Download a copy of this full privacy policy

Table of Contents

1. Personal Data We Collect
2. How We Collect Personal Data
3. How We Use Personal Data
4. How We Disclose Personal Data
5. Your Privacy Choices & Legal Rights
6. Links to Other Websites
7. Children’s Privacy
8. How Long do we Retain your Personal Data
9. How We Protect Your Personal Data
10.   Cross-Border Transfers
11.   Additional Information for non-US Residents
12.   Additional Information for Residents of Brazil, Canada, Mexico or India
13.   Additional Information for US Residents
14.   How to Contact Us
15.   Updates to this Privacy Policy

2. How We Collect Personal Data

Depending on how you interact with us, we collect your Personal Data in the following ways:

• Directly from You. 
  • When you visit and use the Website or Services or otherwise interact with us
    
  • When you purchase our products;
  • When you register for and participate in one of our promotions;
  • When you submit a recipe review;
  • When you use the Website’s “Submit an Idea” function or similar features;
  • When you download a corporate report from the Website;
  • When you sign up to receive communications from us, including newsletters or financial reports;
  • When you contact us directly (via phone, email, etc.);
  • When you interact with our social media pages; or
  • When you interact with us in-person (e.g., visit one of our physical locations, engage with us at an in-person event, etc.).

• Through Automated Means. 

When you access and engage with the Website or interact with our online media and content (including advertisements), we automatically collect information about your browser, device, and activity.   We (and our partners) may use various tracking technologies (e.g., cookies, pixel tags (or web beacons), session replay tools, etc.) to collect information automatically. The information collected may include details about your behavior on the Website, including how you move and scroll through the Website, your keystrokes, the links you choose to click, and how you interact with forms. The information we collect automatically may include Personal Data, or we may link and/or combine it with other Personal Data we have about you. These technologies may also be used to collect information about you over time and across different websites, mobile applications, and devices. 

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our Website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. With your consent, Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. You can disable the use of Microsoft Clarity during your visit to the Website at any time from the Cookie Preferences link and Privacy Preference Center. Additionally, we use this information for site optimization, fraud/security purposes, and advertising.

We do not use Microsoft Clarity to capture, view, or record any Personal Data or Sensitive Personal Information about you or from you during your visit to the Website.

Microsoft Clarity and Microsoft Advertising act as independent controllers regarding the collection and processing of the data collected. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

To learn more about our use of cookies and other similar technologies and how you can control them, please review our Cookie & Ads Policy.  

• From Third Parties. We may receive your Personal Data from other sources, as permitted by law, including the following categories of parties:
  • Our service providers.
  • Our business partners, including companies that co-sponsor our promotions.
  • Our analytics and advertising partners and providers, including online advertising networks and analytics providers.
  • Social media platforms (note that the Personal Data we receive from the platforms is dependent upon their policies and your settings on each platform).
  • Third-party sites, including those that allow you to integrate your third-party account with your account with us.
  • Other companies that provide Personal Data to supplement what we already know about you, including data aggregators.

3. How We Use Personal Data

We generally use the Personal Data we collect for purposes associated with the growth, maintenance, and management of our business. Depending on how you interact with us, we may use your Personal Data in the following ways:

