This Privacy Policy refers to the processing of personal data obtained through this Website or any of the channels enabled for this purpose, carried out by the Data Controller.

1. Who is the Data Controller?

• Data Controller: MAHOU, S.A. with CIF A-28078202, (hereinafter, “Mahou”).
• Data Protection Officer email: consultasprivacidad@mahou-sanmiguel.com

2. Obligation to provide the data

The data requested through any of the enabled channels is generally mandatory (unless otherwise specified in the required field) to fulfill the purposes for which it is being collected.

Therefore, if these documents are not provided or are not provided correctly, the requests cannot be processed.

3.- For what purposes will the data controllers process the User’s data and on what legal basis?

Mahou will process the personal data provided by the User or that Mahou may obtain directly (for example, browsing data) through any of the channels enabled for this purpose, for the purposes indicated below, in accordance with the legal basis applicable in each case:

1. To guarantee the User access to and use of the Website:

The User’s personal data will be processed, where applicable, to enable navigation on the Website, thus allowing access to the information and content provided. While simply visiting the Website does not require providing personal information, certain functionalities do depend on the use of cookies, as explained in the Cookie Policy. The legal basis for this processing is the express consent given by accepting the Website’s cookies, where applicable.

2. User relationship management and provision of contracted services.

For the proper management of the relationship with the User and the provision of the contracted services, it will be necessary to carry out the following processing:

• Process user requests.
• Contact the User when any relevant circumstances arise related to the purchased products.
• Save the information of those unregistered users who request that it be remembered.
• Retrieve profile data associated with registered users who log in using their credentials. This data may be provided by third-party platforms, and therefore, the communication of this data will be governed by the privacy policies of those third parties.

These treatments will be carried out by the execution of the contractual relationship derived from the purchase made.

3. Newsletter submission:

The processing of personal data will be carried out based on the User’s consent. In this regard, the data subject may revoke their consent at any time, without this affecting the lawfulness of the processing carried out previously.

4. Conduct statistical and market research:

The following treatments will be carried out for this purpose:

• Conducting inquiries with Users regarding the quality and their satisfaction with the goods or services provided by Mahou.
• Analysis and preparation of internal statistics and reports on user satisfaction, the success of marketing campaigns, overall user preferences, and any other matter deemed relevant. This will always be done using data obtained directly by Mahou.

All processing derived from this purpose will be based on the legitimate interest, recognized to the controller of the processing by the regulations.

This legitimate interest is based on being able to offer Users Mahou products with the highest quality and best possible experience, as well as establishing mechanisms to facilitate contact and the relationship with the company.

1. To carry out promotional activities about products, activities and services of both Mahou and third parties, including sending electronic commercial communications adapted to the User’s profile.

The aforementioned processing will only be carried out with the explicit consent of the data subjects. This consent may be revoked at any time, without affecting any processing carried out previously.

2. To guarantee security in the use of the Website and in the purchase of products by the User:

Mahou has implemented security measures for managing the security of the Website, as well as for detecting and preventing fraud in transactions carried out.

The legal basis for the security of systems and transactions is the legitimate interest recognized to the data controller by the regulations.

This legitimate interest will consist of minimizing the risks assumed by Mahou and its customers.

3. Compliance with legal obligations:

Mahou will process User data to comply with applicable regulations.

The legal basis for this processing will be compliance with the relevant legal obligations.

4.- With which recipients will the User’s data be shared?

The proper handling of requests made by the User implies that other third-party service providers of Mahou access the User’s personal data as data processors with whom Mahou has signed the corresponding service provision agreements with access to data.

In addition to the above, the User understands that Mahou may transfer or communicate personal data to fulfill its obligations to Public Administrations in cases where required by current legislation and, where appropriate, also to other bodies such as State Security Forces and Corps and Judicial bodies.

5.- International data transfers

Mahou may share Users’ personal data with third parties located outside the EU for the proper execution of orders, to respond to User requests, or to fulfill any of the purposes indicated. Mahou guarantees that, in cases where there is no adequacy decision in force, the aforementioned international data transfer will be carried out in compliance with applicable data protection regulations and, in all cases, with appropriate safeguards. Specifically, this includes the signing of standard contractual clauses approved by the European Commission and, where necessary, the adoption of any additional safeguards deemed appropriate.

6. Data retention

Mahou will retain User data for as long as necessary to fulfill the purposes indicated above, without prejudice to any retention that may be necessary for the establishment, exercise, or defense of potential claims and/or as permitted by applicable law. Once this period has ended, the Company will delete the data.

7.- User Responsibility

The User guarantees that they are over eighteen (18) years of age and that the information they provide to Mahou is true, accurate, complete, and up-to-date. To this end, the User is responsible for the accuracy of all information provided and will keep the information up-to-date so that it reflects their current situation.

