Privacy Policy Mövenpick Holding AG (B2B)

v. 1.0 of 15 September 2026

1. Controller and Content of this Privacy Policy

We, Mövenpick Holding AG, Oberneuhofstrasse 12, 6340 Baar, Switzerland, are the operator of the website www.b2b.moevenpick-finefood.com (Website) and are, unless otherwise stated in this privacy policy, responsible for the data processing described in this privacy policy.

Please take note of the information below to know what personal data we collect from you and for what purposes we use it. When it comes to data protection, we primarily adhere to the legal requirements of Swiss data protection law, in particular the Federal Act on Data Protection (FADP), as well as the EU General Data Protection Regulation (GDPR), which may be applicable in individual cases.

Please note that the following information may be reviewed and amended from time to time. Therefore, we recommend regularly checking this privacy policy for any updates. Furthermore, for individual data processing listed below, other companies are responsible under data protection law or jointly responsible with us, so that in these cases, the information provided by those companies is also relevant.

This Privacy Policy applies exclusively to our business-to-business activities and the website www.b2b.moevenpick-finefood.com. A separate privacy policy applies to our consumer-facing (B2C) website and services.

2. Contact Person for Data Protection

If you have any questions regarding data protection or wish to exercise your rights, please contact our data protection contact person by sending an email to the following address: privacy@moevenpick-group.com.

You can reach our EU data protection representative at:

MLL EU-GDPR GmbH, Ganghoferstrasse 33, 80339 Munich, Germany, moevenpickholding@mll-gdpr.com

3. Data Processing when Contacting Us and Managing Business Enquiries

If you contact us through our contact addresses and channels (e.g., by email or phone), your personal data is processed. We process the data you provide us with, such as your name, company name, your role, your email address, your phone number, and your request. We process this data to address your request (e.g., providing information about our fine food products and distribution opportunities, supporting business enquiries, incorporating your feedback, etc.). If you contact us regarding a potential or existing business relationship, including licensing, distribution, supply, retail, import, food service or other commercial cooperation, we process the information you provide, such as your company and personal information (e.g., name, role, email address, phone number), relevant business information (e.g., turnover, product interests, target markets), and the content of our communications. We process this data to assess and respond to your enquiry, manage potential or existing business relationships, and take steps towards entering into or performing a contract.

The legal basis for this data processing is our legitimate interest under Article 6(1)(f) of the GDPR in addressing your request or, if your request is aimed at the conclusion or performance of a contract, in the implementation of the necessary measures within the meaning of Article 6(1)(b) of the GDPR.

4. Compliance with Legal Obligations and Protection of our Legal Interests

The personal data referred to in this Privacy Policy may also be processed where this is necessary to comply with legal obligations or to protect, defend or enforce our legal interests or the rights and interests of third parties. This may include, in particular, investigating incidents, preparing, asserting or defending legal claims, and providing information to public authorities where required by law. For these purposes, personal data may also be disclosed to authorities and other third parties, such as courts, debt enforcement offices, supervisory authorities, legal advisers, tax advisers, accountants or auditors.

To the extent that the processing is necessary for compliance with a legal obligation under applicable EU or Member State law, the legal basis is Article 6(1)(c) of the GDPR. In other cases, the legal basis is our legitimate interest within the meaning of Article 6(1)(f) of the GDPR in complying with applicable legal requirements and protecting, defending and enforcing our legal interests or the rights and interests of third parties.

5. Disclosure and Cross-Border Transfer

5.1 Disclosure to Third Parties and Third-Party Access

Without the support of other companies, we would not be able to provide our fine food products and distribution opportunities in the desired form. To use the services of these companies, it is necessary to share your personal data with these companies to a certain extent. A disclosure of data is limited to selected third-party service providers and only to the extent necessary for the optimal provision of our services.

In connection with the Website, we use the services of Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, United States (Webflow). For more information about data processing in connection with Webflow, see https://webflow.com/legal/eu-privacy-policy.