• To Provide and Manage the Services. We use your Personal Data to provide, administer, and manage the Website, including to maintain and service individual users' accounts (where applicable). We also use Personal Data as otherwise necessary to provide the Services and operate our business.
• To Process and Fulfill Your Order(s). Where applicable, we use your Personal Data to process and fulfill your orders and requests for our products or services. We may also use your Personal Data to process your returns or inform you of any product recall.
• To Communicate with You. We use your Personal Data to communicate with you about your account, your order(s), and/or our relationship; to respond to your submissions, requests, and inquiries; and to request information or feedback from you. Additionally, from time to time, we may use your Personal Data to send you important updates and communications about this Privacy Policy, the Website’s Terms & Conditions, and/or other applicable terms.
• To Send You Marketing and Promotional Communications. Where you have subscribed, we use your Personal Data to send you communications about new products, promotions, surveys, and special offers through email, postal mail, SMS or other communication channels. These communications and materials may include third-party offers or products we think you might find interesting. Details on how to exercise your choices with respect to these communications can be found in the “Your Privacy Choices and Legal Rights” section below.
• To Identify Usage Trends and Make Improvements. We use your Personal Data to understand how you use the Website and identify usage trends. We also use your Personal Data to identify issues; test new features or changes in our features; and improve the Website, the Services, and our products.
• To Understand Your Interests and Personalize Your Experience. We use your Personal Data to help us understand which parts of the Website and/or which of our products are of interest to you. We also use your Personal Data to customize or personalize your experience with us.
• To Engage in Interest-Based Advertising. We and our third-party partners’ use Personal Data to serve you relevant advertising on the Website or on other online services across the devices you may use. Details on how to exercise your choices with respect to interest-based advertising can be found in our Cookie & Ads Policy below.
• To Satisfy Our Legal Obligations. We use your Personal Data to comply with applicable law and respond to lawful requests and communications from law enforcement authorities and other government officials.
• To Maintain Security and Prevent Fraud. We use your Personal Data to help monitor and maintain the security and integrity of the Website as well as our systems and networks. Additionally, we use your Personal Data to detect, prevent, investigate, and protect you, our business, and others from fraud; unauthorized transactions; and other  malicious, deceptive, illegal, or unsafe activity.
• To Carry Out Sales and Business Transactions. We may use your Personal Data in connection with the evaluation, negotiation, and/or completion of a business transaction (e.g., a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets), whether as a going concern or as part of any bankruptcy, liquidation, or similar proceeding, in which Personal Data held by us is among the assets transferred or is otherwise relevant to the evaluation, negotiation, or completion of the transaction.
• As Otherwise Permitted, Necessary, or Appropriate. We use your Personal Data as otherwise described in this Privacy Policy or as explained to you at the point of data collection. We will also use your Personal Data at your direction or with your consent. Finally, we will use your Personal Data as we believe necessary or appropriate to protect our rights, privacy, safety, property, and/or those of others.

4. How We Disclose Personal Data

In connection with one or more of the purposes outlined above, we may disclose  Personal Data from each of the categories of data described in the “Personal Data We Collect” section above to the following categories of third parties:

• Our Brands and Affiliates. We disclose your Personal Data within the Hershey Family of Companies (including our brands and affiliated companies) for our business purposes and to otherwise engage in the activities described in this Privacy Policy.
• Our Service Providers. We disclose your Personal Data to third parties who perform services on our behalf. For example, we disclose Personal Data to parties who operate the Website, help us to prevent fraud, run promotions, and send emails or SMS messages on our behalf. We may authorize these parties to collect Personal Data on our behalf and disclose certain data to their subcontractors, but only to the extent necessary for them to perform services on our behalf. Our service providers may be located within or outside of North America and are restricted in their use of the Personal Data they process on our behalf. You can contact us if you want to learn more about how our service providers use your Personal Data.
• Our Business Partners. We disclose your Personal Data to other companies with whom we partner as necessary to provide our products and services and carry out other related activities. For example, we will disclose Personal Data to third parties who co-sponsor a promotion with us. We might also disclose Personal Data to third parties who distribute our products. These partners may send you information about events and products by mail or email.
• Hershey Entertainment and Resorts Company. We may disclose your Personal Data to Hershey Entertainment and Resorts Company as necessary or appropriate. For example, if you contact us with questions about The Hotel Hershey or Hersheypark, we may disclose your Personal Data to The Hotel Hershey or Hersheypark so that they can address your questions. We may also disclose Personal Data to Hershey Entertainment and Resorts Company and its third-party service providers so that Hershey Entertainment and Resorts Company can more effectively deliver digital advertisements to you about its products, services, and events based upon your interests.
• Our Licensees. We will disclose your Personal Data to licensees as appropriate. For example, if we receive a complaint or question from you about Hershey’s licensed products, we will disclose your Personal Data to the relevant licensee so that the licensee can address your question or concern.
• Our Research Partners. We disclose your Personal Data to our research partners, including those that perform surveys or research projects in partnership with us or on our behalf.
• Our Analytics Partners. We disclose your Personal Data to our partners that assist us in performing analytics and help us measure the effectiveness of the Website’s content and our online and offline marketing and advertising efforts. Our analytics partners may include entities who are independent controllers of your Personal Data.
• Our Advertising Partners. We disclose your Personal Data to third parties for advertising purposes, including social media platforms, third-party advertising networks, and other parties that assist us in serving and optimizing our advertisements.
• Competent Governmental and Public Authorities. We will disclose your Personal Data as necessary pursuant to a court order or subpoena or to cooperate with a government agency or investigatory body request.
• Relevant Third Parties in Connection with Business Transactions or Reorganizations. We may take part in or be involved with a corporate business transaction, such as a merger, sale, joint venture, or any other type of acquisition or business combination of all or a portion of our assets. If another entity acquires us or any of our assets, Personal Data that we have collected may be transferred to such entity and its advisors leading up to and/or following the transaction. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, Personal Data that we hold may be considered an asset of ours and may be sold or transferred to third parties.
• Other Parties. We will disclose your Personal Data to other parties at your direction or with your consent. If you are the winner of a sweepstakes or other contest, we may also disclose your Personal Data to anyone who requests a winner’s list. Finally, we will disclose your Personal Data to other parties as we believe necessary or appropriate either to: (i) comply with applicable law; (ii) protect our operations and those of any of our affiliates; (iii) investigate and prevent against fraud; (iv) protect our rights, privacy, safety, or property and/or those of others; or (v) allow us to pursue available remedies or limit damages that we may sustain.

