Privacy Policy

Issue Date:May 2018

Last Update: Jan 2021

1. INTRODUCTION

This Privacy Policy (the “Privacy Policy”) provides detailed information on how Fonthill Waters Limited (“FONTHILL”) uses and protects your personal data when browsing our website www.springwisebottledwater.co.uk (the “Website”), as well as your rights in this respect. This Privacy Policy applies to the processing of personal data provided by you or that we obtain from you when you access and use the Website, be it for browsing the Website, purchasing our products or services, requesting information from us, contacting us, submitting an application or making use of the functionalities or services available on the Website. FONTHILL respects your right to privacy and complies with the current legislation on personal data protection, including the new General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, applicable from 25 May 2018, as well as any other rules that may develop or supplement it in the future. We recommend that you carefully review our Privacy Policy to ensure that you understand how your personal data is used when browsing the Website.

2. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?

The data controller is the legal person that determines the purposes and means of the processing of personal data. In other words, the controller decides how and for what purpose personal data are processed. For the purposes of this Privacy Policy, the data controller is FONTHILL: Fonthill Waters Limited with its registered office address at C.O Aimia Food Holdings Penny Lane, Haydock, Merseyside, WA11 0QZ registered in The UK with registered company number 04107923.

3. WHO CAN YOU CONTACT AT FONTHILL REGARDING THE PROTECTION OF YOUR PERSONAL DATA?

If you have any questions or wish to receive more information regarding the processing or protection of your personal data, you may contact us via any of the following: Data Controller: Fonthill Waters Limited Postal Address: 39-42 Tir Llwyd Industrial Park, Kinmel Bay LL18 5JA England Telephone: 01745 343504 You may also contact us by email at sales@springwisebottledwater.co.uk

4. WHAT IS PERSONAL DATA?

Personal data is any information relating to an identified or identifiable natural person.

5. WHAT PERSONAL DATA ARE PROCESSED BY FONTHILL?

For the purposes laid out in this Privacy Policy, FONTHILL collects and processes the following personal data: 1. a) Identifying data: name and surname. 2. b) Contact information: postal address, email address, landline telephone number, mobile telephone number. 3. c) Transaction data: information on purchases, orders, contracts, billing and collection, payment methods, bank details, debit or credit card details, delivery instructions (only if you have opted to provide any such delivery instructions) and any other data relating to your transactions with us. 4. d) Electronic data: IP address, device type and ID, browser type and language, domain through which the Website is accessed, browsing information, Website activity. FONTHILL does not intentionally collect information on minors, except with the express consent of their parents or legal guardians. You guarantee to be over 16 years old. If you know or suspect that FONTHILL has personal data of minors, please contact us through any of the channels indicated in section 3 of this Privacy Policy WHO CAN YOU CONTACT AT FONTHILL REGARDING THE PROTECTION OF YOUR PERSONAL DATA? and this information will be removed.

6. COLLECTION AND OBTENTION OF PERSONAL DATA

FONTHILL collects and processes personal data that you voluntarily provide us when interacting with our Website, in particular when: • requesting information or quotes for our products and services; • subscribing to our newsletter; • registering to our Customer Zone or renewing access to the Customer Zone; • checking service availability for your home or location; • acquiring and paying for FONTHILL products or services; • where you have consented, using your stored payment information for future transactions; • requesting technical assistance or assistance relating to FONTHILL’s services; • sending us your CV with the aim of taking part in recruitment processes. You are only obliged to provide personal data that is necessary for FONTHILL to provide you services or make available to you the functionalities of the Website that you have requested. For example, if you wish to receive FONTHILL’s newsletter, it will necessary for you to provide us with your email address. If you request information from us or would like us to contact you, you must provide us with the contact information needed for these purposes. If you wish to acquire any product or service that FONTHILL makes available on its Website, it will be necessary that you provide all of the information required on the order page of the website, although you will not be required to tick the voluntary check-boxes to consent to receiving marketing or the storage of your payment information. If you do not provide us with the required personal data, it would not be possible for us to provide you with our goods or services. If not all the required information is provided or if we receive an unusual or incorrect response, we will not be able to process your request or provide you with the corresponding service or functionality. In any event, you guarantee and are liable for the truthfulness, accuracy, validity and authenticity of the personal data provided and undertake to keep them duly updated. It is not necessary to provide us with your personal data to browse the Website. However, when visiting our Website, FONTHILL collects, automatically and through cookies, depending on your browser specific settings, the following information: IP address, device type and ID, browser type and language, domain through which the Website is accessed, browsing information, Website activity. For more information, please refer to our Cookies Policy at www.springwisebottledwater.co.uk

