The Coca‐Cola Company Privacy Policy

1. Policy Summary

The Coca-Cola Company and wholly-owned direct and indirect subsidiaries ("TCCC") respects the
 privacy of individuals and wants to ensure that all Personnel are familiar with its practices and procedures
 for protecting all Personal Information that TCCC collects, uses and discloses. This Privacy Policy ("Policy")
 sets out the uniform minimum standard TCCC will take with respect to the worldwide Processing of Personal
 Information, and provides appropriate and consistent safeguards for the handling of Personal Information by
 its Personnel.

2. Policy Applies To / Eligibility

This policy applies to all employees of The Coca-Cola Company and its worldwide subsidiaries, including
 officers, directors, and agents.

3. Policy Details

3.1. Purpose of Data Processing

TCCC Personnel will only process Personal Information for legitimate business needs, or as otherwise required
 or authorized by law. TCCC's legitimate business needs include:

  • providing products and services requested by its customers and consumers;
  • protecting security and safety of TCCC and Individuals including its customers, consumers, business
 partners, and Personnel;

  • marketing of products and services including running contests and promotions;
  • protecting TCCC's economic and financial interests;
  • managing its workforce including providing benefits and entitlements (such as compensation and benefits)
 to Personnel;

  • communicating with Individuals including Personnel, business partners, consumers and customers;
  • safeguarding uninterrupted continuity of business operations;
  • carrying out an (intended) sale, merger, or acquisition or other corporate transaction;
  • preventing, detecting, and prosecuting (including cooperation with public authorities) of
 suspected fraud and security, other breaches of (criminal) law, breaches of the terms of employment or
 other rules or codes, including internal controls, audit, or lawful investigations by a governmental
 body or public authority and related internal investigations;

  • protecting the rights and freedoms of TCCC, its customers, consumers, business partners, and Personnel;

  • complying with legal requirements.

3.2. Security and Confidentiality

TCCC and its Personnel will take appropriate and commercially reasonable technical and organizational
 measures to protect Personal Information against unauthorized or accidental access, acquisition, loss,
 disclosure, destruction or damage.

Access to internal TCCC systems that contain Personal Information is limited to a select group of authorized
 TCCC users who have a business need to access particular Personal Information. TCCC users are given access
 to such systems through the use of a unique identifier and password and other access control mechanisms.

Personnel who need permanent or regular access to Personal Information are bound by contract, code of
 conduct, work rules, or policies that protect the confidentiality of the Personal Information.

3.3. Notice

TCCC entities will provide each Individual with information as to the Personal Information collected from him
 or her, the purposes for which such information is collected, the identity of the entity responsible for the
 collection, as well as other information such as access and correction rights, unless the Individual already
 has such information. Such information may be provided in written or electronic form or by providing a link
 to a website in accordance with applicable law. The information will be easily accessible, for example,
 published on the TCCC website for customers or on the TCCC intranet for TCCC Personnel.

Where the Personal Information has not been obtained directly from Individuals, Individuals will be informed
 as appropriate and in compliance with local law. If personal information is disclosed to a Third Party,
 Individuals will be informed as appropriate.

The TCCC Global Privacy Council (see section 13) may allow exemptions in case of compelling business
 interests, or where informing all Individuals is impossible or disproportionate.

3.4. Choice

When appropriate and as required by law, TCCC entities will provide customers, consumers and Personnel with
 the right to choose how, when, and for what purpose(s) their Personal Information will be Processed. This
 choice will vary depending on the types of information to be Processed, the proposed purpose(s) of
 Processing, and the extent to which misuse of such information is likely to result in severe harm or damage
 to the Individual. For example, TCCC will provide Individuals with the opportunity to opt out when their
 Personal Information is to be disclosed to a Third Party for marketing purposes. If, however, third party
 disclosures are necessary in order to provide a product or service requested by the Individual, or if third
 party entities have been hired by TCCC to perform services, then the Individual may not be given the
 opportunity to opt out, except where required by law. In such instances, TCCC will remain accountable for
 the handling of the Personal Information by its Agents and Service Providers.

TCCC does not collect Sensitive Personal Information, except in specific and limited cases. In such cases,
 the information is Processed in compliance with applicable law.