We may disclose your Personal Data for other reasons that we will describe at the time of data collection or prior to disclosing your data.

If you reside in the United States, depending on your state of residence, some of the disclosures described above constitute “sales” or “sharing” of Personal Data under applicable law. Details on how to exercise your legal rights with respect to such disclosures can be found below.

Please note that we may de-identify or aggregate Personal Data so that it will no longer be considered “Personal Data” and disclose such information to other parties for purposes consistent with those described in this Privacy Policy.

5. Your Privacy Choices and Legal Rights

Your Choices

Depending on your jurisdiction, you may have rights over the control of your Personal Data and how we use it. Additional details are below.

• Opt Out of Receiving Our Marketing and Promotional Communications. You can opt out of receiving marketing and promotional communications from us at any time. Note that even if you opt out of receiving marketing and promotional communications from us, you will still receive non-marketing and transactional messages from us (e.g., messages about your account, responses to your inquiries and requests, confirmation and updates about your purchases, etc.). To opt out of receiving marketing and promotional communications from us, follow the unsubscribe link in any marketing or promotional emails that you receive from us or reply "STOP" to any SMS messages.
• Control Cookies and Other Similar Technologies. As described in the “How We Collect Personal Data” section above, we (and our partners) use cookies and other similar technologies to collect certain Personal Data automatically. To learn more about our use of cookies and other similar technologies and how to manage them, please read our Cookie & Ads Policy, available below.

Your Legal Rights

Depending on your country or state of residence, you may have some or all of the following rights:

• Receive information about the Personal Data we have collected about you, and confirmation of whether we process your Personal Data; 
• Receive information about the business purpose and whom we have shared Personal Data with that we have collected and processed about you;   
• Receive information about whether we have sold or shared your Personal Data, and obtain a list of the categories of third parties to whom we have disclosed your Personal Data, or a list of third parties to whom we have disclosed Personal Data generally; 
• Receive a copy of the Personal Data we have collected about you, including in a portable format;  
• Correct inaccurate Personal Data that we maintain about you;  
• Delete the Personal Data that we have collected from you, subject to certain exceptions; 
• Request that we restrict the processing of your Personal Data in certain circumstances; 
• Object to any processing where we rely upon legitimate interests as a lawful basis for processing your Personal Data;  
• Limit the use and disclosure of any Personal Data we have collected from you;  
• Challenge or opt out of any automated decision-making processes we may use to process your Personal Data if it has a material impact on you; and 
• Opt out of the sale of your Personal Data, or processing of your Personal Data for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects;  
• File an appeal or complaint with the relevant regulatory authority in your jurisdiction.  

We will not discriminate against you if you decide to exercise your privacy rights. However, please note that some features and services may not be available to you if you choose to restrict or otherwise opt out of the sharing of Personal Data where the services rely on that information. Please note that certain rights are subject to applicable exceptions by law. 

