The purpose of this "Privacy and Personal Data Protection Policy" is to clarify and present the obligations and rights stipulated by the new General Data Protection Regulation (hereinafter referred to as "GDPR"). Accordingly, this Policy will seek to demonstrate how we may collect, safeguard, process, share and transfer your personal data when establishing any relationship with CR&F Lda. part of the J. Portugal Ramos Vinhos, S. A. Group. This is our way of helping you to obtain the necessary information about our best practices regarding data processing and protection. Therefore, we ask you to please read this policy carefully. It is of utmost importance that after reading it you provide us with your express consent for the maintenance and processing of your personal data, in order to authorise us to send you our communications/Newsletters. CR&F, Lda, legal entity No. 507804325, with registered office at Vila Santa, 7100-149, Estremoz, Portugal, is the entity responsible for the collection and processing of your personal data for the purposes presented below. Should you feel that you have not been fully informed about this policy, please do not hesitate to contact us via our website www.crfaguardente.pt or using the following e-mail crf@jportugalramos.pt or by letter to the following address: Vila Santa, 7100-149 Estremoz.

The GDPR defines personal data as any information that allows the identification or identifies, directly or indirectly, a natural person. A natural person is considered identifiable if he or she can be identified, directly or indirectly, namely by reference to an identifier (e.g. an identification number, name and surname, address, email address). In order to provide you with a better experience with our products, CR&F, Lda. uses certain personal details strictly for the purpose of registering you as a customer to allow you to make purchases, and sending you our Newsletter containing our offers, promotions, news and any other information related to our business.
Thus, for the registration of customers we ask you to provide the following details:
– Customer's Name or abbreviation;
– Taxpayer No;
– Telephone/Mobile Phone;
– E-mail;
– Date of Birth;
– Billing address and/or delivery address.
In order to send our Newsletter we use the following details: – Customer's name and
E-mail.

Your personal data may be processed by CR&F, Lda. specifically for our records concerning the creation of customer accounts / billing and to send you our Newsletters. Therefore, you will only give your consent for the above-mentioned purposes. In relation to Newsletters, we may send you information that we consider to be of interest to you. In view of the above, CR&F hereby clarifies that it does not request, nor does it store, in any place or manner, the remittance and sending of personal data regarding philosophical or political convictions, party or trade union affiliation, religious faith, private life and racial or ethnic origin, as well as the processing of data relating to health and sex life, including genetic data. Thus, should such personal data be transmitted to CR&F, Lda, CR&F, Lda cannot be held responsible for their processing under this Policy.

Your personal data will be processed and stored electronically and in paper if necessary. CR&F, Lda. is committed to guaranteeing the security and protection of your personal data provided to us. To this end, we have adopted the measures and best practices deemed necessary for this purpose. By way of example we would like to mention some of the procedures we have implemented: (i) protection with passwords; (ii) electronic access restrictions with determination of profiles for employees; (iii) physical entrance restrictions to the places where the personal data storage servers are located; (iv) firewalls; among other specific procedures to ensure the protection of your data. CR&F, Lda. informs you that these security measures will be constantly reviewed and updated according to the needs and requirements inherent to the legislation in force. Additionally, we inform you that we will actively work together with the Information Technology company in order to continuously improve the safety and control process regarding the personal data in our systems. Should, for any reason, a breach of security occur in an accidental or illicit manner leading to the destruction, loss, alteration, unauthorised disclosure of or access to personal data, CR&F, Lda undertakes to notify the competent authorities under the terms of the applicable legislation without justified delay and, whenever possible, within 72 hours of becoming aware of such occurrence. Notice will also be given to the data subject of the possible breach in accordance with the applicable legislation. Along with the measures implemented by CR&F, Lda, we would like to emphasise the need for the data subject to also implement security measures such as an active firewall, updated anti-virus and anti-spyware.

In the course of its activity CR&F, Lda. may use the services of third parties, which may involve access to your personal data by such entities. Should this be necessary, CR&F, Lda undertakes to take all measures within its power to ensure that third parties also offer a high level of control and data protection, including enshrining this issue in a written contractual clause signed by CR&F, Lda and the contracted third party. It should be noted that CR&F. Lda. will remain jointly responsible for the treatment of your data.