The legal basis for this data processing is the performance of a contract within the meaning of Article 6(1)(b) of the GDPR.

Your data may be disclosed to third parties to the extent necessary for the fulfilment of the contractual relationship, e.g., to Webflow or providers of other services. The legal basis for these disclosures is the necessity for the performance of a contract within the meaning of Article 6(1)(b) of the GDPR. For these data processing activities, the third-party service providers are considered data controllers under the data protection laws, and not us. It is the responsibility of these third-party service providers to inform you about their own data processing, which may extend beyond the mere sharing of data for the provision of services, and to comply with data protection laws.

In addition, your personal data may be disclosed where this is necessary to comply with our legal obligations or to protect, defend or enforce our legal interests or the rights and interests of third parties (see Section 4). Data may also be disclosed if another company intends to acquire our company or parts thereof, and such disclosure is necessary to conduct a due diligence or to complete the transaction.

The legal basis for this data processing is our legitimate interest within the meaning of Article 6(1)(f) of the GDPR in facilitating the sale of our company or parts thereof.

5.2 Transfer of Personal Data to Third Countries

We have the right to transfer your personal data to third parties located abroad if it is necessary to carry out the data processing described in this Privacy Policy. Specific data transfers have been mentioned in Section 5.1. When making such transfers, we will ensure compliance with the applicable legal requirements for disclosing personal data to third parties. The legal provisions governing the disclosure of personal data to third parties are duly observed.

The countries to which data is transmitted include those that, according to the decision of the Federal Council and the European Commission, have an adequate level of data protection (such as the member states of the EEA or, from the EU's perspective, Switzerland), as well as those countries (such as the USA) whose level of data protection is not considered adequate (see Annex 1 of the Data Protection Ordinance (DPO) and the website of the European Commission). If the country in question does not provide an adequate level of data protection, we ensure that your data is adequately protected by these companies by means of appropriate safeguards, unless an exception is specified on a case-by-case basis for the individual data processing (see Article 49 of the GDPR). Unless otherwise specified, an adequate level of protection may be ensured by selecting recipients certified under an applicable Privacy Framework Agreement or by implementing appropriate safeguards, such as standard contractual clauses within the meaning of Article 46(2)(c) of the GDPR and, where required, additional technical and organisational measures. Further information is available on the websites of the Federal Data Protection and Information Commissioner (FDPIC) and the EU Commission. If you have any questions regarding the implemented measures, please reach out to our data protection contact person (see Section 2).

5.3 Information on Data Transfers to the USA

Some of the third-party service providers mentioned in this Privacy Policy are based in the USA. For the sake of completeness, we would like to inform users residing or based in Switzerland or the EU that certain third-party service providers mentioned in this privacy statement are located in the USA. It is important to note that there are surveillance measures by US authorities in place that generally allow for the storage of all personal data of individuals whose data has been transmitted from Switzerland or the EU to the United States. This occurs without differentiation, limitation, or exception based on the purpose for which the data is being collected and without an objective criterion that would restrict US authorities' access to the data and its subsequent use to specific, strictly limited purposes that can justify the interference associated with accessing and using the data. Furthermore, we would like to point out that affected individuals from Switzerland or the EU do not have legal remedies or effective judicial protection against general access rights of US authorities, which would allow them to access the data concerning them and to rectify or delete it. We explicitly highlight this legal and factual situation to enable you to make an informed decision regarding your consent to the use of your data.

For users residing in Switzerland or a member state of the EU, we also want to inform you that, from the perspective of the European Union and Switzerland, the United States does not provide an adequate level of data protection, among other reasons, as explained in this paragraph. In cases where we have mentioned in this privacy statement that data recipients are located in the United States, we will ensure through the selection of companies certified under the Privacy Framework Agreement or, in some cases additionally, the use of standard contractual clauses within the meaning of Article 46(2)(c) GDPR, which can be found on the websites of the Federal Data Protection and Information Commissioner (FDPIC) and the EU Commission, that your data is adequately protected at our third-party service providers.