7. WHAT DO WE USE YOUR PERSONAL DATA FOR? PURPOSES AND LEGAL BASIS FOR DATA PROCESSING

In general, the personal data you provide to us and that we obtain from you are used to process your requests and transactions, to provide you with high-quality service and to inform you about opportunities we believe may interest you. Below are the specific purposes for which we process your personal data: 1. a) To provide you with information you request, including quotes of products and services. In this case, your consent is the legal basis for processing your data. 2. b) To send you our newsletter with information, promotions, campaigns and news on products and services of Fonthill Waters Ltd and products and services of third parties marketed and distributed by FONTHILL. In this case, your consent is the legal basis for processing your data. 3. c) To check service availability at your home or location. In this case, the need to take steps, at your request, prior to entering into a contract is the legal basis for processing your data. 4. d) To register you as a customer, process your transactions, manage the contractual relationship with you, grant you access to the private customer area, send you relevant information on products and services, notifications of delivery, maintenance, invoicing, collections and payments, process transactions and payment methods as well as any other service communication or communications related to your contact and transactions, management of loyalty programmes, discounts and promotions, perform satisfaction surveys or surveys related to products and services marketed and distributed by FONTHILL. In this case, the legal basis for processing your data is, if you are a residential customer, the performance of the product sales contract or the service provision contract with FONTHILL; and, if you are a corporate customer, our legitimate interest in contracting and providing our services to the company at which you are employed or provide services to. 5. e) To create an account to provide you with access to the Customer Zone, to renew access to the Customer Zone and to provide you with access to the information and services available therein: information on your customer account, billing and payments, order placements, information on products and services marketed and distributed by FONTHILL, management of loyalty programmes, discounts and promotions. In this case, the legal basis for processing your data is, if you are a residential customer, the execution of the agreement of the sale of products or provision of services with FONTHILL; and, if you are a corporate customer, our legitimate interest in contracting and providing our services to the company at which you are employed or provide services to. 6. f) To respond to requests for technical support or support relating to FONTHILL’s services. In this case, your consent and our fulfilment of our contract with you are the legal basis for processing your data. 7. g) To store your data and contact you regarding recruitment and staff selection processes at FONTHILL, as well as to manage your participation in said processes. In this case, your consent is the legal basis for processing your data. 8. h) If you give your consent, to send you marketing communications on our products and services and on products and services of third parties marketed and distributed by FONTHILL, our publications, opinion surveys, promotional and advertising information, coupons, offers (including customized offers) and recommendations of our products and services as well as of products and services of third parties marketed and distributed by FONTHILL, according to your interests and based on a profile developed by us, by phone, post, email, SMS and MMS. In this case, your consent is the legal basis for processing your data. 9. i) To guarantee the security of our Website and of the information. In this case, the legal basis for processing your data is the legitimate interest in providing a secure environment and preventing harm to FONTHILL’s systems and to the users’ information, as well as unauthorized access to and misuse of FONTHILL’s systems and users’ information. 10. j)For internal management purposes: planning, resource allocation, policy development, quality improvement, strategic analysis, marketing and commercial development, monitoring, audit, compliance with legal obligations and, adoption, where appropriate, of legal measures, evaluation and reporting. In this case, the legal basis for processing your data is our legitimate interest in understanding and analysing the development of our business, improving our products and services, and exploring ways to develop and enhance our business. 11. k) With regard to the use and purpose of cookies, please refer to our Cookies Policy at www.springwisebottledwater.co.uk.In this case, your consent is the legal basis for processing your data. When the basis for data processing is consent, you may withdraw it at any time by sending a communication to sales@springwisebottledwater.co.uk, including your name and address for communication and verification purposes and providing the necessary details to process your request. You may always contact us through any of the channels indicated in section 3 of this Privacy Policy: WHO CAN YOU CONTACT AT FONTHILL REGARDING THE PROTECTION OF YOUR PERSONAL DATA? Bear in mind that receiving marketing information is not essential to maintain the relationship we have with you. If you prefer not to receive marketing communications, you may inform us at any time through the means indicated or opt-out at the link provided for these purposes in the marketing communications that you receive by email, or if the communications are provided by other means, through the procedure indicated for these purposes. If you purchase any goods or services through our Website, we will only store your debit or credit card details for future purchases if you consent to use doing so using the checkbox provided. Consenting to this by ticking the checkbox is not necessary to complete your purchase. If you have consented to Fonthill storing your card details for future purchases, you can revoke this consent at any time (by contacting us through any of the channels indicated in section 3 of this Privacy Policy WHO CAN YOU CONTACT AT FONTHILL REGARDING THE PROTECTION OF YOUR PERSONAL DATA?). To what extent is decision-making automated? FONTHILL does not use completely automated decision-making processes to engage in, develop or terminate a contractual relationship with you. If we were to use these processes in a specific case, we would inform you, communicate your rights in this respect and comply with our legal obligations in accordance with applicable regulations. Will you use profiling? With the aim of being able to offer you products and/or services in accordance with your interests and to improve your user experience, we may develop a “commercial profile” based on the information provided. However, automated decisions will not be taken based on said profile.

