Our privacy policy

1. Introduction

This Privacy Policy explains how BRASSERIES ET LIMONADERIES DU RWANDA (BRALIRWA) Plc Part of the Heineken Company collects, uses and manage s personal data for our external stakeholders .

This notice informs you which personal data we process, how we process it, how long we keep your personal data, how you can access and update your personal data and where to go for information. For the purposes of this Privacy Policy, personal data means any information relating to an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, contact details, an identification number, location data, an online identifier or to one or more factors specific to the physical, psychological, genetic, mental, economic, cultural or social identity of that natural person;

‍

‍2. Who is this Privacy Policy intended for?

This Privacy Policy is about your personal data when you interact with us as:

a) consumer purchasing our products, using our services or taking part in our activities;

b) visitor to our buildings and facilities;

c) visitor to our websites; and

d) user of a BRALIRWA website or BRALIRWA social media pages;

e) Customers

f) Business partners

g) Prospective employees

‍

3. Which HEINEKEN company is responsible for your personal data (data controller)?

We, BRALIRWA that interact with you or you interact with, are responsible for the processing of your personal data. Heineken International N.V. is the main operating and management company within the group and can in some cases (also) be responsible for the processing of your personal data. The purposes for which Heineken International N.V. will be joint or sole data controllership with BRALIRWA relate to the management of the group of HEINEKEN companies as a whole. Generally, these are referred to as being typical ‘head office activities and include the management of global IT systems, the execution of global processes, the creation and provision of global insights and analytics activities, organizational analysis

‍

4. What personal data do we process about you?

We collect personal data directly from you (for example, when providing personal data when you participate in BRALIRWA activities and campaigns, join our marketing and promotional activities or visit us), from BRALIRWA sources and from other sources during the course of our relation with you. This includes the following categories of personal data:

‍

Category of personal data	Examples
Basic personal details	Name, organization, work or business contact details (email, phone numbers, physical or business address), job title.
Other personal details	Home contact details (email, phone numbers, physical address), language(s) spoken, gender, date of birth, age, login and passwords, internal identification number.
Business communications	Information included in requests from, or correspondence with, you and other online interactions with BRALIRWA.
Analytics information	Information about the use of and interactions with HEINEKEN's websites, apps, newsletters, online advertisements or other systems and services, including IP addresses, device information, click and surf behavior, session length, and responses to consumer satisfaction surveys.
Company information	Chamber of commerce details, VAT details, tax details, which may include personal data for independent contractors or other small businesses.
Compliance information	Records related to your preferences (marketing preferences, consent documentation) and data subject rights requests.
Security information	Security, authentication, fraud prevention, and risk-management related data.

‍

5. Our purposes and legal basis for processing your personal data

Our purposes and legal basis for processing your personal data relate to, for example, supporting a responsible, effective and efficient consumer relationship and marketing process and protecting our BRALIRWA websites and facilities. The legal basis for processing your personal data is mainly to take steps at your request to enter into a contract with you (for example, when taking part in our marketing activities or events), our legitimate interests in protecting our buildings, facilities and websites or your consent. Personal data requested from you are the minimum required in order to fulfil legal and/or contractual requirements and to provide opportunities to take part in our activities or to provide a service. Where you choose not to provide us with information described in this Privacy Policy, in some situations the consequence is that it will affect your ability to obtain a service, take part in an activity or visit our websites.

Where the processing is based on consent, you have the right to withdraw your consent at any time. This will not affect the validity of the processing prior to the withdrawal of consent.

The specific purposes and legal basis are described below (including examples):

