All references to ‘our’, ‘us’, ‘we’, or ‘company’ within this policy are deemed to refer to Savannah Brands Company Ltd, its entities, affiliates or subsidiaries, as appropriate.
African Originals is a beverage manufacturing company based in Nairobi, Kenya. Details of African Originals different brands can be found on the following pages:

https://africanoriginals.com/
https://kenyanoriginals.co.ke/
https://shop.africanoriginals.com/

We are registered with the Office of the Kenyan Data Protection Commissioner (ODPC) as a Data Controller and Processor per the Kenya Data Protection Act, 2019.

“You” references the customers, suppliers, service providers, and all visitors patronizing any of African Originals locations (both physical and virtual).

You must not provide us with your personal data if you are not over 18 years of age in the country in which you reside
We do not intend to collect personal data from any individuals under the legal purchase age, or to market alcoholic beverages to anyone under the legal purchase age.

If we receive notice or believe that someone under the legal purchase age has provided us with personal information, we will make a reasonable effort to remove such personal data from our records.

We collect personal information about you and any other person whose details you provide to us in accordance with the relevant laws, either:

I. Directly from you when you complete a product or service application form, electronically, telephonically or by way of a hard copy, via CCTV cameras mounted in our premises;
II. Indirectly from you when you interact with us electronically by way of our website, apps, or social media channels, which may include the collection of metadata (data about data);
III. We will also collect your information where you have only partially completed and/or abandoned any information which you began to apply to our website and/or other online forms. Given that we already consider you a customer at this stage, we may use this information to contact you to remind you to complete outstanding information.
IV. Where relevant, from third-party sources, that are representatives of African Originals;

Where we require personal information to provide you with our products and services, your failure to provide us with the necessary information, may result in African Originals being unable to provide you with our products and services.

We process personal data when you use our products and services based on which of our products and services you express interest in.

Personal data you provide to us, includes and / or relates to

A. Contact details (such as your name, physical addresses, phone numbers and email addresses) & demographic information (such as your date of birth, age or age range and gender);
B. Online registration information (such as your username and other authentication information);
C. Payment information and personal details where you are making a purchase (such as your credit card details, billing and shipping address, phone number);
D. As part of online questionnaires (such as responses to any customer satisfaction surveys or market research),
E. When you enter a competition or take advantage of a promotion;
F. When you attend any of our promotional events;
G. When you contact us with an enquiry or ask us to provide you with information;
H. When you register on one of our websites or mobile apps;
I. When you leave reviews or comments on one of our sites or social media pages;
J. When you sign up for one or more of our loyalty programmes;
K. When you visit our locations;
L. Your marketing preferences; and / or
M. Information is provided when you communicate with us via social media websites, third party apps or similar technologies.

We will indicate where any personal information we have requested is mandatory or optional. We will also explain the consequences should you decide not to provide information which we have indicated is mandatory. In some circumstances this may mean we are unable to provide you with a certain service or product.

Personal data we collect automatically

These types of personal data may relate to your device (such as your personal computer, tablet or other mobile devices), your use of our websites and apps (as well as certain third-party websites with whom we have partnered), and/or your personal preferences, interests, or geographic location. This includes but is not limited to:

A. Name and age (or predicted age range);
B. Information about your device, operating system, browser and IP address, unique identifiers associated with your device;
C. Details of web pages that you have visited;
D. Products you have looked at online (including information about products you have searched for or viewed, purchased or added to an online shopping basket);
E. How long you spend on certain areas of a website or app together with the date and time of your visit/usage, personal data contained within user-generated content (such as blogs and social media postings), social media username and / or ID; and / or
F. Social media profile photo and other social media profile information.
G. When you browse or use our websites or apps (as well as certain third-party websites with whom we have partnered) we (and our partners) use cookies and similar technologies to collect information automatically from one or more of your devices associated with you (see below for more details regarding the use of cookies and similar technologies).

We also use certain automated techniques and technologies to infer or generate additional information about you, for example by analyzing or predicting certain personal aspects such as your personal preferences or interests. We also use pixels in our email communications to collect data about whether our emails have been opened and whether links in our emails have been clicked. In addition, we receive IP addresses from all website users because this information is automatically reported by your browser each time you view a web page. For most users accessing the internet, the IP address will be different every time you log on. IP addresses are generally recorded in files called “log files”.

When you are in one of our physical spaces, an image of you and associated audio may be collected via CCTV cameras mounted on the premises for incident recording purposes. These cameras are always activated.

We strive to provide you with choices regarding the Personal Data that you provide to us. Where required by law, if you wish to have your Personal Data used by African Originals to provide you with a personalized experience/targeted advertising & content, you can indicate so through the relevant tick-box(es) located on the registration form or by answering the question(s) presented by African Originals representatives. If you decide that you no longer wish to benefit from this personalization, you can opt-out or adjust your preferences at any time by closing your account . You can close your account by clicking on this link and following the instructions. Once your account is closed, all products and services that you access through your account will no longer be available

Information we obtain from third parties

In addition to the information we collect as described above, we may also partner with, and use the services of, third parties to collect personal data about you from other sources, We will only obtain such information where we have your consent and/or another applicable legal ground to do so.

