Privacy policy
How your personal data is used when you take part in The Heat Is On., Belgium's Hottest Bar Contest by ABSOLUT TABASCO™.
Last updated: 18 August 2026
1. Who is responsible
21 AGENCY BV (Ter Stratenweg 25, 2520 Ranst, Belgium, company number BE 0768.847.437) organises this campaign and decides why and how your data is used. It is the data controller.
The Absolut Company International AB and the Pernod Ricard companies that distribute ABSOLUT in Belgium act as controller for the brand-side use of the data — in particular the prize and, if you opted in, marketing communication. For that part of the processing they determine their own purposes, which makes them a separate (joint) controller alongside 21 AGENCY BV.
Next Frontier Innovation BV (Stapelhuisstraat 4 bus 201, 3000 Leuven, Belgium, company number BE 0799.480.631) built the platform and stores and maintains the data on the controllers' behalf. It is a processor: it acts only on documented instructions and never uses your data for its own purposes.
2. What we collect and why
When you vote
| Data | Why | Legal basis |
|---|---|---|
| Your e-mail address | To confirm your entry and to contact you if you win | Performance of the competition contract you enter into when you accept the conditions |
| Your age in whole years You enter a date of birth; we calculate the age and store only that. The date itself is never saved. | To check you are 18 or older, as required for a campaign by an alcohol brand, and whether you meet the 25+ condition to win | Legal obligation and legitimate interest in responsible marketing; contract for the prize condition |
| Your four ratings (creativity, hotness, taste, looks) | To build the public leaderboard | Performance of the competition contract |
| Your tie-breaker answer | To determine the winner — the closest estimate wins | Performance of the competition contract |
| Your answer to “if you were an ABSOLUT TABASCO™ cocktail, what would you be called?” (optional) | Campaign colour: it may be used anonymously in campaign reporting and content | Consent — leaving it blank has no consequence |
| A random device identifier in a first-party cookie | To enforce one vote per bar per day | Legitimate interest in a fair contest |
| A one-way pseudonymised (salted hash) version of your IP address and browser type | To detect automated or coordinated voting. Raw values are never stored and administrators cannot see them | Legitimate interest in preventing fraud |
| Whether you ticked the marketing box | To send you campaign and brand communication | Consent, which you can withdraw at any time |
If you add a photo or claim the story bonus
- Your cocktail photo, which you upload with explicit permission for campaign promotional use. It appears publicly only after review. Basis: consent.
- Your public Instagram handle, used once to check your story and to record its follower count as a reach figure. Basis: consent.
If you are a bartender or a bar
- Your name, e-mail address, telephone number and an encrypted password, plus your bar's name and address and your cocktail submission. Basis: performance of your participation agreement.
3. What we never do
- No advertising trackers, no third-party analytics, no cross-site profiling.
- No selling of personal data, ever.
- No attempt to identify you from anonymous voting signals, and no automated decision with a legal or similarly significant effect. The winner is decided by a published rule (closest tie-breaker answer) and confirmed by a person.
- No use of your personal data to train artificial intelligence. The campaign uses an AI writing assistant, but only for bartenders' cocktail descriptions, never for consumer data.
4. Who else sees your data
- Microsoft Ireland Operations Ltd — hosting, database, file storage and e-mail delivery on Microsoft Azure. All data stays inside the European Union (West Europe, North Europe and Sweden Central regions).
- The brand and its partners — The Absolut Company International AB, Pernod Ricard Belgium and the agencies working on this activation receive the contest data they need to award and deliver the prize, and the marketing contacts of people who opted in.
- Participating bars receive results about their own venue only, never personal data about voters.
We do not transfer personal data outside the European Economic Area. Should that ever become necessary, it will be covered by the European Commission's standard contractual clauses.
5. How long we keep it
| Data | Kept until |
|---|---|
| Voting records, device identifiers, pseudonymised IP and browser hashes, e-mail addresses | Deleted or irreversibly anonymised no later than 90 days after the campaign ends |
| Winner records | Until the prize has been delivered and any statutory accounting period has passed |
| Marketing contacts (opt-in only) | Until you withdraw your consent or unsubscribe |
| Photos you allowed us to use | Kept for the campaign archive; the link to your vote is severed in the clean-up |
| Bartender contact details | Removed in the same post-campaign clean-up; the bar and cocktail stay in the public record of the competition |
| Anonymous statistics (counts, ratings, age bands) | Kept indefinitely — these can no longer be linked to a person |
6. Your rights
Under the GDPR you can ask for access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest. Where we rely on consent — marketing, your photo, your Instagram handle, the cocktail question — you can withdraw it at any time, without affecting what happened before.
- For the campaign: 21 AGENCY BV, Ter Stratenweg 25, 2520 Ranst, Belgium — info@21.agency
- For the brand's use of your data: The Absolut Company International AB, Att. TAC Privacy Board, S-117 97 Stockholm, Sweden — or by e-mail to privacy@absolut.com
We answer within one month. Note that voting data is deliberately pseudonymised: if you did not leave an e-mail address we may be unable to link any record to you, and we will not collect extra data just to try.
You also have the right to lodge a complaint with the Belgian supervisory authority, the Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels, Belgium — contact@apd-gba.be.
7. How your data is protected
- Encrypted in transit (HTTPS only, HSTS) and at rest.
- Identifiers are pseudonymised with a keyed hash before storage, so a leaked database still does not reveal IP addresses or devices.
- Secrets are held in a managed key vault; the application authenticates with a managed identity and no human holds the database password by default.
- Administrator access is role-based, session-limited and written to an audit log.
8. Children
This campaign is not intended for anyone under 18. We ask for a date of birth and block participation below that age. If you believe a minor has taken part, contact us and we will delete the record.
9. Changes
If this policy changes materially during the campaign we will publish the new version here with a new date. See also our cookie policy and the competition rules, which govern the a festival experience with Absolut.