Your Privacy Matters to Us

Guinness Ghana respects your privacy. We collect and use personal data only for legitimate business purposes and in line with Ghana’s Data Protection Act 2012 (Act 843).

PRIVACY NOTICE – GUINNESS GHANA BREWERIES PLC

Introduction

This Privacy Notice applies to personal information collected by or on behalf of a company within the Castel group of companies, of which Guinness Ghana breweries Plc (“Guinness Ghana”) is one. It sets out what we do with your personal information, how we keep it secure and explains the rights that you have in relation to your personal information.

Customer, supplier or employee/candidate?

Where you are representing one of our corporate customers or suppliers (or are a natural person acting as one of our suppliers or customers), please see the “Customers and Suppliers” section at the end of this Privacy Notice for details on the information that we gather about you.

Who we are

Guinness Ghana is a majority owned subsidiary of Castel. All references to ‘our’, ‘us’, ‘we’, or ‘company’ within this notice are deemed to refer to Guinness Ghana, its subsidiaries, affiliates, and/or associates as appropriate.

Are you of legal purchase age?

You must not provide us with your personal information if you are not of legal age to purchase alcohol in the Republic of Ghana. We do not intend to collect personal information from any individuals under the legal purchase age, or to market alcoholic beverages to anyone under the legal purchase age.

If we receive notice or believe that someone under the legal purchase age has provided us with personal information, we will make every reasonable effort to remove such personal information from our records.

What types of personal information do we collect

Personal information is information about an identifiable individual as defined by applicable law. The personal information we collect from your interaction with us, our products or our marketing and promotional activities includes:

• information you provide to us; and
• information we automatically collect/generate or information we obtain from third parties.

We have set out below more details regarding these types of personal information:

• Information you provide to us: These types of personal information may include (without limitation) contact details (such as your name, postal addresses, phone numbers and email addresses), demographic information (such as your date of birth, age or age range and gender), online registration information (such as your password and other authentication information), payment information and personal details where you are making a purchase (such as your credit details, billing and shipping address, phone number),
• information provided as part of online questionnaires (such as responses to any customer satisfaction surveys or market research), competition entries/submissions, and in certain cases, your marketing preferences.
• Information we automatically collect/generate or obtain from third parties: These types of personal information may relate to the device used to communicate with us or to access our website (such as your PC, tablet or other mobile device), your use of our websites and apps (as well as certain third-party websites with whom we have partnered), and/or your personal preferences, interests, or geographic location. Examples of these types of information include:
• name and age (or predicted age range),
• information about your device, operating system, browser and IP address, unique identifiers associated with your device,
• details of web pages that you have visited,
• which products you have looked at online (including information about products you have searched for or viewed, purchased or added to an online shopping basket),
• how long you spend on certain areas of a website or app together with the date and time of your visit/usage, personal information contained within user-generated content (such as blogs and social media postings), social media username or ID, and
• social media profile photo and other social media profile information (such as number of followers).

How/when do we collect personal information

• Information you provide to us: There are various situations in which you may directly provide personal information to us. These include, but are not limited to, when you:
• enter a competition, take advantage of a promotion or provide us with your personal details in respect of an ongoing or impending promotion,
• fill in an online questionnaire (such as a customer satisfaction survey), provide credit card details (such as when purchasing products from us), contact us with an enquiry or ask us to provide you with information, register on a website or app or leave any reviews or comments,
• attend any of our promotional events, forward an item to a friend,
• engage in a survey run by us or on our behalf,
• engage with our sales or marketing teams in the ordinary course of business.
• inform us of your marketing preferences, and/or
• communicate with us via social media websites, third party apps or similar technologies.

We will indicate where any personal information we have requested is mandatory or optional. We will also explain the consequences should you decide not to provide information which we have indicated is mandatory. In some circumstances this may mean we are unable to provide you with a certain service or product.

• Information we automatically collect/generate: When you browse or use our websites or apps (as well as certain third- party websites with whom we have partnered) we (and our partners) use cookies and similar technologies to collect information automatically from one or more of your devices associated with you.

