exercise them.

1. Responsibility

The processing of personal data in the context of communicating with you is carried out under the
responsibility of Craft Beverages, located at Strawinskylaan 613, Toren A, WTC 1077 XX – Amsterdam, The Netherlands.
If you have any questions, complaints and/or other comments about the processing of personal data by Craft
Beverages, please contact info@craftbeverages.eu.

2. Personal data

Personal data includes all information of an identified or identifiable (natural) person. We process
personal data that you provide directly to us, such as your name and contact details, including your
phone number and e-mail address.

3. Purposes and grounds

In accordance with the GDPR, we may process personal data when you contact us via e-mail. Your
personal data will be used primarily to handle your inquiry and provide you with an appropriate
response. We will not process your personal data for other purposes, unless you request us to do so
for example when engaging a (commercial) relationship.

We also use cookies on our website for tracking. For this we collect your consent. For more
information on cookies we refer to our cookie policy.

Craft Beverages only processes your personal data on a lawful basis. We might process your personal
data on the basis of your consent, to execute or prepare an agreement with you, on the basis of a
legal obligation (such as financial administration) and for our legitimate interest. This legitimate
interest is to provide you with an appropriate response to any inquiry.

The basis for the processing of personal data by Craft Beverages is found in article 6, paragraph 1,
point a, b, c and f of the GDPR.

4. Provision of your personal data to third parties

Craft Beverages may provide your personal data to other parties. We will only do so if this is
necessary to perform the agreement between you and Craft Beverages or if a legal obligation
requires it. In addition, we use processors that process your personal data on behalf of us. This
includes:

– Cloud provider (Netherlands)

– Website host (Netherlands)

5. Security

Craft Beverages shall ensure adequate security by implementing, periodically evaluating and, where
necessary, adjusting appropriate technical and organizational security measures aimed at preventing the loss and/or unlawful processing of personal data. Craft Beverages will regularly evaluate whether the technical and organizational security measures taken, still constitute an appropriate and adequate level of security or whether additional measures are required to ensure the protection of personal data.

6. Retention period

Your personal data will not be retained longer than necessary for the purposes described in this
privacy statement, unless Craft Beverages is required by law. Your personal data will be stored for as
long as necessary to properly respond to your message via e-mail. If you do not enter into a
(commercial) relationship with Craft Beverages, we will delete your personal data within 1 year after
handling your request appropriately.

7. Your rights

You, as a data subject, have different rights based on the GDPR. To exercise your rights, you can
contact us via the contact details provided above. You may invoke the following rights.

– The right to access the personal data that Craft Beverages processes about you.

– The right to have inaccurate or incomplete personal data that Craft Beverages processes
about you rectified and/or completed.

– The right to have the use of your personal data restricted.

– With regard to data processing based on a legitimate interest of Craft Beverages, you have
the right to object.

– The right to have personal data deleted, e.g. when personal data are processed unlawfully or
retention periods have expired.

– You have the right to withdraw your consent at any time, if the processing of your personal
data by us is based on consent.

– To the extent that Craft Beverages processes personal data based on your consent or to give
effect to a contract with you, you have the right to receive that data in a structured,
commonly used and machine-readable form and/or to have it transferred to a third party.

Craft Beverages does not use automated decision-making and/or profiling.

8. Complaints

Complaints regarding the processing of your personal data by Craft Beverages can be addressed to
the contact details provided above. We request you to provide sufficient grounds for your complaint
in order for us to provide an appropriate response. Craft Beverages will respond to your complaint in
writing as soon as possible, but no later than one month after receipt. If this does not provide a
satisfactory response to your complaint, we will be happy to consult with you about a suitable
solution. We would like to draw your attention to the fact that you also have the right to submit a
complaint to the Dutch supervisory authority at any time (in Dutch: Autoriteit Persoonsgegevens’).

9. Amendments to this privacy statement

This privacy statement may be amended or updated from time to time. The most up-to-date version
of the privacy statement is always published on our website. We, therefore, advise you to consult our
website (at least) when you provide us your personal data.

Amsterdam, October 2022