Data protection Members of the Whisky Club Luxembourg A.s.b.l. (the "Whisky Club Luxembourg") (the "Members") are informed that the Whisky Club Luxembourg, as data controller (the “Data Controller”), collects, stores and processes by electronic or other means the personal data (i.e. any information relating to an identified or identifiable natural person) supplied by the Member at the time of their application (and at any other time during the relationship) or otherwise collected by the Whisky Club Luxembourg (hereafter, the “Personal Data”), in accordance with data protection law applicable in Luxembourg (including, but not limited to, the law of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework, as amended from time to time (the "2018 Law") and the Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation”, together with the 2018 Law, the "Data Protection Law")), for the purpose of performing the related services and/or for complying with its legal and regulatory obligations as described below. The Members’ Personal Data will be processed (i) as a result of the application of the Member to the Whisky Club Luxembourg and to provide the related services to the Member or to take steps at the request of the Members prior to such application and/or, (ii) where necessary to comply with applicable laws and regulations (iii) the Personal Data will be processed based on the legitimate interests of the Whisky Club Luxembourg and/or the Data Processors, which mainly consist in the provision of the related services to the Members Personal Data processed may include amongst others (i) the names, addresses, telephone numbers, business contact information, financial information, age, and any other information that is necessary to the Whisky Club Luxembourg and/or the Data Processors to perform the related services or to comply with applicable laws and regulations. Such Personal Data is collected directly from the Members or may be collected through publicly accessible sources, social media, subscription services, other third party data sources or, through the Member’s authorised intermediaries, (including, without limitation, legal representatives), or employees. In particular, Personal Data may be processed for the purpose of carrying out the services provided by the Whisky Club Luxembourg or the Data Processors such as, for the purposes of administration, processing the application of each Member, processing annual membership fees, handling communications to the Members, and any other agreement entered into by the Data Controller and its service providers that is communicated or made available to the Member. Personal Data may also be processed in order to comply with legal or regulatory obligations including, but not limited to, legal or regulatory obligations under applicable non-profit (such as maintenance of the register of Members, anti-money laundering and counter-terrorist financing law (such as carrying out member due diligence). The Personal Data will be processed and/or disclosed (i) as a result of the application of the Member to the Whisky Club Luxembourg and to provide the related services to the Member and/or, (ii) where necessary to comply with applicable laws and regulations and/or, (iii) where their application is not entered into directly by the Member as natural persons, the Personal Data will be processed and/or disclosed where necessary for the purpose of the legitimate interests pursued by the Whisky Club Luxembourg and/or the Data Processors, which mainly consist in the provision of the related services to the Member or compliance with foreign laws and regulations and/or any order of a foreign court, government or regulatory authority, including tax authority Personal Data may be disclosed to and processed by accountants, legal and financial advisors, the other service providers of the Whisky Club Luxembourg, and, court, governmental or regulatory bodies and, any of the foregoing’s processors, affiliates, agents, delegates, subcontractors, or their successors and assigns as well as, any other recipient as provided in the agreements entered into by the Whisky Club Luxembourg and its service providers which is communicated or made available to the Members ; any of which may act as data processor on behalf of the Whisky Club Luxembourg for providing the services resulting from the articles of incorporation of the Whisky Club Luxembourg (and related services) to the Whisky Club Luxembourg or to the Members or, in certain circumstances, as data controller in particular for compliance with their legal obligations in accordance with applicable laws and regulations (such as anti-money laundering identification) and/or order of competent jurisdiction (together hereafter the “Data Processors”). The Members acknowledge that the Entities may be located outside of the European Economic Area (“EEA”) in countries which do not ensure an adequate level of protection according to the European Commission and where data protection and/or professional secrecy laws might not exist or be of a lower standard than in the EEA (such as for instance the United States of America). The Whisky Club Luxembourg, undertakes not to transfer the Personal Data to any third parties other than the Data Processors, except as disclosed herein or if required by applicable laws and regulations or court order. By becoming a member of the Whisky Club Luxembourg, the Member acknowledges and accepts, that transfer of Personal Data may take place to countries which do not have equivalent data protection laws to those of the EEA, or that are not subject to an adequacy decision of the European Commission, including the Data Protection Law and the Luxembourg law of 5 April 1993 on the financial sector which provides for a professional secrecy obligation (including but not limited to the United States of America). The Data Controller may only transfer the Personal Data for the purposes of providing to the Members the services resulting from the articles of incorporation and other related services resulting from any agreement entered into between the Whisky Club Luxembourg and a service provider or for compliance with applicable laws and regulations, as described herein. The Whisky Club Luxembourg may transfer the Personal Data to the Data Processors (i) on the basis of an adequacy decision of the European Commission with respect to the protection of personal data and/or on the basis of the EU-U.S. Privacy Shield framework or, (ii) on the basis of appropriate safeguards listed by and subject to the provisions of Article 46 of the General Data Protection Regulation (when applicable), such as standard contractual clauses, binding corporate rules, an approved code of conduct, or an approved certification mechanism or, (iii) on the basis of the Member’s explicit consent or, (iv) where necessary for the performance of the services resulting from the articles of incorporation or, (v) where necessary for the performance of the services of the Data Processors rendered in connection with the articles of incorporation or, (vi) where