6. Data Processing when Visiting our Website (Log File Data)

When you visit our Website, the servers of our hosting provider Webflow temporarily store every access in a log file. The following data is collected without your intervention and stored by us until automatically deleted:

• IP address of the requesting computer;
• date and time of access;
• name and URL of the accessed file;
• website from which the access was made, if applicable, with the search word used;
• operating system of your computer and the browser you are using (including type, version, and language setting);
• device type in case of access from mobile phones;
• city or region from which the access was made; and
• name of your internet service provider.

The collection and processing of this data is carried out for the purpose of enabling the use of our Website (establishing a connection), ensuring the long-term security and stability of the system, and enabling error and performance analysis and optimisation of our Website.

In case of an attack on the network infrastructure of the Website or suspicion of other unauthorised or improper use of the Website, the IP address and other data will be analysed for clarification and defence purposes; if necessary, they may be used in civil or criminal proceedings for the identification of the respective user.

The legal basis for this data processing is our legitimate interest within the meaning of Article 6(1)(f) of the GDPR in the purposes described above.

7. Retention Periods

We only store personal data for as long as it is necessary to carry out the processing described in this privacy policy within the scope of our legitimate interests. The following retention periods apply to the respective data categories:

• Contact and business enquiry data and business correspondence: 3 years after the last communication, unless longer retention is required for legal reasons;
• Server log files: 6 months;
• Contractual and accounting data: 10 years in accordance with statutory retention obligations under Swiss accounting and tax law.

If we no longer need this data to provide services for you, the data will be blocked. This means that the data may then only be used if this is necessary to fulfil the retention obligations or to defend and enforce our legal interests. The data will be deleted as soon as there is no longer any legal obligation to retain it and no legitimate interest in its retention exists.

8. Data Security

We use appropriate technical and organisational security measures to protect your personal data stored with us against loss and unlawful processing, in particular unauthorised access by third parties. Our employees and the service companies mandated by us are obliged to maintain confidentiality and uphold data protection. Furthermore, these persons are only granted access to personal data to the extent necessary for the performance of their tasks.

Our security measures are continuously adapted in line with technological developments. However, the transmission of information via the Internet and electronic means of communication always involves certain security risks and we cannot, therefore, provide any absolute guarantee for the security of information transmitted in this way.

9. Your Rights

If the legal requirements are met, as a data subject, you have the following rights with respect to data processing:

Right of access: You have the right to request access to your personal data stored by us at any time and free of charge if we process such data. This gives you the opportunity to check what personal data concerning you we process and whether we process it in accordance with applicable data protection regulations.

Right to rectification: You have the right to have inaccurate or incomplete personal data rectified and to be informed about the rectification. In this case, we will also inform the recipients of the data concerned about the adaptations we have made, unless this is impossible or involves disproportionate effort.

Right to erasure: You have the right to obtain the erasure of your personal data under certain circumstances. In individual cases, particularly in the case of statutory retention obligations, the right to erasure may be excluded. In this case, the erasure may be replaced by a blocking of the data if the requirements are met.

Right to restriction of processing: You have the right to request that the processing of your personal data be restricted.

Right to data portability: You have the right to receive from us, free of charge, the personal data you have provided to us in a machine-readable format.

Right to object: You have the right to object at any time to data processing, especially with regard to data processing related to direct marketing (e.g., marketing emails).

Right to withdraw consent: You have the right to withdraw your consent at any time. However, processing activities based on your consent in the past will not become unlawful due to your withdrawal.

To exercise these rights, please send us an e-mail to the following address: privacy@moevenpick-group.com.

Right of complaint: You have the right to lodge a complaint with a competent supervisory authority, e.g., against the manner in which your personal data is processed.

‍

‍