CR&F, Lda. needs your consent by means of a free, specific, informed and explicit manifestation of will, through a declaration or positive unequivocal act, in order to have the legitimacy to proceed with the processing of your data for the purposes and activities described above. Therefore, your written consent will be our legitimate legal basis for us to carry out the processing of your data, which may serve for: compliance with our legal obligations; protection of your interests or those of other persons, as necessary in the public interest; and as necessary for our legitimate interests, including our interests in providing tailored products, unless our interests are overridden by your interests or fundamental rights and freedoms requiring the protection of personal data. All our marketing actions follow what we think will best serve our customers' interests. We may use your data to present you with advertisements and other content on other websites.

Under the GDPR, you have several rights: access, rectification, portability, objection and erasure of your data. You also have the right to object and to limit specific processing of your data. If you have any questions or would like to contact us so that we can satisfy whatever right is present below, we ask that you send an e-mail to crf@jportugalramos.pt or a letter to the following address: Vila Santa, 7100-149 Estremoz, with your request and your identification. Below we provide a slightly more detailed overview of the main rights foreseen in the RGPD: Right to object: if we use your data because we consider it necessary for our legitimate interests and you do not agree with this, you can exercise your right to object to our data processing. Simply send us an e-mail to crf@jportugalramos.pt, or a letter to the following address: Vila Santa, 7100-149 Estremoz and we will respond to your request within 15 days (in certain cases we may extend this period for the same amount of time). In the event of opposition, we will cease the processing of your data, except in the event of compelling legitimate grounds for such processing which override the interests, rights and freedoms of the data subject, or for the purposes of the establishment, exercise or defence of legal claims. Right to withdraw consent: as our basis of legitimacy for carrying out the processing of your personal data, with regard to customer registration or marketing actions, is your consent, your right to withdraw consent at any time you deem necessary is guaranteed. We would like to remind you that the withdrawal of consent does not render illicit the processing carried out on the basis of the previously granted consent. Right of Access: you have the right to ask us to have access to the information we hold about you at any time. Furthermore, you may ask us to amend, rectify or update this information. Upon receipt of your request to be made via email (crf@jportugalramos.pt) or letter to the following address: Vila Santa, 7100-149 Estremoz, we may proceed to resolve it immediately or request proof of your identity, as well as ask for additional information about your request. Our answers will be given by means of a reply to you e-mail or by letter, as applicable. Right to erasure: you have the right to the erasure of your personal data. This will occur upon formal request, via e-mail or letter sent to the following address: Vila Santa, 7100-149 Estremoz for specific situations where we have unlawfully processed your data We will respond to your request within 15 days (which may be extended for an equal period of time if necessary). Upon receipt of your request, we will erase your data, without prejudice to the fact that your request may be refused on compelling legitimate grounds for such processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. Right to data portability: you have the right to transfer your data held by us to another controller. If necessary, we will work to ensure that such transfer of your data is transmitted in a machine-readable and commonly used format. Right to complain to a supervisory authority: You also have the right to lodge a complaint with the national supervisory authority. Right to know about a data breach: You have the right to learn of any breach of your personal data. Right to restriction of processing: Right to challenge: the accuracy; the unlawfulness; the necessity of the data for processing purposes, or when such data is required by the data subject for legal proceedings; and also upon opposition by the data subject. • – If you do not maintain interest in our marketing actions, you can cancel your subscription at any time by sending an e-mail to crf@jportugalramos.pt or a letter to the following address: Vila Santa, 7100-149 Estremoz. • If you wish to know more about your rights regarding the personal data we hold concerning you, you can send an e-mail to crf@jportugalramos.ptor a letter to the following address: Vila Santa, 7100-149 Estremoz to which we will respond as soon as possible.