necessary for important reasons of public interest or, (vii) where necessary for the establishment, exercise or defense of legal claims or, (viii) where the transfer is made from a register which is legally intended to provide information to the public and which is open to consultation, in accordance with applicable laws and regulations, provided that the transfer does not involve the entirety of the personal data or entire categories of the personal data contained in such register or, (ix) subject to the provisions of Article 49.1 of the General Data Protection Regulation (when applicable), where the transfer is necessary for the purposes of compelling legitimate interests pursued by the Whisky Club Luxembourg which are not overridden by the interests or rights and freedoms of the relevant data subjects. Where the transfer of Personal Data to Data Processors outside of the EEA takes place on the basis of the consent of the Members, the Members are entitled to withdraw their consent at any time without prejudice to the lawfulness of the data transfers carried out before the withdrawal of such consent and the Data Controller will accordingly cease such transfers, but without prejudice to the potential reliance on other applicable legal basis (as described above) for the transfer to take place in accordance with Data Protection Law. Any change to, or withdrawal of, the Member’s consent can be communicated in writing to the Whisky Club Luxembourg to the attention of Mr Jérôme Mausen at the address of [email protected]. Each Member acknowledges and accepts that the Data Controller as well as, where relevant, the Data Processors, may be required by applicable laws and regulations to transfer, disclose and/or provide Personal Data, in full compliance with applicable laws and regulations, and in particular Article 48 of the General Data Protection Regulation (when applicable), to supervisory, tax, or other authorities in various jurisdictions, in particular those jurisdictions where members are resident, domiciled or citizens. Failure to provide relevant Personal Data requested in the course of its relationship with the Whisky Club Luxembourg may prevent such Members from exercising their rights in relation to the Whisky Club Luxembourg and such Members may be required to withdraw completely or partially from the Whisky Club Luxembourg. This failure may also need to be reported by the Whisky Club Luxembourg to the relevant Luxembourg authorities to the extent permitted and/or required by applicable laws and regulations. Each Member may request (i) access to, rectification of or deletion of any incorrect Personal Data concerning him, (ii) a limitation to a processing of Personal Data concerning him and, (iii) the portability of any Personal Data concerning him processed by the Data Controller or the Data Processors acting on its behalf and (iv) to obtain a copy of or access to the appropriate or suitable safeguards which have been implemented for transferring the Personal Data outside of the EEA, in the manner and subject to the limitations prescribed in accordance with Data Protection Law. In particular, a Member may at any time object, on request and free of charge, to the processing of its Personal Data for direct marketing purposes. Each Member should address such requests to the Whisky Club Luxembourg to the attention of Mr Jérôme Mausen at the address of [email protected]. For any additional information related to the processing of their Personal Data, Members can contact the Data Protection Officer of the Data Controller via post mail at 1, place Thomas Edisson, L-1483 Strassen or via email at [email protected]. Members are entitled to address any claim relating to the processing of their Personal Data carried out by the Data Controller in relation with the services provided in accordance with the articles of incorporation to the relevant data protection supervisory authority (i.e. in Luxembourg, the Commission Nationale pour la Protection des Données). By applying for membership, each Member acknowledges and accepts the aforementioned processing of Personal Data and, in particular, the disclosure and transfer of their Personal Data to, and the processing of their Personal Data by, the Data Controller and the Data Processors, including by parties which may be located in countries outside the European Union (including but not limited to the United States), which may not offer a similar level of protection as that under applicable laws and regulations in Luxembourg and the EEA. This acceptation is formalised by paying the annual membership fee. Insofar as the Personal Data provided by Members include Personal Data of their individual representative(s) (including, without limitation, legal representatives), directors, officers, employees and/or ultimate beneficial owners (as applicable), the Members represent that they have authority to provide those Personal Data to the Data Controller. If Members are not natural persons, they confirm that they have undertaken to (i) inform any natural person about whom the Members provide Personal Data about the processing of the Personal Data and their rights as described under the present section, in accordance with the information requirements under the Data Protection Law, as described under the present section and (ii) where necessary and appropriate, obtained in advance any consent that may be required for the processing of Personal Data as described under this section, and in accordance with the Data Protection Law, in particular, for the transfer of Personal Data to the Data Processors referred to above, including in countries outside the European Union. The Data Controller may assume, where applicable, that the Member’s individual representative(s) (including, without limitation, legal representatives), directors, officers, employees and/or ultimate beneficial owner(s) (as applicable) have, where necessary, given such consent and have been informed of the processing of their Personal Data and of their rights as described under this section. The Personal Data is held until the Members cease to be a member in the Whisky Club Luxembourg and a period of 5 years thereafter where necessary to comply with applicable laws and regulations or to establish, exercise or defend actual or potential legal claims, subject to the applicable statutes of limitation, unless a longer period is required by applicable laws and regulations. In any case, Personal data shall not be held for longer than necessary with regard to the purpose of the data processing, subject always to applicable legal minimum retention periods. Members acknowledge and accept that the Data Controller and the Data Processors processing the Personal Data on its behalf will accept no liability with respect to unauthorised third party receiving knowledge of, or having access to, their Personal Data, except in the case of proven negligence or serious misconduct by the Data Controller or such Data Processors or by any of their respective employees, officers, directors, affiliates, agents and sub-contractors.