3.5. Access and Correction Rights

TCCC entities will ensure that Individuals may request information regarding the Personal Information stored
 or Processed about them by any TCCC entity. When requested, Individuals will be provided with reasonable
 access to Personal Information as required by applicable law.

If any TCCC Personal Information is inaccurate or incomplete, Individuals may request that their Personal
 Information be corrected.

Requests for access, correction, or deletion may be denied in some instances, such as where required by law,
 if the request is unreasonable, if the request will receive personal information regarding someone else, or
 for other compelling reasons. Where a request is denied, consistent with applicable law, TCCC will inform
 the Individual about its reasons for such denial, except where compelling business interests require

3.6. Data Quality

Reasonable steps will be taken to maintain accuracy of Personal Information based on the intended purposes of

3.7. Cross-Border Transfers

Your personal information will be shared with affiliates that are in other countries including the US, which
 may have different data protection laws than in the country in which you work.

3.8. Retention of Personal Information

TCCC will retain Personal Information consistently with its legal obligations and consistently with its data
 retention policies and procedures. See "InfoAccess: Managing Records and Information", available

In addition, TCCC will dispose of Personal Information that is no longer needed in a responsible manner.

3.9. Service Providers

At times, TCCC entities may share Personal Information with selected Service Providers that deliver products
 and services. Service Providers are selected to: (i) process Personal Information only to deliver products
 and services as instructed by TCCC; (ii) not disclose or transfer Personal Information to or allow access by
 any Third Party (including affiliates and subcontractors) without TCCC's prior permission; (iii) put in
 place appropriate security standards to ensure that the Personal Information is kept confidential and
 secure; (iv) inform TCCC of any inspection, audit, or inquiry made by any supervisory authority with regard
 to the Personal Information under its control; (v) notify TCCC promptly when it reasonably believes that
 there has been any unauthorized or accidental access, acquisition, loss, disclosure, destruction or damage
 of Personal Information ("Security Breach; and (vi) to return or destroy the Personal Information to
 TCCC upon termination or expiration of the relationship or upon request.

3.10. Third Parties

TCCC may disclose certain Personal Information to unaffiliated third parties as a matter of law, to protect
 TCCC's rights, or in an emergency, to the extent necessary for the purposes permitted by this Policy or
 where the TCCC Global Privacy Council has authorized the disclosure.

 In certain circumstances, TCCC may not remain accountable for this sharing. For example an unaffiliated
 third party for whom TCCC is not accountable includes mortgage companies, Individuals seeking a reference,
 credit bureaus, collection agencies, or government entities. If an Individual expressly requests that TCCC
 transfers data to a specific unaffiliated third party,

TCCC will do so with no further obligation to ensure that the Personal Information are Processed properly, or
 that the unaffiliated third party destroys the Personal Information once the Processing has been

3.11. Direct Marketing

TCCC will not process Personal Information to conduct direct marketing, unless Individuals are given an
 opportunity to opt out of receiving direct marketing communications, or, where required by law, have
 provided their prior express consent.

3.12. Children

TCCC will specifically instruct children not to submit Personal Information and/or will take reasonable steps
 to ensure that parental consent is obtained for such submission. In the consumer context, TCCC will
 specifically instruct children under 13 not to submit Personal Information and/or will take reasonable steps
 to ensure that parental consent is obtained for such submission.

3.13. Training

Appropriate training will be provided to Personnel who have permanent or regular access to Personal
 Information or who are involved in the collection of Personal Information.

3.14. Complaint Handling/Enforcement Process

TCCC has appointed Global Privacy Council, which ensures compliance with this Policy.

All TCCC entities and Personnel will ensure that this Policy is observed. Non-compliance with this Policy may
 result in disciplinary sanctions, dismissal, or any other type of sanction permitted by applicable law.

If at any time any person subject to this Policy believes that Personal Information are or have been
 Processed in violation of this Policy, he or she may report the concern to the TCCC Chief Privacy Officer by
 e-mail at ; the local Legal
 office; the local Human Resources office; or the Ethics & Compliance Office

Ethics & Compliance Office

 The Coca-Cola Company

 One Coca-Cola Plaza

 Atlanta, Georgia 30313 USA


 Phone: +1-404-676-5579

 Fax: +1-404-598-5579

If any Worker believes that he or she is not able to comply with this Policy because of legal requirements or
 instructions given to him or her, he or she should also report that information.
 The TCCC Global Privacy Council, in cooperation with other appropriate Personnel, will take the necessary
 and appropriate steps and inform the relevant person about the outcome of the process.

