As further described in the “How We Use Personal Data” section below, we generally collect and use the above-listed categories of personal information to provide and manage the Services, to process and fulfill your orders, to support and market our business, and to achieve other legitimate business or commercial purposes.

As noted in the table above, we “sell” or “share” (as these terms are defined in the CCPA) certain categories of personal information, and you may exercise your right to opt out of such disclosures by completing and submitting the form available here. Alternatively, where available, you may choose to enable an online tool that automatically communicates your opt-out preferences, such as the Global Privacy Control (“GPC”). When detected, we will process such signals as a request to opt out.

We retain each category of personal information that we collect for as long as necessary to fulfill the purposes described in this Privacy Policy, including to satisfy legal or reporting requirements.

More information, including a description of your legal rights, can be found in the “Additional Information for Residents of California” section below.

• Residents of Other U.S. States: Depending on your U.S. state residency, under applicable law, you may have certain rights in relation to your Personal Data. Additional information can be found in the “Additional Information for Residents of Other U.S. States” section below.

Download a copy of this full privacy policy

1. Personal Data We Collect

Depending on how you interact with us and/or the Website, we may collect a variety of information, including Personal Data.

When we use the term “Personal Data” in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you, such as your name, physical address, telephone number, email address, Internet Protocol (“IP”) address, or other online identifiers.

The specific categories of Personal Data we may collect include:

• Contact Information, including your name, street address, telephone number(s), and email address.
• Demographic Information, including your birthdate, gender, and age.
• Payment Information, including your credit/debit card information and billing address.
• Shopping History, including information about the items you viewed, added to your cart, purchased, or returned.
• Information You Post, including information that you provide when using the Website’s posting feature(s) and any other information that you choose to make public on the Website. Please note that we cannot control the actions of third parties who may have access to or collect information you choose to make public.
• Information You Submit, including your responses to surveys administered by us or on our behalf; information that we collect when you enter a promotion; photos, videos, and other user-generated content that you choose to provide when you interact with the Website or send us an electronic communication; and other information that you choose to provide during your interaction(s) with us.
• Visual Information, including your likeness as captured in photographs or video recordings if you visit any of our physical locations.
• Social Media Information, including information that you post on our social media pages, your social media profile information, and information posted on your social media page(s).
• Device and Browser Information, including your device type, browser type, operating system name and version, device identifier(s), IP address, and other online identifiers.
• Correspondence and Communications, including recordings of your phone conversations with our customer support service.
• Geolocation Information, including your approximate location derived from your device’s IP address.
• Log and Usage Information, including the date and time you access the Website, the site you came from and/or the site you visit when you leave the Website, the frequency with which you access and use the Website, the pages that you navigate to, links that you click, and other information about your interactions with the Website.
• Inferences, including inferences drawn from the above-listed categories of information to create a profile reflecting your preferences or characteristics.

2. How We Collect Personal Data

Depending on how you interact with us, we collect your Personal Data in the following ways:

• Directly from You. When you visit and use the Website or otherwise interact with us, we collect Personal Data that you share with us. For example, we collect Personal Data directly from you when you:
  • purchase our products;
  • register for and participate in one of our promotions;
  • submit a recipe review;
  • use the Website’s “Submit an Idea” function or similar features;
  • download a corporate report from the Website;
  • sign up to receive communications from us, including newsletters or financial reports;
  • contact us directly (via phone, email, etc.);
  • interact with our social media pages; or
  • interact with us in-person (e.g., visit one of our physical locations, engage with us at an in-person event, etc.).
• Through Automated Means. When you access and engage with the Website or interact with our online media and content (including advertisements), we automatically collect information about your browser, device, and activity.
  We (and our partners) may use various tracking technologies (e.g.,  cookies, pixel tags (or web beacons), etc.) to collect information automatically. The information collected may include details about your behavior on the Website, including how you move and scroll through the Website, your keystrokes, the links you choose to click, and how you interact with forms. These technologies may also be used to collect information about you over time and across different websites, mobile applications, and devices.
  To learn more about our use of cookies and other similar technologies and how you can control them, please review our Cookie & Ads Policy.
  
• From Third Parties. We may receive your Personal Data from other sources, as permitted by law, including the following categories of parties:
  • Our service providers.
  • Our business partners, including companies that co-sponsor our promotions.
  • Our analytics and advertising partners and providers, including online advertising networks and analytics providers.
  • Social media platforms (note that the Personal Data we receive from the platforms is dependent upon their policies and your settings on each platform).
  • Third-party sites, including those that allow you to integrate your third-party account with your account with us.
  • Other companies that provide Personal Data to supplement what we already know about you, including data aggregators.