We also use certain automated techniques and technologies to infer or generate additional information about you, for example by analyzing or predicting certain personal aspects such as your personal preferences or interests.

In addition, we receive IP addresses from all users because this information is automatically reported by your browser each time you view a Guinness Ghana affiliated web page. For most users accessing the internet, the IP address will be different every time you log on. IP addresses are generally recorded in files called “log files”.

• Information we obtain from third parties: In addition to the information we collect as described above, we may also partner with and use the services of various third parties to collect personal data about you from other sources. We will only obtain such information where we have your consent and/or another legal ground to do so. This information may include:
• Data from other organizations who have obtained your permission to share information about you with us;
• Data we receive when someone refers you for our products and services (please see below for more);
• Data we may require from other organizations to fulfil our legal obligations; and/or
• Where your information is publicly available.

Here are a few places third party data may come from:

Public information sources, such as the Electoral Roll; Third-party social media platforms; other third-party websites that we have partnered with; other third-party partners who may have responsibility for managing, coordinating or promoting our sales, marketing and promotional activities and events.

Purposes for which your personal information is used

The different purposes for which we use your personal information are set out below:

• Legitimate Business Purposes: We may use your personal information as may be required by law, for customer service, or to help market, produce, promote or sell any of the products we or any Castel group company may market, produce, promote or sell. For the avoidance of doubt, this includes all reasonable uses for the purposes of furthering Gunness Ghana’s commercial endeavors.

 

• Marketing Communications: We may use your personal information to communicate with you through channels such as, telephone, email, SMS and posts about our products and services, and those of our subsidiaries, affiliates, and parent companies, and any of their related businesses. This may also include using your date of birth to send you special offers around your birthday. You have the right to opt out at any time from receipt of further marketing communications as described in “Your Rights” section.

 

• Marketing analysis: We may use your personal information for marketing analysis, for example, to assess trends amongst our consumers and what people are saying about our products, to evaluate the impact and effectiveness of our marketing campaigns and promotions, and to analyze the number and types of visitors to our websites and/or users of our apps (including the locations from which such visitors/users access our websites and apps). We often aggregate personal information for these purposes so that it no longer identifies any particular individual.

 

• Online interest-based advertising: We use techniques such as “online behavioral advertising” and “programmatic advertising” which involve the use of personal information, which includes the information we automatically collect/generate as referred to above (such as information about your online activity and/or personal preferences), as well as other information you provide to us (such as your contact details) and information regarding your online purchase (and the sharing of it with our service providers) to display the most appropriate and relevant advertisement to you either on our websites, apps or third-party websites (including social media platforms).

Similarly, we may also use such personal information (and share it with our service providers as described below) in order to determine if you are a member of a particular social media platform so that:

• we can display our advertising to you on that service or
• we can identify consumers who share similar interests and characteristics with you for the purposes of making our advertising more relevant to consumers – examples of this are Facebook’s “Custom Audiences” and “Lookalike Audiences” products which we may use subject to the law.

In relation to these products, we act as joint controller of your data.

You have the right to opt-out at any time from the use of your personal information for online interest-based advertising.