How long we will keep your personal data depends on how long our relationship is. We will store your data until they are no longer needed to provide our Products to you or until you unsubscribe from our Newsletters. Therefore, this is a determination that varies on a case-by-case basis and will depend entirely on our relationship as well as factors such as the nature of the data, the reason it has been collected and processed and the relevant operational or legal retention requirements.

CR&F, Lda. may at any time make adjustments or amendments to this privacy and personal data protection policy, provided that such amendments are duly published on this website www.crfaguardente.pt. The version published on the website is the current version in force Dispute Resolution Under Law No. 144/2015 of 08/09, which regulates the scheme applicable to the Mechanisms for Out-of-Court Settlement of Consumer Disputes, we hereby inform you that, in the event of a dispute, the consumer may appeal to the competent entities for Alternative Dispute Resolution identified in the consumer portal, on the website http://www.consumidor.pt, or the Online Consumer Dispute Resolution identified on the website https://webgate.ec.europa.eu/odr. The alternative dispute resolution entities currently in existence are as follows: • CNIACC – National Centre for Information and Arbitration of Consumer Conflicts Generic jurisdiction E-mail: cniacc@unl.pt Website: http://www.arbitragemdeconsumo.org • Algarve Centre for Information, Mediation and Arbitration of Consumer Conflicts Geographical area covered – contracts concluded in the District of Faro E-mail: apoio@consumidoronline.pt Website: http://www.consumidoronline.pt/ • District of Coimbra Centre for Arbitration of Consumer Conflicts Geographical area covered – contracts concluded in the following municipalities: Arganil, Cantanhede, Coimbra, Condeixa-a-Nova, Figueira da Foz, Góis, Lousã, Mira, Miranda do Corvo, Montemor-o-Velho, Oliveira do Hospital, Penacova, Penela, Soure, Tábua, Vila Nova de Poiares. E-mail: geral@centrodearbitragemdecoimbra.com Website: http://www.centrodearbitragemdecoimbra.com • Lisbon Centre for Arbitration of Consumer Conflicts Geographical area covered – contracts concluded in the Lisbon Metropolitan Area: Lisbon, Alcochete, Almada, Amadora, Azambuja, Barreiro, Cascais, Lisboa, Loures, Mafra, Moita, Montijo, Odivelas, Oeiras, Palmela, Seixal, Sesimbra, Setúbal, Sintra and Vila Franca de Xira. E-mail: juridico@centroarbitragemlisboa.pt / director@centroarbitragemlisboa.pt Web: http://www.centroarbitragemlisboa.pt • Porto Centre for Consumer Information and Arbitration Geographical area covered – contracts concluded in the Porto Metropolitan Area: Arouca, Espinho, Gondomar, Maia, Matosinhos, Oliveira de Azeméis, Porto, Póvoa de Varzim, Santa Maria da Feira, Santo Tirso, São João da Madeira, Trofa, Vale de Cambra, Valongo, Vila do Conde and Vila Nova de Gaia. E-mail: cicap@mail.telepac.pt Website: http://www.cicap.pt • Vale do Ave / Arbitration Court Centre for Arbitration of Consumer Conflicts Geographical area covered – contracts concluded in the following municipalities: Cabeceiras de Basto, Fafe, Felgueiras, Guimarães, Póvoa de Lanhoso, Póvoa de Varzim, Santo Tirso, Trofa, Vila do Conde, Vila Nova de Famalicão, Vizela, Vieira do Minho and Vizela. E-mail: triave@gmail.com Website: http://www.triave.pt • CIAB – Centre for Information, Arbitration and Consumer Conflicts Geographical area of: Amares, Arcos de Valdevez, Barcelos, Braga, Caminha, Esposende, Melgaço, Monção, Montalegre, Paredes de Coura, Ponte da Barca, Póvoa do Lanhoso, Terras do Bouro, Valença, Viana do Castelo, Vila Nova de Cerveira, Vieira do Minho and Vila Verde. E-mail geral@ciab.pt Website: http://www.ciab.pt • Madeira Centre for Arbitration of Consumer Conflicts E-mail: centroarbitragem.sras@gov-madeira.pt Web: http://www.srrh.gov-madeira.pt