3. How We Use Personal Data

We generally use the Personal Data we collect for purposes associated with the growth, maintenance, and management of our business. Depending on how you interact with us, we may use your Personal Data in the following ways:

• To Provide and Manage the Services. We use your Personal Data to provide, administer, and manage the Website, including to maintain and service accounts (where applicable). We also use Personal Data as otherwise necessary to provide the Services and operate our business.
• To Process and Fulfill Your Order(s). Where applicable, we use your Personal Data to process and fulfill your orders and requests for our products or services. We may also use your Personal Data to process your returns or inform you of any product recall.
• To Communicate with You. We use your Personal Data to communicate with you about your account, your order(s), and/or our relationship; to respond to your submissions, requests, and inquiries; and to request information or feedback from you. We may also use your Personal Data to invite you to and communicate with you about your participation in any promotions, surveys, or other activities administered by us or on our behalf. Additionally, from time to time, we may use your Personal Data to send you important updates and communications about this Privacy Policy, the Website’s Terms & Conditions, and/or other applicable terms.
• To Send You Marketing and Promotional Communications. We use your Personal Data to send you communications and other materials with  information about new products and special offers through email (if subscribed), postal mail, or other communication channels. These communications and materials may include third-party offers or products we think you might find interesting. Details on how to exercise your choices with respect to marketing and promotional communications from us can be found in the “Your Choices and Legal Rights” section below.
• To Identify Usage Trends and Make Improvements. We use your Personal Data to understand how you use the Website and identify usage trends. We also use your Personal Data to identify issues; test new features or changes in our features; and improve the Website, the Services, and our products.
• To Understand Your Interests and Personalize Your Experience. We use your Personal Data to help us understand which parts of the Website and/or which of our products are of interest to you. We also use your Personal Data to customize or personalize your experience with us.
• To Engage in Interest-Based Advertising. We and our third-party partners’ use Personal Data to serve you relevant advertising on the Website or on other online services across the devices you may use. Details on how to exercise your choices with respect to interest-based advertising can be found in our Cookie & Ads Policy below.
• To Satisfy Our Legal Obligations. We use your Personal Data to comply with applicable law and respond to lawful requests and communications from law enforcement authorities and other government officials.
• To Maintain Security and Prevent Fraud. We use your Personal Data to help monitor and maintain the security and integrity of the Website as well as our systems and networks. Additionally, we use your Personal Data to detect, prevent, investigate, and protect you, our business, and others from fraud; unauthorized transactions; and other  malicious, deceptive, illegal, or unsafe activity.
• To Carry Out Sales and Business Transactions. We may use your Personal Data in connection with the evaluation, negotiation, and/or completion of a business transaction (e.g., a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets), whether as a going concern or as part of any bankruptcy, liquidation, or similar proceeding, in which Personal Data held by us is among the assets transferred or is otherwise relevant to the evaluation, negotiation, or completion of the transaction.
• As Otherwise Permitted, Necessary, or Appropriate. We use your Personal Data as otherwise described in this Privacy Policy or as explained to you at the point of data collection. We will also use your Personal Data at your direction or with your consent. Finally, we will use your Personal Data as we believe necessary or appropriate to protect our rights, privacy, safety, property, and/or those of others.

4. How We Disclose Personal Data

In connection with one or more of the purposes outlined above, we may disclose  Personal Data from each of the categories of data described in the “Personal Data We Collect” section above to the following categories of third parties:

