PERSONAL DATA PROTECTION POLICY

This personal data protection policy (the “Policy”) explains how your personal data are collected and processed in
the context of the presentation of Baron Philippe de Rothschild SA’s wine brands. You may also be asked, on the
websites accessible from the addresses listed below, to fill in a contact form so that you can contact us or request
a guided tour.

https://www.bpdr.com

https://www.chateau-mouton-rothschild.com
https://www.chateau-clercl-milon.com
https://
www.chateau-darmailhac.com
https:// www.domaine-de-baronarques.com
https:// www.moutoncadet.com
https://
www.escudo-rojo.com

You can access the various sections of the Policy directly by clicking on the following links:

Controller of the processing of personal data
What personal data do we collect?
What do we use your personal data for?
How long do we keep your personal data
Cookies
Who do we share your personal data with?
Your rights
Changes to the Policy

1. Controller of the processing of personal data

Baron Philippe de Rothschild SA is the controller of the processing of your personal data collected in connection
with the presentation of the Company’s wine brands and the offer of guided tours of certain estates. The Company
determines how personal data are collected and what they are used for. As such, it is responsible for protecting the
data and the guarantor of the processing of your personal data.

Contact details of the controller of the processing:
BARON PHILIPPE DE ROTHSCHILD S.A.
Société anonyme with capital of €6,250,000
Registered in the Bordeaux Trade and Companies Register as no. 459
020 644
Registered office: 10, rue de Grassi – 33 250 PAUILLAC
mesdonnees@bphr.com

The terms “the
Company”, “it” and “we” in the Policy refer to Baron Philippe de Rothschild SA.

2. What personal data do we collect?

We collect and process various types of personal data.

Personal data which we collect directly from you:
We collect and process the personal data you
provide us with in the context of a request for information using our contact forms, a visit reservation request
using our visit forms, a wine authentication request using the authentication service or the submission of a job
application using the general application form (for unsolicited applications) or the recruitment application form
(for job offers).

The types of personal data we collect in this context include:

– general identification data (individual or
professional; title, name(s) and first name(s), nationality, email address, phone number where applicable);
–
the specific information needed to process your contact request (the subject of your message, your message,
international trade, national French trade);
– the specific information needed to process your visit request
(desired date of visit, number of visitors, number of adults, number of children if any and their age, language of
the tour and whether you have a interpreter with you, your message);
– the specific information needed to process
your request to authenticate a bottle (your message);
– the specific information needed to register your
application (your CV/resume and any other document(s) you send, your message);
– a record of your contacts with
us, for example if you submit a request using our “Contact” form, if you request a visit using our “Reserve a visit”
form, if you contact us following a first authentication test using the authentication service, or if you submit a
job application (either unsolicited or in response to a specific offer).

You should not provide other people’s personal data without their prior consent.

When you fill in our forms,
mandatory information is indicated by an asterisk. One such piece of information is your email address because we
want to be sure that we can get back to you in response to your request. If you do not complete the corresponding
fields, we will not be able to respond to your request.

Personal data which we collect automatically:

Some personal data are collected automatically when you interact with our website.

– Browsing data: we use
cookies that enable us to track your actions when you browse Baron Philippe de Rothschild websites or when you
interact with us in some other away, for example by clicking on links in our emails. Please see the “Cookies”
section of this Policy for further details.
– Connection data: when you visit Baron Philippe de Rothschild
websites, we collect data about your connection (type of browser, operating system, source of access to the
website).

3. What do we use your data for?

We use your personal data for the following purposes, on the legal basis indicated:

4. How long do we keep your personal data?

How long we keep personal data depends on the purpose for which it was collected.

We keep personal data
collected in the context of a question about a vintage for three years as of the date of collection or the last
contact from you, for example if you submit a contact form selecting “Vintage question” in the “Message subject”
field.

We keep personal data collected in the context of a visit reservation request (via the contact form or the visit
form) for three years as of the date of collection or the last contact from you in order to keep track of our
exchanges with visitors.

We keep personal data collected in the context of a press request (via the “Press
service” option in the “Message subject” field of our contact form) for three years as of the date of collection or
the last contact from you in order to keep track of our exchanges with press and/or wine industry
professionals.

We keep personal data collected in the context of a contact with the Human Resources
Department (via the “Jobs” option in the “Message subject” field of our contact form or an online application using
the “General application” form or the “Apply for this job” form) for two years as of the date of collection or the
last contact from you in order to monitor our recruitment processes.

These data may be transferred to
authorised persons within the company and to external recruitment agencies as part of the recruitment process unless
you specifically opt out. If your application is unsuccessful, your data will not be retained once the recruitment
process is complete.

We keep personal data collected in the context of an after-sales service request (via
the “After-sales service” option in the “Message subject” field of the contact form or if that is the subject of the
description of the request) for three years as of the date of collection or the last contact from you, as part of
our sales archives.

We keep personal data collected in the context of a request using the contact forms, where the subject is “Other
questions” or cannot be attributed to one of the categories listed above, for three years as of the date of
collection or the last contact from you..

In all events, and pursuant to Article 7 below, you may at any
time ask for all or some of your data to be deleted, oppose their processing or ask for such processing to be
limited.