3.15. Audit

TCCC will periodically monitor compliance with this policy.

3.16. Obligations Towards Data Protection Authorities

TCCC will respond diligently and appropriately to inquiries from data protection authorities and other
 regulators with jurisdiction about this Policy or compliance with applicable data protection and privacy
 laws and regulations.

All inquiries relating to this Policy should be directed to TCCC Global Privacy Council:

3.17. Relationship between this Policy and national law

TCCC recognizes that certain laws may impose requirements stricter than those described in this Policy. TCCC
 will handle Personal Data in accordance with applicable local law. Where applicable local law provides a
 lower level of protection of Personal Data than that established by this Policy, then the requirements of
 this Policy will apply.

3.18. Implementation of and Modifications to this Policy

This Policy was enacted January 2007; amendments to this Policy will become effective February 2013. This
 Policy shall be published on the TCCC Intranet.

TCCC reserves the right to modify this Policy as needed, for example, to comply with changes in laws,
 regulations, TCCC practices and procedures, or requirements imposed by data protection authorities. TCCC
 will post all changes to this Policy on relevant internal websites.

4. Policy Purpose

This Privacy Policy ("Policy") sets out the uniform minimum standard TCCC will take with respect to
 the worldwide Processing of Personal Information, and provides appropriate and consistent safeguards for the
 handling of Personal Information by its Personnel.

5. Key Terms and Definitions

When used in this Policy,

"Personal Information" means any information Processed by TCCC that relates to an identifiable
 Individual. An identifiable Individual ("Individual") can be, for example an employee, independent
 contractor, temporary employee, agent, consumer, or any employee of customers, distributors, and service

"Sensitive Personal Information" means Personal Information that reveals, directly or indirectly,
 the racial or ethnic origin, political or philosophical opinions, religious beliefs, trade union membership,
 physical or mental health or sexual life or the judicial data of an Individual or personal financial
 information such as an individuals bank account number, credit card number, government issue ID (including
 Social Security number), driver's license number or biometric data.

"Processing" or "Processed" means any action that is performed on Personal Information,
 such as collecting, recording, organizing, storing, using, disclosing, transmitting, disseminating,
 blocking, or deleting such information.

"Personnel" means any Individual performing work for TCCC such as a current or former employee,
 independent contractor, and temporary agent.

"Service Provider" means any company which is not a subsidiary or affiliate of TCCC, which
 processes Personal Information on behalf of, or as directed by TCCC.

6. Related Policies, Processes, and Guidelines

  • IPP
  • Data Classification Guide
  • Personal Information
  • Privacy FAQ

Last Reviewed/Revised Date : August 2016
Original Effective Date : January 2007

For questions or clarification, please contact:

Katherine Fithen

 Chief Privacy Officer

 +1 404 676 3151


Notice of Disclaimer – Right to Vary, Terminate or Amend Policy

 The Coca-Cola Company ("the Company," "TCCC") intends to notify associates of changes to
 its policies and procedures. However, TCCC reserves the right to change, revise, withdraw, or add to its
 policies, processes, procedures, or guidance at any time, at its sole discretion, with or without notice if
 necessary, in accordance with applicable law and regulations by providing such notice as may be required by
 applicable law. If there is any discrepancy between local law, labor agreements, including works council
 agreements, or custom and the content of this policy, then local law, labor agreements and/or custom will
 always govern. This policy does not create any contractual rights or obligations, whether express or

Notice of Disclaimer – Contract of Employment

 TCCC's policies and associated processes, procedures, and guidance are not contracts of employment nor are
 they intended to create contractual rights or obligations for TCCC. The terms of this policy do not create a
 contract of employment or alter the at-will employment relationship between the Company and Employees in all
 jurisdictions where employment at-will is permitted. In instances where a contract of employment exists the
 terms of this policy are not incorporated into an associate's contract of employment with the Company.
 It is important to note that for most policies the original language is English. In the event that the
 original language is not English, the original language will govern. If there is some discrepancy between
 the original language version and any other version, then original language version governs.