Information we obtain from third parties includes and / or relates to:

A. Data from other organizations who have obtained your permission to share information about you with us;
B. Data we receive when someone refers you for our products and services;
C. Data we may require from other organizations to fulfill our legal obligations; and/or
D. Where your information is publicly available.

A. Corporate transactions: We may use your personal data in the event of a sale, merger, consolidation, change in control, transfer of substantial assets, financing, reorganization, or liquidation whereby we transfer, sell, or assign to third-party information concerning your relationship with us.
B. Technical maintenance: We use personal data for system administration purposes and to diagnose service or technology problems reported by our users or engineers, these types of problems may be associated with the IP addresses controlled by a specific web company or ISP.
C. Marketing Communications: We may use your personal data to send you targeted marketing communications through channels such as email, SMS, social media, mobile, in-app and push notification, and post about our products and services, and those of our subsidiaries, affiliates, and parent companies, and any of their related businesses. This may also include using your date of birth to send you special offers around your birthday. You have the right to opt-out at any time from receipt of further marketing communications as described in the “Your Rights” section.
D. Customer Profiles: We combine the personal data obtained from the various sources referred to in this privacy notice to create a single consolidated profile of our customers. This profile allows us to engage with you more effectively and helps us to understand our customers better.
E. Marketing and data analysis: We may use your personal data for marketing and data analysis, for example, to assess trends amongst our consumers and what people are saying about our products, to evaluate the impact and effectiveness of our marketing campaigns and promotions, and to analyze the number and types of visitors to our websites, purchasers of our products, and/or users of our apps (including the locations from which such visitors/users access our websites and apps). We often aggregate personal data for these purposes so that it no longer identifies any particular individual. We may also use the personal data of our customers to undertake data analysis (including using third party service providers to perform such analysis) to determine whether our resellers are purchasing the relevant products from us and to ensure our e-commerce terms are being complied with.
F. Online interest-based advertising: We use techniques such as “online behavioral advertising” and “programmatic advertising” which involve the use of personal data, which includes the information we automatically collect/generate as referred to above (such as information about your online activity and/or personal preferences), as well as other information you provide to us (such as your contact details) and information regarding your online purchase (and the sharing of it with our service providers) to display the most appropriate and relevant advertising to you either on our websites, apps or third-party websites (including social media platforms).We also use certain automated techniques and technologies to infer or generate additional information about you, for example by analyzing or predicting certain personal aspects such as your personal preferences or interests.
G. Registering you as a new customer
H. Processing and delivering your orders.
I. Managing your relationship with us.
J. Enabling you to participate in promotions, competitions and surveys.
K. Improving our website, applications, products and services.
L. Detecting fraud.

Similarly, we may also use such personal data (and share it with our service providers as described below in our ‘Disclosure of your personal data’ section) in order to determine if you are a user of a particular online platform so that:

❖ we can display our advertising to you on that service; or
❖ we can identify consumers who share similar interests and characteristics with you for the purposes of making our advertising more relevant to consumers – examples of this are Facebook’s “Custom Audiences” and “Lookalike Audiences” products which we may use in certain countries subject to local law.

M. Online ad verification: We use personal data to monitor our digital advertising to ensure that it does not appear on unsuitable websites or near inappropriate content, and to ensure that our advertising is visible and seen by real people online (as opposed to ‘bots’ or similar fraudulent techniques).
N. Forward to a friend: When you provide us with information regarding another individual, such as when you request that we send someone information from one of our websites, we will send that individual only the information you specifically requested that we send. We will not send them additional communications based on your providing us with their information. You must confirm that your friend is of Legal Purchase Age in the country where they are located, and that they are happy to receive any such communications, in order for us to transmit the requested information
O. Authentication and access control: We may use your personal data to authenticate your access to our websites or apps and to determine which content to provide you and/or whether you should be granted access to certain content (for example checking your age or location to ensure you are of Legal Purchase Age in the jurisdiction where you are located). We may also use your personal data to verify your identity when responding to any requests to exercise your rights under applicable law.
P. To comply with legal obligations and / or protect against legal claims or liability: We may use your personal data to comply with our legal obligations protect us against legal claims, or to detect, protect, or defend us and/or other third parties against error, negligence, breach of contract, theft, fraud, or other illegal or harmful activity, to comply with our audit and security requirements, or to audit compliance with our corporate policies, procedures, legal, or contractual obligations.
Q. Incident Recording Purposes: Images of you and associated audio may be collected via CCTV cameras in our physical retail spaces for incident recording purposes.
R. Customer service: We will use your personal data to provide specific services that you request from us, as well as to provide additional services that may be of interest. We will also use your personal data to process any orders you submit, to contact you in relation to any enquiries, orders or matters relating to your account and to maintain your accounts and manage transactions such as credit card payments for any products that you order from us or our agents, or for the fulfillment of such transactions (e.g. delivery) or to answer any questions you may have. We may also use your personal data to notify you about changes to our services, our terms and conditions or this Privacy and Cookie Notice.