• Online ad verification: We use personal information to monitor our digital advertising to ensure that it does not appear on unsuitable websites or near inappropriate content, and also to ensure that our advertising is visible and seen by real people online (as opposed to ‘bots’ or similar fraudulent techniques)
• Forward to a friend: When you provide us with information regarding another individual, such as when you request that we send someone information from one of our websites, we will send that individual only the information you specifically requested that we send. We will not send them additional communications based on your providing us with their information. You must confirm that your friend is of Legal Purchase Age in the jurisdiction where they are located in order for us to transmit the requested information and that they are happy to receive any such communications.
• Authentication and access control: We may use your personal information to authenticate your access to our websites or apps and to determine which content to provide you and/or whether you should be granted access to certain content (for example checking your age or location to ensure you are of Legal Purchase Age in the jurisdiction where you are located). We may also use your personal information to verify your identity when responding to any requests to exercise your rights under applicable law.
• Comply with legal obligations and protect against legal claims or liability: We may use your personal information to comply with our legal obligations, to protect us against legal claims, or to detect, protect, or defend us and/or other third parties against error, negligence, breach of contract, theft, fraud, or other illegal or harmful activity, to comply with our audit and security requirements, or to audit compliance with our corporate policies, procedures, legal, or contractual obligations. o Customer service: We will use your personal information to provide specific services that you request from us, as well as to provide additional services that may be of interest. We will also use your personal information to process any orders you submit, to contact you in relation to any enquiries, orders or matters relating to your account and to maintain your accounts and manage transactions such as credit card payments for any products that you order from us or our agents, or for the fulfilment of such transactions (e.g. delivery) or to answer any questions you may have. We may also use your personal information to notify you about changes to our services, our terms and conditions or this Privacy Notice.
• Corporate transactions: We may use your personal information in the event of a sale, merger, consolidation, change in control, transfer of substantial assets, financing, reorganization, or liquidation whereby we transfer, sell, or assign to a third-party information concerning your relationship with us.
• Technical maintenance: We use personal information for system administration purposes and to diagnose service or technology problems reported by our users or engineers, these types of problem may be associated with the IP addresses controlled by a specific web company or ISP.

Legal basis for the processing of personal information

We will only process your personal information where we have a legal basis to do so. The legal basis will depend on the purposes for which we have collected and use your personal information. In almost every case the legal basis will be one of the following:

• Consent: For example, where you have provided your consent to receive certain marketing from us. You can withdraw your consent at any time by notifying us, including by clicking on the “unsubscribe” link at the bottom of any marketing email we may send you.
• Our legitimate business interests: Where it is necessary for us to understand our customers, promote our services and products and operate effectively as a total beverages company, provided in each case that this is done in a legitimate way which does not unduly affect your privacy and other rights. For example, we will rely on this legal basis when we conduct certain market analysis to understand our customer and/or consumers in sufficient detail so we can create new products and improve the profile of our brands.
• Performance of a contract with you: This would also apply where we need to take steps prior to entering into a contract with you. For example, where you have purchased a product from us and we need to use your contact details and payment information in order to process your order and send the product to you.
• Compliance with law: Where we are subject to a legal obligation and need to use your personal information in order to comply with that obligation.

Disclosure of your personal information

We value your personal information and only share it in certain circumstances. For example:

• third parties where you have provided your consent or where permitted by applicable law. For example we will obtain your permission before we allow a third party that is not an affiliate to send you any marketing and promotional information relating to that third party’s products or services;
• our service providers and subcontractors, including our affiliates, and/or third party websites (such as social media platforms or search engines) retained to perform functions on our behalf, or to provide services to us (such as warehousing and delivery), to provide marketing and advertising services (including by delivering online interest-based advertising on third party websites and social media platforms and where you have consented to the use of advertising cookies set by Guinness Ghana or our partners); for payment and data processing; age verification; monitoring our digital advertisements to ensure that they do not appear on unsuitable websites or near inappropriate content and also to ensure that our advertising is visible and seen by real people online (as opposed to ‘bots’ or similar fraudulent techniques); software development; website hosting and management; information technology and office services; legal, accounting, audit and other professional service providers; and other services related to our business), provided such service providers and subcontractors have entered into written agreements with us which maintains data privacy and do not collect, use, or disclose the personal information for any purpose other than to perform such functions on our behalf, to provide services to us, or as otherwise required or permitted by law; to third parties who assist us with identity verification and credit reference checks, as described above
• third parties who, in our reasonable judgment, are providing or seeking the information as your authorized or appointed legal agent;
• a person or entity, including our affiliates, in the event of a sale, merger, consolidation, change in control, transfer of substantial assets, financing, reorganization, or liquidation whereby we transfer, sell, or assign to such third-party information concerning your relationship with us, including without limitation, personal information that you provide and other information concerning your relationship with us; and
• law enforcement, governmental or regulatory agencies, or other third parties globally in order to comply with applicable law, or where we believe such action is necessary in order to comply with applicable law, or to detect, protect, or defend us and/or other third parties against error, negligence, breach of contract, theft, fraud, or other illegal or harmful activity, to comply with our audit and security requirements, or to audit compliance with our corporate policies, procedures, legal, or contractual obligations.