How to Exercise Your Legal Rights 

You can submit a request to exercise your rights by:  

• Calling us at 1-800-468-1714 
• Completing and submitting the form available here

To opt out of the sale or sharing of your personal data, use this form

All requests must be verified. To protect your privacy, we may require the matching of up to three pieces of Personal Data provided with your request with information we maintain to verify that it is you making the request. Where applicable, we will use the requested information for verification purposes only. Please note that we may decline a request where we are unable to verify your identity and confirm the personal data we maintain relates to you.

Exercising your rights does not require you to create an account with us.  

We will confirm receipt of your request to know, correct, or delete your Personal Data within 10 business days and will provide information regarding how we will process your request and any necessary verification procedures.

We will respond to your request to know, correct, or delete your Personal Data within 45 calendar days of receipt. If we are unable to verify your identity to make the request within 45 days, we may deny the request. If necessary, we may take an additional 45 days to respond to your request, for a maximum of 90 calendar days from the day we received the request. We will provide you with notice and an explanation of the reason that an extension is necessary

Alternatively, where available, you can use certain preference signals to exercise your opt-out right automatically with all businesses that you interact with online, including Hershey. If you enable a browser-based opt-out preference signal that complies with applicable U.S. state privacy laws, such as the Global Privacy Control (GPC), upon receipt or detection, we will treat the signal as a valid request to opt out of the sale or sharing of your Personal Data linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers, browser profiles, or devices you will have to enable the signal on each one that you use. 

Authorized Agents  

You may authorize someone to submit a request on your behalf (an “Authorized Agent”). An Authorized Agent will need to demonstrate that you’ve authorized them to act on your behalf, unless you have provided the agent with power of attorney pursuant to applicable probate law. Depending on the evidence provided, we may also contact you to verify your identity with us or request confirmation from you that the agent is authorized to submit the request on your behalf. Authorized Agents can contact us at privacy@hersheys.com.

Appealing Privacy Rights Decisions  

You have the right to appeal a decision we have made in connection with your privacy rights request. To appeal a decision, please submit your appeal using this form or contact privacy@hersheys.com.  If you are unsatisfied with the way that we have handled your appeal, you may have the right to complain to your state’s Attorney General or your country's supervisory authority that regulates privacy.

6. Links to Other Websites

The Website may contain links to third-party websites, plug-ins, applications, or other online services. If you click on a link to a third-party service, you will be taken to a service we do not control and that is not governed by this Privacy Policy. We are not responsible for third parties’ privacy practices. We suggest that you read the privacy policies of every service with which you interact carefully.

7. Children's Privacy

The Website is intended for adults. We do not knowingly collect Personal Data from anyone under the age of 13 through the Website.

This Privacy Policy and the CARU icon shown on the Website confirm that The Hershey Company is a valid licensee and participating member in the CARU Safe Harbor Program (“CARU Safe Harbor”). To protect your privacy, we have voluntarily undertaken this privacy initiative. CARU has reviewed and certified that our websites are General Audience sites and that we meet established online data collection and use practices on all properties where this Privacy Policy is posted. As part of the CARU Safe Harbor, we are subject to audits and frequent monitoring of our websites and other enforcement and accountability mechanisms administered independently by CARU.

If you believe that we have not responded to your inquiry or your inquiry has not been satisfactorily addressed, please contact CARU at:

CARU Safe Harbor
Attn: Director
1676 International Drive #550
McLean, Virginia 22102
infocaru@bbbnp.org

If you are a parent and think that your child has provided Personal Data on the Website, you can request that the Personal Data be changed or deleted by contacting us by calling the following toll-free phone number: 1-800-468-1714, contacting us Online, or writing to us at:

The Hershey Company
Consumer Relations
19 E. Chocolate Ave
Hershey, PA 17033

8. How Long Do We Retain Your Personal Data

We retain your Personal Data as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or allowed under law.

To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data; the potential risk of harm from unauthorized use or disclose of the Personal Data; the purposes for which we use the Personal Data; whether we can achieve the purposes through other means; and the applicable legal requirements.

If we de-identify data, we will maintain and use the data in de-identified form and not attempt to re-identify the data except as required or permitted by law.

9. How We Protect Your Personal Data

We use commercially reasonable security measures, including physical, technical, and administrative safeguards to protect your Personal Data from loss; misuse; and unauthorized access, disclosure, modification, and deletion.

