Data Protection

We are pleased that you are visiting our website, and thank you for your interest. Below we inform you about the handling of your personal data when you use our website. Personal data is any data with which you can personally be identified. The following provisions apply equally to CCE Holding GmbH and its affiliated companies.

The responsible party for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is CCE Holding GmbH, Bräuhausgasse 37, 1050 Vienna, Austria, Tel.: +43 (0)50 264-0, Email: office@cce-holding.com. The person responsible for processing personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

For security reasons and to protect the transmission of personal data and other confidential content (e.g., inquiries to the responsible party), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string "https://" and the lock symbol in your browser line.

1. Personal Data

The use of our website is generally possible without providing personal data. However, different regulations may apply to the use of individual services, which we will inform you about separately.

Apart from the cookies described below, we generally only collect and store data that you voluntarily provide to us by entering it into our input masks or actively interacting with our website in other ways.

Personal data is all information that relates to an identified or identifiable natural person. This includes, for example, your name, address, telephone number, or date of birth, but also your IP address or geolocation data, which can be traced back to you.

2. Use of Cookies

a. If you use our website for informational purposes only, meaning you are not registering or otherwise transmitting information to us (e.g., via a contact form), we only collect the data that your browser transmits to our server (so-called "server log files"). These are technically necessary for us to display the website to you and ensure its stability and security in accordance with Art. 6 para. 1 lit. f GDPR:

• Our visited website

• Date and time of the access

• Amount of data sent in bytes

• Source/referral from which you accessed the page

• Browser used

• Operating system used

• IP address used (possibly in anonymized form)

There is no sharing or other use of the data. However, we reserve the right to review the server log files subsequently if there are concrete indications of illegal use.

b. In addition to the previously mentioned data, cookies are stored on your end device when you use our website; these are small text files stored in the browser you use. Some cookies are deleted again after the end of the browser session (session cookies), others remain on your end device and enable your browser to be recognized upon your next visit (persistent cookies). Persistent cookies are automatically deleted after a predetermined period, which can vary depending on the cookie.

c. If personal data is also processed by individual cookies we deploy, the processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR for the performance of the contract, in accordance with Art. 6 para. 1 lit. a GDPR in case of consent given, or in accordance with Art. 6 para. 1 lit. f GDPR to safeguard our legitimate interests in the optimal functionality of the website and a customer-friendly and effective design of the site visit.

d. Our website uses technically necessary or functional cookies (see the table below). These cookies are used for the safe and functional operation of the website and are processed based on our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR.

e. You can adjust your browser settings at any time, for example to refuse acceptance of third-party cookies or all cookies. Each browser differs in how it manages cookie settings; this is described in the help menu of each browser. The relevant information can be found at the following links:

Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies

Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

Chrome: https://support.google.com/chrome/answer/95647?hl=de&hlrm=en

Safari: https://support.apple.com/de-de/guide/safari/sfri11471/12.0/mac/10.14

Opera: https://help.opera.com/de/latest/web-preferences/#cookies

Please note that the functionality of our website may be restricted if cookies are not accepted. An overview of the specific cookies used can be found in the table below:

3. Collection and Processing of Personal Data

Website

Personal data beyond the information stored by cookies is only processed by us when you voluntarily provide it, for example when you contact us. This exclusively concerns contact data and information related to the concerns you approach us with.

The purpose of processing your data is to operate our website and to provide targeted company-specific information along with the presentation of our goods and services. Any further use of your data only takes place if you have expressly consented beforehand, we need your data to fulfill a contract concluded with you, or we are legally required to retain it.

Contact

In the course of contacting us (e.g., via contact form or email), personal data is collected. The data collected in the case of a contact form is apparent from the respective contact form. This data is stored and used exclusively for the purpose of responding to your inquiry or for contacting you and the related technical administration. The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Art. 6 para. 1 lit. f GDPR. If your contact aims at the conclusion of a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted after your request has been processed, provided there are no statutory retention obligations to the contrary.

Application management

We collect data from applicants for job openings with us for the purpose of initiating a potential employment relationship in accordance with Art. 6 para. 1 lit. b GDPR or possibly based on explicit consent for evidence purposes. The data collected in the course of an application is apparent from the respective application form.

4. Storage duration

The duration of the storage of personal data is determined based on the respective legal basis, the purpose of processing, and, where applicable, also based on the respective statutory retention period (e.g., commercial and tax law retention periods).