International data transfers

Please note that your personal information may be transferred to, and stored at, a destination outside the Republic of Ghana, including countries, which have less strict, or no data protection laws, when compared to Ghana.

Whenever we transfer your information as described in the paragraph above, we will take steps to ensure that the third party complies with the Data Protection Act 2012 of Ghana (Act 843), including steps which are reasonably necessary to ensure that adequate safeguards are in place to protect your personal information and to make sure it is treated securely. In these cases, we rely on approved data transfer mechanisms (for example, the EU “Standard Contractual Clauses”) to ensure your information is subject to adequate safeguards in the recipient country.

Public areas of our websites and apps

Information that you post on or through the public areas of our websites and apps (e.g., chat rooms, bulletin boards, discussion groups, and Edge platforms), or on social media platforms generally is accessible to, and may be collected and used by, others, and may result in unsolicited messages or other contact from others. You should not provide personal information about yourself in public (or interactive) areas of our websites, apps or social media pages. We take no responsibility for information shared by you in a public forum.

Information security

We take information security seriously and take precautions to keep your personal information secure. We have put in place appropriate physical, technical, and organizational measures to safeguard the information we collect. However, we have no control over the privacy of any communication while it is in transit to us. We therefore recommend that you do not include confidential, proprietary, or sensitive information in any such communications.

Unfortunately, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us of the problem by contacting us at the contact details below.

In the unlikely event that we believe that the security of your personal information in our possession or control may have been compromised, we may seek to notify you of that development. If such a notification is appropriate, we will endeavour to do so as promptly as possible under the circumstances, and, to the extent we have your email address, we may notify you by email.

You are reminded that, in accordance with the Conditions of Use for this website and/or app, you are responsible for maintaining the strict confidentiality of your account password, and you are responsible for any activity under your account and password. It is your sole responsibility to control the dissemination and use of your password, access to and use of your account, and to notify us when you wish to cancel your account. We will not be responsible or liable for any loss or damage arising from your failure to comply with this obligation.

Your rights

You have certain rights in relation to your personal information. These rights may include:

• the right to withdraw your consent to any processing of your personal information (where you had provided consent);
• the right to object to the processing of your information for certain purposes;
• the right to access your personal information, and the ability to erase, restrict or in certain cases receive in intelligible form, information which constitutes your personal information;
• the right to ask us to rectify any information about you that you think is inaccurate;
• the right to unsubscribe from any of our marketing communications at any time; and
• the right to complain to a Data Protection Commission if you think we have processed your personal information in a manner which is unlawful or infringes your rights;

Should you have any concern(s), we suggest that you initially contact us (using the contact details below in the “How to contact us” section) so that we can investigate and hopefully resolve your concerns.

How long will we retain your personal information for?

We will retain your personal information for the period necessary to fulfil the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law. After this period, it will be deleted, destroyed or in some cases anonymized.

For example, where you have made a purchase with us, we will keep a record of your purchase for the period necessary for invoicing, tax and warranty purposes. We may also keep a record of correspondence with you (for example if you have made a complaint) for as long as is appropriate to protect us in the event of a legal claim.

Where we have collected the personal information based on your consent and we have no other lawful basis to continue with that processing, if you subsequently withdraw your consent then we will delete your personal information. However, please note that where you unsubscribe from our marketing communications, we will keep a record of your contact details to ensure we do not send you further marketing communications in future.

How to contact us

We are committed to safeguarding your privacy. If you have any comments, queries, or complaints about our collection or use of personal information please contact us by delivering by hand or registered post at:

The Data Privacy Officer

Guinness Ghana Breweries PLC

ABC Junction

Off the Achimota- Nsawam Highway,

Achimota- Accra

1. O. BOX 3610, Accra, Ghana

 

You may contact us by email at: GGB-Consumer.Privacy.Queries@castel-afrique.com.

