This Privacy Policy has been adopted by Cloetta AB (publ) and its group companies (“Cloetta” or “we”) and applies when you communicate with us, participate in our campaigns, or visit our websites and digital channels.

Cloetta is committed to protecting and respecting your privacy. This policy describes how we continuously apply this commitment when collecting and using personal data, what rights you have in relation to us, and how you can exercise those rights. You are therefore encouraged to read this policy carefully. Please contact us using the information in the section “Contact Information” below if you have any questions.

What is personal data?

Personal data is any information that can directly or indirectly (i.e. together with other information) identify you. This means that many different types of information, such as names, contact details, IP addresses, behaviours, and choices made online, constitute personal data.

All actions performed in relation to personal data constitute processing, such as collection, recording, organisation, storage, adaptation or alteration, blocking, erasure, or destruction of personal data, whether or not this is done by automated means.

How do we process your personal data?

Visitors to our websites and digital channels

When you visit our websites and digital channels, we may process:

• information you have voluntarily provided, such as name, date of birth, and contact details;
• information about your visits to our websites and digital channels, which may include search terms you use, likes, and shares;
• information relating to campaign traffic;
• sales made via the website;
• personal information that does not identify you (“Aggregated Data”), which may include gender, region, household, and age;
• technical data, which may include URL information, cookie data, your IP address, and the types of devices you use to visit Cloetta’s websites.

We process this data for the following purposes:

• to monitor and improve our products and services, where applicable, for example to optimise the website and our digital channels, make them more user‑friendly, and for follow‑up and statistical purposes;
• to measure the outcome of advertising and digital campaigns;
• to target and reach audiences online;
• to communicate with you, for example via our digital channels, monitoring social media posts, brand perception, and newsletters;
• to analyse information for individual profiling in order to offer personalised advertisements, offers, and other customised information; and
• for purposes related to our use of cookies; please see Cookie Policy.

Customers purchasing our products online

When you are a customer and purchase our products online, we may process:

• information you have voluntarily provided, such as name, gender, home and/or delivery address, telephone number, email address, date of birth, demographic information, interests, preferences;
• payment information;
• historical order information; and
• the product(s) you purchased.

We process this data for the following purposes:

• to manage our customer relationship, for example to identify you as a customer; and
• to fulfil contractual obligations, such as providing products.

Newsletter subscribers or participants in marketing competitions and campaigns

In accordance with the consent you have given by agreeing to our terms, we may process:

• name, gender, telephone number, address, and email address;
• date of birth;
• receipts for campaign purchases; and
• depending on the prize (value in SEK), we may also collect your personal identity number.

We process this data for the following purposes:

• direct marketing purposes, including providing you with newsletters, offers, and campaigns relating to products and services via email, if you have requested such information (you may opt out at any time by clicking the link in each email);
• to administer competitions and campaigns; and
• to comply with legal obligations, for example, where applicable, reporting competitions and campaigns to tax authorities.

When you communicate with us

When you communicate with us, we may process:

• information you have voluntarily provided, such as name, home and/or delivery address, telephone number, email address, date of birth, demographic information, interests, preferences, payment information, and case‑related information.

We process this data for the following purposes:

• to fulfil a request from you or respond to your enquiries, for example handling customer complaints.

Legal basis for our processing

Cloetta processes personal data in accordance with applicable data protection legislation. Within the EU/EEA, the General Data Protection Regulation (GDPR) applies as of 25 May 2018 (Regulation (EU) 2016/679) and within the UK, the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018.

We process your personal data when it is necessary in order to: (i) fulfil a request from you or respond to your enquiries; or
(ii) comply with a legal obligation.

Your data may also be processed where necessary on the basis of a legitimate interest of Cloetta, including marketing and improving our services. Where a specific processing activity requires your consent, such consent will be collected before the processing is carried out.

Personal data that we request from you and mark as mandatory must be provided in order for us to deliver the service and/or goods, for example for statutory, contractual, administrative, or technical reasons.

How long do we retain your data?

We retain your information only for as long as necessary: (i) to provide you with a product or service;
(ii) to improve our services; and
(iii) for legal and audit purposes.

We have procedures in place to ensure that personal data is subsequently deleted.

How do we share your information?

Cloetta may engage third parties to provide services to Cloetta, such as IT systems, services, and other activities. Your data may be shared with and processed by such service providers on behalf of Cloetta to the extent necessary for the provision of services.

Where personal data relating to UK individuals is transferred outside the UK, such transfers are carried out in accordance with Chapter V of the UK GDPR, using appropriate safeguards such as: UK adequacy regulations, the UK International Data Transfer Agreement (IDTA); and/or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

Personal data may also be disclosed to third parties where we are required to do so by applicable laws and regulations, or to detect and prevent fraud or other security or technical issues.

Companies processing personal data on behalf of Cloetta are required to enter into agreements with Cloetta to ensure a high level of protection for your personal data.

Our use of cookies

A cookie is a small text file placed on your computer, mobile phone, or other device when you visit a website. For further information on how information may be used and shared by Cloetta, please refer to the cookie policy of this website.

Your rights under applicable data protection legislation

Under applicable data protection legislation, you have certain rights. If you wish to exercise any of these rights, please contact us using the details set out in the section “Contact Information”.

In accordance with applicable data protection legislation, you have the right to:

• request access to and rectification of personal data we process about you;
• request erasure of your personal data;
• request restriction of the processing of your personal data;
• object to the processing of your personal data and, where processing is based on consent, withdraw your consent at any time; and
• receive personal data about you that you have provided to us.

You also have the right to lodge a complaint with the competent supervisory authority if you believe that your personal data is processed in breach of applicable data protection legislation. In the UK, this is the Information Commissioner’s Office (ICO).

Contact information

The legal entity identified as the responsible legal entity for the relevant digital channel is the controller of personal data processed in connection with that digital channel.

Where applicable, other legal entities within the Cloetta group may also be controllers of personal data in accordance with the terms applicable to the relevant service or function.

If you have any questions regarding the processing of your personal data or wish to exercise your rights under applicable data protection legislation, you may contact us using the following details:

Cloetta UK Ltd
Email: privacy@cloetta.com
Address: Fort Southwick, James Callaghan Drive, Fareham, Hampshire, PO17 6AR

Updates to this policy

This Privacy Policy was last updated in June 2026. We update the policy from time to time, for example by making new versions available on our website or otherwise providing the update in an appropriate manner. You are encouraged to visit our website periodically to learn about any updates.