However, the Internet is not 100% secure. As a result, like all businesses, we cannot guarantee the security of the Personal Data you provide to us. We encourage you to use caution when using the Internet. This includes not sharing your passwords. You are responsible for the protection and use of your password(s) to the Website. Do not disclose or share your password to the Website with any other person for any reason.

10. Cross-Border Transfers

As a global organization, we will transfer and/or store Personal Data under our control in the United States and/or other countries where we have facilities or in which we engage service providers. As a result, your Personal Data may be transferred to other countries or regions.

If you live outside of the United States, you understand and agree that we may transfer your Personal Data to the United States. When we transfer your Personal Data outside of your country of residence, we do so in accordance with applicable law and take appropriate steps to ensure your data is protected. However, please note that while outside of the jurisdiction in which you reside, your Personal Data will be subject to applicable laws (including those in the United States), which may not provide the same level of protections for Personal Data as those in your country of residence.

If you are located outside of the United States, please note that we may need to transfer your Personal Data to countries that have not been recognized as providing an adequate level of data protection. We generally use Standard Contractual Clauses (or other government-approved contracts) or other lawful data transfer mechanisms that provide appropriate safeguards for Personal Data that are transferred to countries that have not been recognized as providing an adequate level of protection. To learn more about the cross-border transfer of your Personal Data and the transfer mechanism(s) we use to lawfully carry out such transfers, please contact us online.

11. Additional Information for non-US Residents

In certain countries, The Hershey Company acts as the “Controller” (as defined in applicable data protection law) of your Personal Data, and the following disclosures are provided in accordance with applicable law. 

Our Legal Basis for Processing Your Personal Data

Below are the legal bases that we rely on to process your Personal Data:

• Consent. We may rely on the consent that you provide us at the point of data collection or disclosure to process your Personal Data. You have the right to withdraw the consent you have provided us at any time and may do so by contacting us using the contact information below. Additionally, if you have consented to our use of cookies, you can review and change your preferences and opt out of our use of cookies (other than those that are “strictly necessary”) through the cookie management tool available at the link on the bottom of the webpage.
• Contractual Necessity. We may process your Personal Data where it is either necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. This may include Personal Data used to provide you with our products and related services and related transaction information.
• Compliance with a Legal Obligation. We are subject to various legal requirements in the jurisdictions in which we operate, and we may process your Personal Data if necessary for us to comply with a legal or regulatory obligation to which we are subject. In particular, we may be required to retain your Personal Data for extended periods of time and to provide copies of such data to law enforcement, governmental, or other regulatory authorities and/or third parties.
• Exercise of Our Rights. We may need to process your Personal Data to exercise our legal rights in judicial, administrative, or arbitration procedures. 
• Legitimate Interests. We may rely on one or more of our legitimate interests to process your Personal Data, provided that our interests are not overridden by your interests or fundamental rights and freedoms. For example, we may collect and use your Personal Data in reliance on a legitimate interest in managing our relationship with you; conducting and managing our business; providing you with customer support; conducting market research; developing and enhancing the Website and the Services; detecting and preventing fraud and other harmful activities; and monitoring and maintaining the security of our data, systems, and networks.

How Residents in the EEA, UK, or Switzerland Can Contact Our EU Representative 

If you have questions about this Privacy Policy or our data handling and privacy practices, please contact our EU representative by sending an email to GDPR-hershey@intertrustgroup.com. or writing to:

Hershey Netherlands B.V.
Attn. GDPR Services Team
Basisweg 10,
1043 AP Amsterdam,
The Netherlands

12. Additional Information for Residents of Brazil, Canada, Mexico, or India

If you are located in Brazil, Canada, Mexico, or India, please review the following privacy policies, for additional information.  

• Brazil 
• Canada 
• Mexico
  
• India 

13. Additional Information for US Residents

Pursuant to state privacy laws across the US, the following chart details which categories of Personal Data we have collected from and about US residents in the past twelve (12) months, the source(s) of each category of data, the categories of third parties to whom we have disclosed each category of data for a business purpose, and the categories of third parties to whom we have “sold” or with whom we have “shared” each category of data (as such terms are defined in US state privacy laws) (where applicable). Please note that the first column in the chart lists by category the types of data described in the “Personal Data We Collect” section above.