We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the purposes for which we have collected your personal data. In almost every case the legal basis will be one of the following:

A. Consent: We rely on consent for targeted marketing communications. We may advertise our products, services and events through a variety of different channels and rely on your consent to do so. As part of this, we may work with advertising partners, as listed in the ‘Disclosure of your personal data’ section below. These partners have their own privacy policies and consent mechanisms for their customers, in addition to African Original’s controls. You can withdraw your consent at any time, including by clicking on the “unsubscribe” link included in any marketing communications we send you or by entering your email in the box provided on our website.
B. Our legitimate business interests: Where it is necessary for us to understand our customers, promote our services and operate effectively as a beverage manufacturing company, provided in each case that this is done in a legitimate way where they are not outweighed by your privacy and other rights. For example we will rely on this legal basis when we conduct certain market analysis to understand our consumers in sufficient detail so we can create new products and improve the profile of our brands.
C. Performance of a contract with you: This would also apply where we need to take steps prior to entering into a contract with you. For example, where you have purchased a product from us and we need to use your contact details and payment information in order to process your order and send the product to you.
D. Compliance with law: Where we are subject to a legal obligation and need to use your personal data in order to comply with that obligation.

A. Third parties where you have provided your consent or where permitted by applicable law: Entities within African Originals will only share your personal information with third parties if there is a legitimate reason to do so. We may disclose the personal information you provide to us to the following entities:

a. Our third-party service providers who facilitate financial transactions
b. Our third-party service providers who provide logistic services
c. Other third parties in relation to the purposes set out under the previous section (How we use your information);

B. Law enforcement or regulatory agencies: African Originals will only disclose information when lawfully required to do so:

a. To comply with any relevant legislation;
b. To comply with any legal process; and
c. By any regulatory authority.

C. Reporting:On occasion, African Originals may – for legitimate purposes – share aggregated information with its stakeholders and business partners (for example, demographic data) in a manner that does not identify the persons to whom the information applies. However, African Originals will not disclose your personal information to third parties unless there is valid processing ground as set out in applicable law.

D. Sale of personal data: African Originals will not sell, rent, or trade your personal information to any third party.

Some of the persons to whom we disclose your personal information may be situated outside of the Republic of Kenya in jurisdictions. In this regard, we may send your personal information to service providers outside of the country for storage and/or processing African Originals’ behalf. However, we will not send your information to a country that does not have information protection legislation similar to that of Kenya, unless we have ensured that the recipient agrees to effectively adhere to the principles for processing of information in accordance with the Kenya Data Protection Act, 2019.

African Originals intends to protect the integrity and confidentiality of your personal information. As such, we have implemented appropriate technical and organizational information security measures to keep your information secure, accurate, current, and complete. However, we cannot guarantee the security of any information you transmit to us online and you do so at your own risk.

Where third parties are required to process your personal information in relation to the purposes set out in this notice and for other lawful requirements, we ensure that they are contractually bound to apply the appropriate security practices.

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, the need to comply with our internal policy and the applicable legal, regulatory, tax, accounting or other requirements.

Depending on the country in which you are located, you have certain rights in relation to your personal data.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

These rights include;

A. Your right to object to the processing of your information for certain purposes;
B. Your right to withdraw your consent to any processing of your personal data (where you had provided consent);
C. Your right to request access to your personal data, and the ability to erase, restrict or in certain cases receive a copy of your personal data.
D. Your right to ask us to rectify any information about you that you think is inaccurate, you also have the right to ask us to complete information you think is incomplete.;

In addition, you have the right:
E. To unsubscribe from any of our marketing communications at any time; and
F. .
G. Where you wish to permanently delete your data from our website and other applications, you can choose the option of closing your account. You can close your account by clicking on this
link and following the instructions. Once your account is closed, all products and services that you access through your account will no longer be available.
H. We can refuse to accede to your request where it is unreasonable or where you have failed to provide additional information necessary to confirm your identity.
I.

If you wish to exercise any of the rights set out above, kindly complete the subject access request form, for general enquiries please contact us on compliance@africanoriginals.com.

We try to respond to all legitimate requests within reasonable time. Occasionally it could take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

This policy will be subjected to annual review to ensure it remains relevant, and can provide the necessary protections in the ever changing socio-economic, legal and regulatory environment in which
African Originals operates.

The responsibility for review of this policy rests with theRisk and Compliance Manager, in consultation with the Company Counsel.

The Policy will come into force on 11th September 2023 and shall apply until a revision is approved. A notice will be posted on the African Originals’ website’s homepage whenever the Privacy Policy is
materially changed.

Questions, comments and requests regarding this statement may be directed to compliance@africanoriginals.com for clarification.