8. WHO WILL WE SHARE YOUR PERSONAL DATA WITH?

We only use, transfer or share personal data with third parties in accordance with the terms laid out in this Privacy Policy. FONTHILL does not sell or rent your personal data to third parties and only communicates personal data to persons or entities if we obtain your prior consent or pursuant to or in accordance with applicable legislation when consent is not necessary for a specific transfer. We will share or give third parties access to your personal data when necessary to achieve one of the objectives described below and in accordance with current legislation: 8. Our suppliers. FONTHILL shall communicate or allow access to your personal data to companies that provide services to us under a contract, when it is necessary to achieve one of the purposes described in section 7 of this Privacy Policy WHAT DO WE USE YOUR PERSONAL DATA FOR? – PURPOSES AND LEGAL BASES FOR DATA PROCESSING: IT and web platform services, management of orders and shipping, payment processing, email distribution, call centres, web positioning services, marketing, market analysis and organization of promotional campaigns. If any of these service providers needs to access your personal data, they will use it only to provide us with a service and according to our instructions. We also require them to keep the data confidential and secure and to return or destroy the data when they no longer need it. Some of these suppliers are located abroad, so these transfers may imply an international transfer of your personal data as described in section 8.d 9. Legal obligations: FONTHILL may communicate your personal data when the transfer is necessary to comply with a legal obligation, including the transfer to competent authorities, judges and courts. This includes complying with requests made by authorities regarding the prevention of money laundering and the financing of terrorism. 10. Fonthill Water Limited companies: FONTHILL shall allow access to your personal data to Fonthill Water Limited companies for the purposes described in section 7.j) of this Privacy Policy WHAT DO WE USE YOUR PERSONAL DATA FOR?PURPOSES AND LEGAL BASES FOR DATA PROCESSING, or when required for the establishment, exercise or defense of legal claims, or to comply with a statutory requirement. FONTHILLshall allow access to your personal data to companies belonging to Fonthill Water Limited that provide services to us and act as data processor. Fonthill Water Limited companies are located within and outside the European Economic Area (EEA), so these transfers may involve an international transfer of your personal data as described in section 8.d). For additional information about Fonthill Water Limited and its structure, visit www.springwisebottledwater.co.uk/about-us/. 11. International data transfers. Your data may be disclosed to other companies within the Fonthill Water Limited and to data processors, within and outside the European Economic Area (EEA). In some cases, the laws of countries outside the EEA do not provide the same level of protection of your personal data as those inside the EEA. However, to the extent that your personal data is transferred outside the EEA, such transfers will be based on adequacy decisions or standard contractual clauses adopted by the European Commission.

9. WHAT MEASURES DO WE APPLY TO KEEP YOUR PERSONAL DATA SAFE?

FONTHILL takes the appropriate technical and organisational measures in accordance with current regulations to protect your personal data against any misuse, destruction, loss, accidental or illicit modification, disclosure or unauthorised access, including the measures necessary to deal with any suspected data breaches. The Website has a log-in system, with a user name and password, through which only authorised users can access the private Customer Zone area. FONTHILL shall not use this information at any time for any use other than maintenance of the mentioned Customer Zone, to manage the business relationship with you, as well as to offer any services available in the Customer Zone. You agree to keep and use the user name with due care and diligence. The use of the password is personal and non-transferable and the transfer of the password to third parties is not allowed, not even temporarily. In that regard, you must take the necessary measures to safeguard your password, preventing its use by third parties. Accordingly, you are solely responsible for the use of your password and FONTHILL shall not be liable in respect of any loss or damage connected with the mis-use of your password. If you are aware of or suspect that your password is being used by third parties or that personal data may be being misused or accessed without authorization, please notify us as soon as possible through any of the channels indicated in section 3 of this Privacy Policy WHO CAN YOU CONTACT AT FONTHILL REGARDING THE PROTECTION OF YOUR PERSONAL DATA?