When personal data is processed on the basis of explicit consent in accordance with Art. 6 para. 1 lit. a GDPR, this data is stored until the person concerned revokes their consent.

If there are statutory retention periods for data processed as part of legal or similar obligations on the basis of Art. 6 para. 1 lit. b GDPR, this data is routinely deleted after the retention periods have expired, provided that they are no longer required for contract fulfillment or initiation and/or there is no legitimate interest on our part in continued storage.

When personal data is processed based on Art. 6 para. 1 lit. f GDPR, this data is stored until the person concerned exercises their right of objection under Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for processing that outweigh the interests, rights, and freedoms of the person concerned, or the processing serves to assert, exercise, or defend legal claims.

Unless otherwise stated in other information in this declaration about specific processing situations, stored personal data will be deleted if it is no longer necessary for the purposes for which it was collected or otherwise processed.

5. Data transfer

General

As a general rule, your data will not be transferred to third parties unless we are legally obliged to do so, the data transfer is necessary to carry out a contractual relationship concluded between us, or you have given your explicit consent to the transfer of your data beforehand. Your personal data will not be sold or otherwise marketed by us to third parties.

To the extent that one of our processors comes into contact with your personal data, we ensure by means of a contract in accordance with Art. 28 GDPR that they comply with data protection laws in the same manner as we do.

Data transfer to the USA

We occasionally offer some services in the course of which data transfer to the USA takes place or can take place. For this, we primarily rely on two legal bases:

Data transfer due to the existence of an adequacy decision

On July 10, 2023, the European Commission adopted an adequacy decision under Art. 45 GDPR for the USA - the EU-U.S. Data Privacy Framework (DPF). However, this adequacy decision only applies to those data importers in the USA who are registered in the Data Privacy Framework List (https://www.dataprivacyframework.gov/s/participant-search). We check for each service provider who is to receive personal data in the USA as a data importer whether they are registered in the Data Privacy Framework List. If this is the case, it is indicated in our privacy policy for the respective service provider.

Standard contractual clauses and/or consent

If a data importer is not registered in the Data Privacy Framework List, we rely on the standard contractual clauses (Standard Contractual Clauses, SCC) issued by the European Commission under Art. 46 para. 2 lit. c GDPR, possibly supplemented by additional protective measures, or we obtain your explicit consent in accordance with Art. 49 para. 1 lit. a GDPR. We point out that according to the case law of the CJEU (C-311/18, Schrems II), the USA does not guarantee a level of data protection equivalent to EU law in every respect, particularly with regard to the access possibilities of US authorities. We will inform about the possibility of data transfer to the USA for each affected service separately.

6. Tools and applications used

a. We use Plausible Analytics for statistical analysis of website usage, a web analytics service whose servers are operated in Germany (Falkenstein). Plausible Analytics works entirely without cookies and without collecting personal data: No cookies are set, and no cross-device profiles are created; all data is aggregated and evaluated anonymously, so no conclusions can be drawn about individual people. The analysis is solely to understand the reach and use of our website and improve our offering. The legal basis is our legitimate interest in data-efficient reach measurement in accordance with Art. 6 para. 1 lit. f GDPR. The data is processed on our behalf and not passed on to third parties.

b. We use the service Cloudflare by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare serves the security and operational functionality of our website, particularly the defense against abusive access and automated attacks (bot detection using 'Turnstile'). For this purpose, Cloudflare may set technically necessary cookies and process connection data (especially the IP address). The legal basis is our legitimate interest in the security and availability of our website in accordance with Art. 6 para. 1 lit. f GDPR. This may involve the transfer of personal data to Cloudflare, Inc. in the USA; Cloudflare, Inc. is registered in the Data Privacy Framework List. For more information, see https://www.cloudflare.com/privacypolicy/.

c. Although the videos provided on our website are managed through the service Vimeo, our website does not incorporate a Vimeo player. Instead, the respective video files (MP4) are delivered via our own web server and played directly in the user's browser. When a page with a video is accessed or played back, no connection to Vimeo's servers is established. As a result, no personal data, particularly no IP address or usage data, is transmitted to Vimeo in connection with video playback. Vimeo is solely used for the management of video content; delivery to website visitors does not occur through Vimeo.

d. We also include links to other websites on our site; this is done solely for informational purposes. These websites are not under our control and therefore do not fall under the provisions of this privacy statement. Please refer to the current privacy policies of the websites we link to for more information.

e. On our website, we link to our profiles or presences in social networks. These are simple links; data transfer to the operators of these networks only occurs when you click on the respective link and access the network's page. The networks in question are:

•      Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The parent company, Meta Platforms Inc., Menlo Park, California, is registered in the Data Privacy Framework List.