‍

Purposes	Examples	Legal basis
Business communication	Processing personal data as part of our business communication activities. This includes communicating with you for various reasons, such as responding to your questions, managing our business operations, and replying to any communications you send BRALIRWA. The processing of your data for these purposes is necessary to ensure efficient and effective communication between you and BRALIRWA. It also supports the smooth operation of our business processes and helps maintain a responsible and productive relationship with you.	The processing of personal data is in our legitimate interests in efficient communication and business operations, except where your interests or fundamental rights prevail. This ensures that the obligations outlined in our agreement are properly carried out, enabling us to provide products and services as specified. Additionally, processing your personal data serves our legitimate interests, specifically by supporting efficient communication and effective business operations. This means that we use your information to maintain smooth interactions and ensure the continuity of our business processes. However, we are committed to respecting your interests and fundamental rights and will always prioritize these where they may outweigh our legitimate interests.
Concluding and executing agreements	We process your personal data in order to provide our products and deliver our services to you. This involves utilizing your information to ensure that you receive the products and services as specified in our agreement.	The processing of your personal data is conducted on the legal basis that it is either necessary for entering into a contract with you or for fulfilling the obligations of an existing contract between you and BRALIRWA. This means we must use your information to provide you with the services and functionalities specified in our agreement.
Monitoring and investigating compliance	Monitoring and investigating compliance with applicable laws, regulations, and/or BRALIRWA policy or conditions (including the HEINEKEN Code of Business Conduct).	Processing personal data may be required for compliance with legal obligations, such as monitoring and investigating adherence to applicable laws, regulations, and company policies. The processing is necessary for compliance with a legal obligation that BRALIRWA is required to comply with.
Website and/or mobile app usage	Providing functionalities of websites and apps, including administering user accounts, improving performance, saving preferences or products, enabling sharing functionalities.	The legal basis for processing personal data for website or mobile app purposes is to provide the functionalities of these platforms, such as administering user accounts, improving performance, saving preferences or products, and enabling sharing functionalities. This processing supports the efficient operation and user experience of the website or app and is typically justified by the necessity to perform a contract with you (for example, to deliver the requested services or products).
Health, safety, security and integrity	Protection of the interests of BRALIRWA, its employees and other individuals and activities such as via access controls to BRALIRWA's systems and premises, protecting facilities using CCTV cameras and other activities involving health and safety, the protection of BRALIRWA and employee assets, and the authentication of visitors and access rights.	The legal basis for processing personal data for health, safety, security, and integrity purposes includes the following: The processing is required to comply with a legal obligation that BRALIRWA is subject to. The processing is required to protect both the company's and individuals' interests, and health and safety, unless these interests are outweighed by your interests or fundamental rights. This includes ensuring safety of company assets, data management on health and for safety of our employees.
Business process execution and internal management and management reporting	Examples of Personal Data Processing Under Business Process include General management activities, such as overseeing business operations and administrative functions; Order management, including processing customer orders; company asset management including the IT systems and infrastructure; legal or business consulting; conducting audits and investigations.	The legal basis for processing personal data for business process execution and internal management, including management reporting, is that the processing is for managing efficient and responsible business operations and ensuring business continuity. This basis applies except where your interests or fundamental rights would override those interests.
Compliance with law	Examples of personal data processing under compliance with laws at BRALIRWA include: Collecting and storing employee identification information to meet labor law requirements. Maintaining health and safety records to comply with workplace safety regulations; collecting information for tax declaration; data management for pension schemes records etc.	The legal basis for processing personal data under compliance with laws is that the processing is necessary to fulfill a legal obligation that BRALIRWA is subject to. This means BRALIRWA must collect, use, or store personal data to meet specific legal requirements, such as labor law regulations, workplace safety rules, tax declarations, or pension scheme records. The company is required by law to carry out these activities and cannot opt out of them.
Organizational analysis and development, management reporting, and acquisitions and divestures	Examples: BRALIRWA aggregates personal data to support the preparation and execution of management reporting and organizational analysis. This process also involves conducting surveys to gather insights that inform business decisions and strategic direction.	The legal basis for processing personal data under organizational analysis and development at BRALIRWA is to support management reporting, conduct organizational analysis, and inform business decisions and strategic direction. This processing is considered necessary for managing responsible business operations, provided that these interests are not overridden by your own interests or fundamental rights.
Relationship management and marketing	Examples of Personal Data Processing under Relationship Management and Marketing: Collection of personal data through BRALIRWA websites, analysis of market surveys and marketing strategies, maintaining and promoting contact with consumers, such as keeping records of communications and preferences. Account management, including updating personal details and handling service inquiries.	The legal basis for processing personal data under relationship management and marketing at BRALIRWA is primarily grounded in maintaining and promoting contact with consumers, analyzing market surveys, and updating account information. The processing ensures a balance between business objectives and the protection of personal rights, as reflected in BRALIRWA's practices for collecting and utilizing personal data for marketing and relationship management purposes.
Administering events and promotions	Examples: Collecting registration details from participants for events, activities, promotions, organized by BRALIRWA. Keeping records of event attendance and participation.	The processing of personal data for events and promotions at BRALIRWA is primarily based on the company's established policies for event and promotion management. This includes the collection, storage, and use of registration details and participation records from individuals involved in events, activities, or promotions organized by BRALIRWA. This approach ensures that all processing activities are conducted in accordance with BRALIRWA's commitment to responsible data handling and are strictly aligned with the purpose of effectively managing and administering these events and promotions while respecting individuals' privacy and rights.