You may also contact the Data Protection Commission in the event of any complaints. The details of the Ghana Data Protection Commission’s Office can be found at https://www.dataprotection.org.gh/contact.

CUSTOMERS AND SUPPLIERS

At Guinness Ghana we value our suppliers and customers and understand the importance of the role of Data Protection in creating trusted and respected relationships. This section of this Privacy Notice applies to all individuals that act on behalf of our customers and suppliers (including employees, workers and contractors), or are natural persons acting as suppliers or customers. For the purpose of this section, “you” means an individual acting on behalf of one of Guinness Ghana’s customers or suppliers (or a natural person acting as supplier or customer); and “your employer” means the organization that you are acting on behalf of.

The following sections of this Privacy Notice shall apply equally to you as it applies to our consumers:

• Introduction;
• Who we are;
• Are you of legal purchase age;
• Disclosure of your personal information;
• International data transfers;
• Public areas of our websites and apps; o Information security;
• Your rights;
• How to make a complaint;
• How long will we retain your personal information for; and
• How to contact us.

Where you are representing one of our suppliers or customers (or are a natural person acting as one of our suppliers or customers), in addition to those set out above, the following sections will also apply to your use of the website, apps and services, as well as your interactions with us or our employees and agents:

What types of personal data do we collect?

• name (first, middle and surname), gender, address, country of residence, date of birth, work address, work email address, work phone number;
• employment details, including position, title;
• where you are a natural person acting as a supplier or a customer, financial information (e.g. bank account details);
• your electronic identification data where required for the purpose of delivering products or services to us (e.g. login, passwords, badge number and picture, IP address, online identifiers/cookies, logs, access and connection times, CCTV footage).
• tax numbers and business licenses (if you are a sole trader),
• your mailing preferences, delivery instructions, reference information, customer service preferences,
• your vehicle and other visitor information collected when you visit our facilities (including, at some facilities, video surveillance of facility perimeters)

We will also maintain records of our correspondence with you. If you are an employee of a customer or supplier and wish to participate in one of our training projects such as “Learning for Life” we may ask to collect details such as your ethnicity or education.

We may also collect personal information from you as part of our Business Partner identification verification process (“Know Your Customer” or “Know Your Business Partner”, as relevant), for example, copies of your identification documents and details of your ownership of the business. We may collect this information directly from you or from your employer, or in circumstances set out below, a credit reference agency.

In the course of our relationship with you and your employer, we may collect and process additional categories of personal data which are not specified above, for example if you voluntarily disclose it to us. In accordance with our legal obligations, we will be transparent about any new processing of personal data.

Note that where in the course of conducting any anti- money laundering or other legally mandated checks on you, we process information about your criminal convictions, political opinions or other special category data, we do so on the basis that (i) you have given your explicit consent, acknowledging that the processing is strictly necessary for Guinness Ghana in order to continue or commercial relationship with you in light of our legal and commercial commitments; and/or (ii) it is necessary for the prevention of, or detection, prosecution or litigation against of unlawful acts, including terrorist financing and money laundering.

How do we handle your information fairly and lawfully?

• The processing described here is necessary for us to be able to perform the contract you have entered into with us (or take steps prior to entering into a contract) or to comply with our legal obligations.
• The processing is also necessary for the legitimate interests we pursue as a company, including to benefit from cost-effective services, to offer and market our products to you and ensuring compliance with statutory obligations and ensuring the administration of our relationship with our suppliers. Where we process personal data for our legitimate interest, we will limit that processing to strictly what is necessary to achieve that objective.
• In limited circumstances, we may also seek your consent to process personal data about you for a particular purpose, and in those circumstances, you will have a choice.
• The personal data we process may be held in in an unstructured way, such as paper records and in Outlook email and in a structured way within various company systems, applications, solutions and databases; some of which may be owned and/or operated by third parties. Where we engage with such third parties, we impose upon them contractual requirements to protect personal data.
• Third parties from which we may collect your personal information.
• We obtain your personal data from a number of sources, including from your employer (as applicable) and from any details that you subsequently provide to us during our engagement with you.
• We monitor communications on our networks, including office and mobile telephone networks and as detailed in our Information Management and Security Policy. The information collected may be periodically reviewed by authorized staff to ensure compliance with our policies and to detect any unauthorized use of our IT infrastructure and systems.