If the User is a minor, they must not provide any data. We cannot and do not wish to collect personal data from any minor, nor do we engage in any promotion, including promoting any type of alcoholic beverage to individuals who are not of legal drinking age. If Mahou becomes aware that a minor has provided personal data, having falsified the required information (date of birth upon access), we will proceed to delete that personal data from our records. Parents or guardians may, in any case, contact Mahou to block the access account of any minors under their care who have registered by falsifying their identity.

The User also guarantees that they have informed any third parties whose data they provide, if applicable, of the information contained in this document. Furthermore, they guarantee that they have obtained authorization from these third parties to provide their data to Mahou for the purposes indicated.

In this regard, the User is informed that he or she will be responsible for any false or inaccurate information provided through the enabled contact channels and for any direct or indirect damages that this may cause to Mahou or third parties.

8.- Exercise of rights

Mahou informs the User of their right to exercise, free of charge, their rights of access, rectification, objection, erasure, portability, and restriction of processing, as well as the right to object to automated processing, of their personal data by sending a signed written request to the following address: Data Protection Officer, c/ Titán 15, 28045, Madrid, or via consultasprivacidad@mahou-sanmiguel.com. For this purpose, the User must send said written communication indicating the request or right being exercised, their full name, and address for notification purposes.

The User has the right to object to the processing of their data for promotional purposes and to opt out of receiving marketing communications by simply notifying Mahou of their intention. To do so, the User may submit their request using the procedure described in the preceding paragraph. The User may also unsubscribe from receiving marketing communications as provided in each communication (for example, via the link included in each one).

In addition to the aforementioned rights, the User has the right to withdraw their consent at any time by following the procedure described above. Such withdrawal will not affect the lawfulness of the processing carried out prior to the withdrawal. Mahou may continue to process the User’s data to the extent permitted by applicable law.

Likewise, the User may file a complaint regarding the protection of their personal data with the Spanish Data Protection Agency at the address C/ Jorge Juan, 6, 28001 – Madrid, when the interested party considers that in the processing carried out by Mahou, the rights recognized by the applicable data protection regulations have been violated.

9. Security measures

User data will be treated at all times by Mahou in an absolutely confidential manner and maintaining the required duty of secrecy with respect to them, in accordance with the provisions of the applicable regulations, adopting for this purpose the necessary technical and organizational measures that guarantee the security of their data and prevent its alteration, loss, unauthorized processing or access, taking into account the state of the technology, the nature of the data stored and the risks to which they are exposed.

10. From what age can the User access our products and services?

The Website is not directed at individuals under the age of 18.

In this regard, access to and registration of the Content is prohibited for individuals under 18 years of age. When purchasing products or services related to alcohol consumption, the User must declare and guarantee that they are over 18 years of age. In these cases, if the User is a minor, they must not provide any data. We cannot and will not collect personal data from any minor, nor promote any type of alcoholic beverage and/or services related to alcohol consumption to individuals who are not of legal age to purchase or consume it. If Mahou becomes aware that a minor has provided personal data, having falsified the required information (date of birth upon access), we will proceed to delete that personal data from our records.

Parents or guardians may in any case contact Mahou to block the access account of minors under their care who have registered by falsifying their identity.

11. Data Quality

Mahou warns the User that, except in cases of legally constituted and accredited representation, no User may use the identity of another person and communicate their personal data, so the User must at all times bear in mind that they may only provide personal data corresponding to their own identity and that are adequate, relevant, current, accurate and true.

For these purposes, the User shall be solely liable for any damage, direct and/or indirect, caused to third parties or to Mahou by the use of another person’s personal data, or their own personal data when it is false, erroneous, outdated, inadequate, or irrelevant. Likewise, the User who communicates the personal data of a third party shall be responsible to that third party for the obligation to inform them when the personal data has not been obtained from the data subject, and/or for the consequences of failing to inform them and, where applicable, obtain their consent.

If the User provides any personal data of third parties, they undertake to inform these people beforehand of the intention to communicate their data to Mahou and to obtain their prior, express and written consent for said data processing and any purposes for which it would be processed, the User being responsible otherwise.

The User is the sole source of information regarding their personal data. Therefore, Mahou requests that, in order to keep their data updated and current at all times in accordance with the principles of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR), they communicate any changes to this data to the address Calle Titán 15, 28045, Madrid or by selecting the corresponding option in the “Contact Us” section of the Content, if available.

12. Use of cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve it. You can find out more about the use of cookies on this website in the Cookie Policy.

12.- Links

The Website may include hyperlinks to other sites that are not operated or controlled by Mahou. Therefore, Mahou does not guarantee, nor is it responsible for, the legality, reliability, usefulness, accuracy, or timeliness of the content of such websites or the data processing they carry out. Before providing your personal information to these third-party websites, please be aware that their data protection practices may differ from ours.

13.- Changes to the privacy policy

Mahou reserves the right to revise this Privacy Policy at any time, in which case Users will be notified. Therefore, we ask that you regularly check this privacy statement to read the most recent version of Mahou’s Privacy Policy, available on this Website.

Last updated: May 2025.