‍

6. Who do we share your personal data with?

Given the international scope of BRALIRWA’s activities as part of Heineken International N.V., there may be occasions when your personal data is shared with other companies within the HEINEKEN group. This sharing of information supports the effective management and coordination of global operations. In addition to internal sharing within the HEINEKEN group, your personal data may also be disclosed to external parties, such as service providers, suppliers, or other third parties, whenever it is considered necessary. These parties may be involved in supporting BRALIRWA’s business processes or providing specific services required for the company’s activities. However, in all cases, the sharing of your personal data, whether with other companies in the HEINEKEN group or with external parties, will occur strictly on a need-to-know basis. This means that only those who require access to your information for the purposes outlined in this Privacy Policy will be granted such access, ensuring that your data is handled responsibly and in accordance with the stated privacy commitments.

We can share your personal data with:

a) other departments at other companies within the HEINEKEN group of companies (for example, the global marketing department, the global legal department or the global IT department);

b) service providers of BRALIRWA where this is needed to provide us with a service (for example, IT services);

c) in case BRALIRWA sells all or some of the assets or shares to a third party, your personal data may need to be provided to this third party;

d) a competent public authority, government, regulatory, supervisory, investigative or tax agency where it is necessary to comply with a legal or regulatory obligation or as permitted by applicable law; and

e) any third party to whom BRALIRWA proposes to transfer any of its rights and/or duties.

‍

7. Transfers of your personal data between countries

If your personal data is transferred to companies within BRALIRWA or to authorized external parties located outside Rwanda, we take organizational, contractual and/or legal measures to ensure that your personal data is protected. These measures include both Standard Contractual Clauses and a data processing agreement (to the extent applicable) signed between BRALIRWA and Heineken International N.V.

‍

8. How long do we keep your personal data?

We will keep your personal data only for as long as needed for the relevant purposes as described in this Privacy Policy or as legally required or as advisable in light of an applicable statute of limitations. We delete or anonymize personal data (so that it will no longer be possible to identify you) when the personal data are no longer necessary for these purposes. In any case, unless indicated otherwise in this Privacy Policy, the criteria we use to decide our retention periods include:

a) if we need your personal data to safeguard our legitimate interest, to perform a contract to which you are subject or to respond to your questions or provide to you the required service;

b) if there is a legal obligation to which we are subject; or

c) if retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

‍

9. Your rights and how to exercise them

You have several rights in relation to your personal data. You can request us at any time:

a) to access your personal data (for example, obtain an overview of your personal data we process);

b) to have your personal data corrected, updated, rectified or erased or to restrict the processing of your personal data;

c) to receive a copy of your personal data in a commonly machine -readable format or to have this information transmitted directly to another organization (if technically possible); and

d) to lodge a complaint with the National Cyber Security Authority (NCSA) and Data Privacy and Protection Office (DPPO).

You also have a right, depending on your particular situation, to object to the processing of your personal data. This does not apply where we have prevailing legitimate interests for the processing, in which case we will continue processing your personal data. Where we would rely on your consent for the processing of your data you may withdraw your consent at any time .

‍

10. Security and integrity of your personal data

We have implemented various technical, physical and organizational measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. We use encryption and apply authentication and verification processes for access to HEINEKEN systems and services. We regularly test, assess and evaluate the effectiveness of our security measures. We will take reasonable steps to ensure that your personal data is reliable, accurate, complete and kept up to date for carrying out the purposes described in this Privacy Policy. Please update us with relevant changes to your personal data. If you suspect that your child has provided personal information to us without permission, you can contact us using the contact information below.