Your personal data will then be deleted.

Cookie lifetime

We have set the lifetime of
cookies on Baron Philippe de Rothschild websites so that it does not exceed 13 months.

5. Cookies

What is a cookie?

A cookie is a text file that servers of browsed websites or third-party
servers leave in a dedicated space on the hard disk of your terminal (computer, tablet, smartphone or any other
internet-optimised device) when you use your browser to consult online content or use an online service. It records
information about your internet browsing and enables the issuer to identify the terminal where it is stored for as
long as the cookie is valid or active.

Main types of cookie used

– Session cookies. We use session cookies for exclusively technical
and functional purposes so that you can browse Baron Philippe de Rothschild websites.

– Statistical cookies.
These cookies enable us to collect data on traffic to and use of Baron Philippe de Rothschild websites (audience
measurement), to detect browsing problems and hence to improve the quality and ergonomics of Baron Philippe de
Rothschild websites (performance analysis). These cookies are persistent, which means that they may remain on your
computer after a session until their expiry date.

The table below gives you information about the
characteristics of the statistical cookies used and how you can disable them.

https://tools.google.com/dlpage/gaoptout?hl=en-GB

Cookie Facebook
Facebook cookies. Facebook may use these cookies to measure audience and gather
statistics, to enable you to share content from the site on Facebook and for advertising purposes. They are
persistent cookies, meaning that they may remain on your computer after a session, until their expiry date. We do
not control these cookies. For more information on how Facebook cookies work, please see Facebook’s cookie policy
(https://www.facebook.com/policies/cookies/).

Security cookie: These cookies are used to ensure the security
of Baron Philippe de Rothschild websites:
– wfvt_ (30 minutes): used to detect how long the same user spends on
the site and hence to group page-view statistics;
– wordfence_verifiedHuman (24 heures / 1 jour): enables the
wordfence plug-in to check whether the internet user is a human or a robot.

Other cookies

– NID (30 jours), DSID (30 jours), IDE (30 jours): cookies left by Google to
remember user preferences, especially for certain functionalities.
– NID (6 mois), 1P_JAR (5 minutes), OGP (2
mois) : cookies left by Google to remember user preferences, especially for certain functionalities like Google
Maps.
– popup_cookie : linked to the pop-up window which appears on the site. It stores your language choice and
expires at the same time as your session on the website.
– icl_current_admin_language_ (5 heures): provides
information about your language choice for our website administration interface.
– icl_current_language (7
heures): provides information about your language choice for our website.

How to configure your browser to refuse cookies?
You can also configure your browser so that
cookies cannot be left on your device. Depending on the browser you use, you can find instructions by following the
links below:

Firefox
Ordinateurs : https://mzl.la/2InlHVK
iOS : http://mzl.la/1mgxeei& http://mzl.la/1MaechM
Android : https://mzl.la/2IDNzsd

Chrome
Ordinateurs : https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=fr&oco=1
iOS : https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DiOS&hl=fr&oco=1
Android
: https://mzl.la/2IDNzsd

Safari
Ordinateurs : https://support.apple.com/kb/PH21411?viewlocale=fr_FR&locale=fr_FR
iOS : https://support.apple.com/fr-fr/HT201265

Edge
Ordinateurs & Windows 10 Mobile : https://privacy.microsoft.com/fr-fr/windows-10-microsoft-edge-and-privacy

Internet explorer
Ordinateurs : https://support.microsoft.com/fr-fr/help/17442/windows-internet-explorer-delete-manage-cookies

6. Who do we share your personal data with?

We may share your personal data with certain third parties. They are:

subcontractors acting on our instructions to provide the following services on our behalf:
hosting and maintenance of Baron Philippe de Rothschild websites;
sponsorship campaigns on our social media;
our employees, where their duties give them cause to access your personal data;
lawyers and other legal officers in the event of a dispute or litigation.

Mergers, demergers or disposals involving our assets may imply the transfer to a third party of files containing
personal data and their prior examination, for example in the context of due diligence. In the event of a
transaction of this kind, we will give guarantees and take appropriate security measures to ensure that data
confidentiality is preserved. If a transfer or disposal of our assets containing your data is completed, we will
take steps to provide you with information that will ensure you are able to exercise your rights with regard to your
personal data.

7. Your rights

You have the following rights:
– the right to access your personal data free of charge and to ask for their
rectification, deletion or portability;
– the right to withdraw your consent, for the future, to all or some of
the processing concerned;
– the right to oppose the processing of your personal data, including for commercial
canvassing purposes by post or by telephone;
– the right to request limitation of the processing of your
personal data.

You can exercise all these rights at any time by sending an email to mesdonnees@bphr.com or a
letter to the following address:

Personal Data Protection Committee
Baron Philippe de Rothschild
10 rue de Grassi
33250 PAUILLAC

You also have the right to lodge a complaint with the CNIL (French data protection authority).

8. Change of the policy

We may have cause to change this Policy.
If that is the case, we will ensure that you are informed of such
changes by means of a special insert posted on Baron Philippe de Rothschild websites.

We invite you to
consult this Policy regularly.