 

For what purposes will we use your personal information?

We process your personal information in order to be able to provide our products to our customers or to receive a service from our suppliers. In particular, we process your data for the following purposes:

• To carry out identification verification checks. We may use a credit reference agency to assist with those checks and so we will have to share with the agency certain personal information, including your forename and surname, personal address and previous address, date of birth and gender to help them confirm your identity.
• managing the relationship with our customers and suppliers including processing orders;
• arranging the negotiation, sale and delivery of our products;
• organising tenders, implementing tasks in preparation of or to perform existing contracts;
• to confirm the financial health of your business, in circumstances where we are considering establishing or continuing a commercial relationship with you as an individual (e.g. as a sole trader), extending a credit or evaluating your credit standing. As a result we reserve the right to gather and share relevant credit information with appropriate third parties.
• monitoring activities at our facilities, including compliance with applicable policies as well as health and safety rules in place;
• granting you access to our training modules allowing you to provide us with certain services;
• archiving and record-keeping; o billing and invoicing;
• Upholding our Code of Business Conduct and internal governance requirements, breach management and compliance requirements, including assurance and advisory reviews and audits to ensure an appropriate controls and compliance environment;
• Legal compliance, requirements and obligations including (i) conducting of internal investigations where there is reason to believe and a requirement to assess that there has been a breach of the Guinness Ghana Code of Business Conduct or a breach of the law; (ii) meeting our anti-bribery and anti-money laundering obligations, both at the start of the business relationship and on an ongoing basis (iii) responding to regulatory requests for information; (iv) responding to discovery requests, court orders and/or in response to third party subpoenas in the context of litigation, mediation, arbitration or some other dispute resolution forum; (v) providing documents in the context of litigation or pre-litigation in an effort to pursue or defend claims on behalf of Guinness Ghana, Castel our affiliates, employees or third parties; (vi) defending any claims made against Castel our affiliates, employees or third parties from time to time; (vii) pursuing claims by us, Castel our affiliates, employees or third parties against other persons or entities from time to time; (viii) protecting the interests of Guinness Ghana, Castel, our affiliates, employees or third parties (for example, in the event of a regulatory matter) and (ix) for any other legitimate purpose in the context of a legal dispute;
• to communicate and provide you with company information, news and updates, including travel monitoring systems emergency employee alert systems and other relevant communications;
• Live transmission of images through use of applications including but not limited to Zoom and Microsoft Teams;
• Marketing to you our products which we think may be of interest to you via telephone, email and post; and
• Monitoring to ensure our network and information security and to meet our Information Management and Security objectives.

We also process personal data for the purposes of crime prevention and detection, including

• where it is necessary for the assessment of risk or the prevention of fraud as well as health and safety;
• Analytics or benchmarking activities on an aggregated or statistical level to support our legitimate business interests and performance;
• Routine management of day-to-day business and operational activities with suppliers and customers, such as contact information.
• Processing as described above may continue following the termination of our arrangement with you as a supplier or customer for our legitimate business purposes (as appropriate and necessary) and in line with our records management policies from time to time (retention schedules are set out in our information asset inventories). Examples include any litigation or dispute and when there is a requirement to do so.

 

How long do we keep your personal data

Where you are representing one of our suppliers or customers (or are a natural person acting as one of our suppliers or customers), we will continue to retain your personal information providing:

• You remain an appropriate contact to enable us to exercise our obligations to you under the terms of our contractual relationship with you or your employer.
• You remain an appropriate contact for us to continue managing our relationship with you and/or your employer for legitimate business interests.
• Keeping your personal information up to date o We want to ensure that personal data we hold is accurate and kept up to date. We need to do this both to comply with our obligations under data protection law, and for the practical day to day management of our relationship with you.
• For these and other reasons related to administering your relationship with us, please notify us of any change in your information (see “How to contact us” for details on contacting us) as soon as is practicable, so that records can be updated.

 

September 2025