‍

11. Cookies

We use cookies and similar technologies that collect and store information when you visit BRALIRWA’s website(s). This is to enable BRALIRWA to identify your internet browser and collect data on your use of our website(s), which pages you visit, the duration of your visits and identify these when you return so that we improve your experience when visiting our website(s). For example, to remember your account settings, language and country, but also enables us to measure and analyze your behavior on our website and for showing you personalised advertisements on our website or on third party websites. You can control and manage your cookies preferences by adjusting your browser settings.

‍

12. No personal data of children

Our websites, apps, services and activities are not intended for use by individuals under the age of 18 (or the applicable legal age for consuming our specific products). A so-called “age-gate” is included in most of our websites. We do therefore not knowingly collect personal data from individuals under the age of 18. BRALIRWA is not liable for the consequences of processing personal data of children without the consent of their parent(s) or guardian. If we discover that we have collected personal data from children without the consent of their parent(s) or guardian, we will take steps to remove this data from our systems. If you suspect that your child has provided personal information to us without permission, you can contact us using the contact information below.

‍

13. Communication and marketing - your choices

If you have consented to receive communications from BRALIRWA (or if you have previously purchased goods/and or services from us and permitted by local law), you could receive offers that are tailored towards your preferences based on the information gathered about you from the various sources described above in order to provide you with better products and increasingly tailored services.

We could send you updates and notifications without your advance consent only where such updates and/or notifications are necessary for the proper functioning of the BRALIRWA apps or other services that you use.

‍

14. Personal Data Breach and Notification.

BRALIRWA is dedicated to protecting the personal data of its employees, customers and consumers.. A personal data breach refers to a breach of personal data security leading to unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed or privacy of this information in so far as the compromise poses a high risk to the individuals whose data is concerned (e.g. financial, reputational or other harm).

Where a personal data breach occurs, or is likely to occur, BRALIRWA shall immediately take all appropriate and legally required steps to address the incident

‍

17. Interacting with BRALIRWA via social media

If you choose to interact with BRALIRWA through social media on a BRALIRWA administered social media page (“BRALIRWA social media page”) such as Facebook, Instagram, YouTube, X or LinkedIn, your personal data (such as your name, your profile picture and the fact that you are interested in BRALIRWA) will be visible to all visitors of your personal webpage depending on your privacy settings on the relevant social media platform, and will also be visible to BRALIRWA. You can delete any information that you share on these sites at any time through your relevant social media platform’s account.

Please contact BRALIRWA if you wish to make a request that you are unable to act yourself and which relates to a BRALIRWA social media page. You can contact us using the contact information below.

‍

E-mail Address: bralirwa@heineken.com

Kigali (Head Office)

Location: Urugero village | Ngoma cell | Kicukiro sector | Kicukiro district | KK 500 Street.

P.O. Box 131.

Tel. +250786090102.

‍

Gisenyi (Brewery)

Busumba Village| Munanira Cell | Nyamyumba Sector| Rubavu District| Western Province

P.O. Box 180.

Tel. +250786090104.

‍

To the extent BRALIRWA is jointly responsible with a social media platform in respect of a BRALIRWA social media page, BRALIRWA will have access through the social media platform to aggregated data providing statistics and insights that help to understand the types of actions you take on BRALIRWA social media pages. For more information on how your personal data are processed on those social media platforms, including any targeted advertising that you may receive, please refer to your privacy settings accessible through your relevant social media platform’s account. We advise you to carefully read the privacy policies of the social media parties as these are applicable to the processing of your personal data by these parties.

‍

17. How to contact us and where to find other information

For questions about this Privacy Policy, our use of your personal data, or how to exercise your privacy rights, you can contact us at email: bralirwa@heineken.com.

‍

18. Changes to this Privacy Policy and last update

We will keep this Privacy Policy under review and change it from time to time. We advise you to regularly review this Privacy Policy for possible updates.

This Privacy Policy was last updated on 19th.01.2026.