•      LinkedIn, operated by LinkedIn Inc., 2029 Stierlin Court, Mountain View, CA 94043, USA.

•      Youtube, operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

When you click on one of these links, you will be redirected to the respective network's page, which allows them to collect data about you. We have no influence on the scope and content of the data transmitted in this process. If you wish to learn about the nature, scope, and purpose of the collected data, we recommend reading the privacy policies of the respective social network.

7. Use of Artificial Intelligence (AI) Systems

We may use Artificial Intelligence (AI) systems to enhance our services and support communication. Currently, no AI systems with direct user contact are in use on our website.

If you enter personal data as part of an AI-supported service, we process it solely for the purpose for which the service is provided (e.g., answering your inquiry). The legal basis for this is your express consent according to Art. 6(1)(a) GDPR, which we obtain before using the service, or the initiation or fulfillment of a contract according to Art. 6(1)(b) GDPR.

We strongly advise you not to enter sensitive data (special categories of personal data according to Art. 9 GDPR, such as health data or political opinions) when using AI-supported features. If we use external service providers to operate AI systems, we ensure compliance with data protection regulations through order processing contracts in accordance with Art. 28 GDPR. If data is transferred to a third country, we will inform you separately and obtain the necessary legal basis (e.g., your consent).

There is no decision based solely on automated processing that has legal effect on you (Art. 22 GDPR). Significant decisions are always reviewed by a human.

8. Security

We employ numerous technical and organizational security measures to protect your data against manipulation, loss, destruction, and unauthorized access by third parties. Our security measures are continuously improved in line with technological developments on the Internet. Should you require more detailed information regarding the type and scope of the technical and organizational measures we have taken, we are happy to provide you with this information upon written request.

9. Your Rights

According to the General Data Protection Regulation and the Data Protection Act, you have the following rights and remedies as a data subject in our data processing:

Right to access (Art. 15 GDPR)

You have the right to request information on whether and – if so – which personal data about you is processed, as well as the purposes of processing, the categories of processed data, the recipients, the planned storage duration, the existence of rights to rectification, erasure, restriction, and objection, the right to lodge a complaint with a supervisory authority, the source of your data, and the existence of automated decision-making. To protect your own interests, we will verify your identity in an appropriate manner before providing information.

Right to rectification (Art. 16) and erasure (Art. 17 GDPR)

You have the right to request the rectification of inaccurate personal data concerning you without delay, or the completion of incomplete personal data, taking into account the purposes of data processing, and the erasure of your data, provided the criteria of Art. 17 GDPR are met.

Right to restriction of processing (Art. 18 GDPR)

Under the statutory requirements, you have the right to restrict the processing of all collected personal data. These data will only be processed with your individual consent or for the establishment, exercise, or defense of legal claims starting from the restriction application.

Right to data portability (Art. 20 GDPR)

You can request the unobstructed and unrestricted transmission of personal data that you have provided to us, to you or a third party, as far as it is technically feasible.

Right to object (Art. 21 GDPR)

You can object, for reasons arising from your specific situation, at any time to the processing of your personal data, which is necessary to protect our legitimate interests or those of a third party. Your data will no longer be processed after the objection unless there are compelling legitimate reasons for processing that outweigh your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims. You can object to data processing for direct marketing purposes at any time with effect for the future.

Revocation of consent

If you have given separate consent for the processing of your data, you can revoke this consent at any time with effect for the future. Revocation of consent does not affect the legality of processing carried out based on consent until the time of revocation.

For applications regarding the violation of rights to access, confidentiality, rectification, or erasure, the Austrian Data Protection Authority is responsible. Their contact details are: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Email: dsb@dsb.gv.at.

We will respond to all reasonable requests free of charge and as promptly as possible, but no later than one month after receipt of your request, within the legal framework.

10. Contact Information / Contact Person

Contact information of the person responsible

CCE Holding GmbH, Bräuhausgasse 37, 1050 Vienna, Austria, Tel.: +43 (0)50 264-0, Email: office@cce-holding.com

Contact information of the contact person for data protection matters

For questions about data protection and to exercise your rights as a data subject, you can reach us at office@cce-holding.com.

Status: August 2026