10. HOW LONG DO WE RETAIN YOUR DATA?

FONTHILL shall retain your personal data for the time necessary to fulfil the purposes for which they were collected, or while you do not exercise your right to erasure or to withdraw your consent. The data will be subsequently deleted, unless a longer retention period is required or permitted by law (for instance, for the establishment, exercise or defence of legal claims) in which case they will be duly retained as long as required before deleting them. To determine an appropriate retention period of your data, we apply the following criteria: 1. a) The data necessary to provide you with the information you request, including quotes of products and services, shall be retained for the time necessary to attend to and process said requests, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation. 2. b) The data necessary to send you the newsletter shall be retained so long as you do not withdraw your consent or inform us of your wish to not continue receiving it, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation. 3. c) The data required to register in our Customer Zone shall be retained during the term of the contract with FONTHILL, so long as you do not unsubscribe to the private area, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation. 4. d) The data necessary to check the availability of service at your home or location shall be retained so long as it is strictly necessary for these purposes, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation. 5. e) The data related to the acquisition of FONTHILL products and services in the context of a contractual relationship shall be retained during the term of the contract with FONTHILL or for the time necessary to exercise the rights and comply with the obligations of the contract with FONTHILL, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation. 6. f) The data necessary to attend to your requests for technical support or those related to FONTHILL products and services shall be retained for the time necessary to attend to and process said requests, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation. 7. g) When you consent to receive marketing communications, your data shall be retained so long as you do not withdraw your consent or inform us of your wish to not continue receiving these communications, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation. 8. h) The data sent with a view to participate in recruitment/staff selection processes shall be retained on a general basis for 3 years, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation. 9. i) When cookies are placed on your device, the data shall be retained in accordance with the applicable legal requirements and the recommendations made by the competent authorities.

11. WHAT ARE YOUR RIGHTS WITH RESPECT TO THE PROCESSING OF YOUR PERSONAL DATA?

In accordance with the applicable legislation, you have specific rights with regard to the collection and processing of your personal data. These rights are the following: 1. a) Right to information: You have the right to be informed about the use and processing of your personal data in a concise, transparent, intelligible and easily accessible manner, and with clear and simple language. 2. b) Right of access: You have the right to request from us, at any time, that we confirm if we are processing your personal data, that we provide you with access to said data and to the information about the processing of them, and to obtain a copy of said data. The copy of your personal data that we provide you shall be free, although the request for additional copies could be subject to a reasonable fee based on administrative costs. On our part, we may request that you give proof of your identity or require more information from you in order to handle your request. 3. c) Right to rectification: You have the right to request the rectification of inaccurate, outdated or incomplete personal data that concerns you. You may also request that any personal data that may be incomplete is completed, including by means of providing a supplementary statement. 4. d) Right to erasure: You have the right to request the erasure of your personal data when, among other things, the data are no longer necessary for the purposes for which they were collected or processed. However, this right is not absolute so that FONTHILL may continue to keep them, duly blocked, in those cases laid down in the applicable regulations. 5. e) Right to restriction of processing: You have the right to request that we restrict the processing of your personal data, which means that we may continue storing them, but may not continue processing them if any of the following conditions is met: – that you contest the accuracy of the data, during a period that allows us to verify the accuracy of said data; – the processing is unlawful and you oppose the erasure of the data and request the restriction of their use instead; – FONTHILL no longer needs the data for the purposes of processing, but you need them for the establishment, exercise or defence of legal claims; – You have objected to the processing, pending the verification whether FONTHILL’s legitimate grounds override yours. 1. f) Right to data portability: You have the right to have your data transferred to another data controller in a structured, commonly used and machine-readable format. This right is applied when the processing of your personal data is based on consent or on the execution of a contract, and said processing is carried out by automated means. 2. g) Right to object: This right allows you to object to the processing of your personal data, including profiling. We shall no longer process your data unless we demonstrate compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims. 3. h) Right to withdraw consent: In those cases in which we have obtained your consent to process your personal data in connection with certain activities (for example, with the aim to send you marketing information), you may withdraw it at any time. 4. i) The right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the UK Information Commissioner’s Office at https://ico.org.uk/concerns/. You may exercise your rights by sending a communication to sales@springwisebottledwater.co.uk, including your name and address for communication and verification purposes and providing the necessary details to process your request. If you wish to withdraw the consent given to receive marketing communications, you may inform us at any time through the means indicated or opt-out at the link provided for these purposes in the marketing communications that you receive by email, or if the communications are provided by other means, through the procedure indicated for these purposes. If your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may either charge a reasonable fee, considering the relevant administrative costs, or we may not act on the request. For further information on your rights you may contact us through any of the channels indicated in section 3 of this Privacy Policy, WHO CAN YOU CONTACT AT FONTHILL REGARDING THE PROTECTION OF YOUR PERSONAL DATA?

12. AMENDMENTS

Fonthill Waters Limited may amend this Privacy Policy to adapt it to the changes that the Website may undergo or in relation to the processing of your personal data or as required by law, from time to time. Any such updates will be posted by Fonthill Waters Limited on the Website as they occur.