• Our Brands and Affiliates. We disclose your Personal Data within the Hershey Family of Companies (including our brands and affiliated companies) for our business purposes and to otherwise engage in the activities described in this Privacy Policy.
• Our Service Providers. We disclose your Personal Data to third parties who perform services on our behalf. For example, we disclose Personal Data to parties who operate the Website, run promotions, and send emails on our behalf. We may authorize these parties to collect Personal Data on our behalf and disclose certain data to their subcontractors, but only to the extent necessary for them to perform services on our behalf. Our service providers may be located within or outside of North America and are restricted in their use of the Personal Data they process on our behalf. You can contact us if you want to learn more about how our service providers use your Personal Data.
• Our Business Partners. We disclose your Personal Data to other companies with whom we partner as necessary to provide our products and services and carry out other related activities. For example, we will disclose Personal Data to third parties who co-sponsor a promotion with us. We might also disclose Personal Data to third parties who distribute our products. These partners may send you information about events and products by mail or email.
• Hershey Entertainment and Resorts Company. We will disclose your Personal Data to Hershey Entertainment and Resorts Company as necessary or appropriate. For example, if you contact us with questions about The Hotel Hershey or Hersheypark, we may disclose your Personal Data to The Hotel Hershey or Hersheypark so that they can address your questions. We may also disclose Personal Data to Hershey Entertainment and Resorts Company and its third-party service providers so that Hershey Entertainment and Resorts Company can more effectively deliver digital advertisements to you about its products, services, and events based upon your interests.
• Our Licensees. We will disclose your Personal Data to licensees as appropriate. For example, if we receive a complaint or question from you about Hershey’s licensed products, we will disclose your Personal Data to the relevant licensee so that the licensee can address your question or concern.
• Our Research Partners. We disclose your Personal Data to our research partners, including those that perform surveys or research projects in partnership with us or on our behalf.
• Our Analytics Partners. We disclose your Personal Data to our partners that assist us in performing analytics and help us measure the effectiveness of the Website’s content and our online and offline marketing and advertising efforts.
• Our Advertising Partners. We disclose your Personal Data to third parties for advertising purposes, including social media platforms, third-party advertising networks, and other parties that assist us in serving and optimizing our advertisements.
• Competent Governmental and Public Authorities. We will disclose your Personal Data as necessary pursuant to a court order or subpoena or to cooperate with a government agency or investigatory body request.
• Relevant Third Parties in Connection with Business Transactions or Reorganizations. We may take part in or be involved with a corporate business transaction, such as a merger, sale, joint venture, or any other type of acquisition or business combination of all or a portion of our assets. If another entity acquires us or any of our assets, Personal Data that we have collected may be transferred to such entity and its advisors leading up to and/or following the transaction. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, Personal Data that we hold may be considered an asset of ours and may be sold or transferred to third parties.
• Other Parties. We will disclose your Personal Data with other parties at your direction or with your consent. If you are the winner of a sweepstakes or other contest, we may also disclose your Personal Data to anyone who requests a winner’s list. Finally, we will disclose your Personal Data to other parties as we believe necessary or appropriate either to: (i) comply with applicable law; (ii) protect our operations and those of any of our affiliates; (iii) investigate and prevent against fraud; (iv) protect our rights, privacy, safety, or property and/or those of others; or (v) allow us to pursue available remedies or limit damages that we may sustain.

We may disclose your Personal Data for other reasons that we will describe at the time of data collection or prior to disclosing your data.

If you reside in the United States, depending on your state of residence, some of the disclosures described above constitute “sales” or “sharing” of Personal Data under applicable law. Details on how to exercise your legal rights with respect to such disclosures can be found in the “Additional Information for Residents of California” and “Additional Information for Residents of Other U.S. States” sections below.

Please note that we may de-identify or aggregate Personal Data so that it will no longer be considered “Personal Data” and disclose such information to other parties for purposes consistent with those described in this Privacy Policy.

5. Your Choices and Legal Rights

Your Choices

We provide you with the ability to make certain choices about how we use your Personal Data. Additional details are below.

• Opt Out of Receiving Our Marketing and Promotional Communications. You can opt out of receiving marketing and promotional communications from us at any time. Note that even if you opt out of receiving marketing and promotional communications from us, you will still receive non-marketing and transactional messages from us (e.g., messages about your account, responses to your inquiries and requests, etc.). To opt out of receiving marketing and promotional communications from us, follow the opt-out link in any marketing or promotional emails that you receive from us or call us at 1 (800) 468-1714.
• Control Cookies and Other Similar Technologies. As described in the “How We Collect Personal Data” section above, we (and our partners) use cookies and other similar technologies to collect certain Personal Data automatically. To learn more about our use of cookies and other similar technologies and how to manage them, please read our Cookie & Ads Policy, available below.
• Access and Correct Your Personal Data. You can request access to the Personal Data that we hold about you and to correct any data that is inaccurate or incomplete. You can make such a request by contacting us using the information in the “How to Contact Us” section below. Please note that we may not accommodate a request to change data if we believe the change would violate any law or legal requirement or cause the data to be incorrect.

Your Legal Rights

Depending on your country (or U.S. state) of residence, you may have certain legal rights in relation to your Personal Data. If you would like to submit a request to exercise your privacy rights under applicable laws, please contact us using the contact details in the “How to Contact Us” section below.

Depending on your location, additional information regarding your privacy rights may also be included below.

6. Links to Other Websites

The Website may contain links to third-party websites, plug-ins, applications, or other online services. If you click on a link to a third-party service, you will be taken to a service we do not control and that is not governed by this Privacy Policy. We are not responsible for third parties’ privacy practices. We suggest that you read the privacy policies of every service with which you interact carefully.

7. Children's Privacy

The Website is intended for adults. We do not knowingly collect Personal Data from anyone under the age of 16 through the Website.

This Privacy Policy and the CARU icon shown on the Website confirm that The Hershey Company is a valid licensee and participating member in the CARU Safe Harbor Program (“CARU Safe Harbor”). To protect your privacy, we have voluntarily undertaken this privacy initiative. CARU has reviewed and certified that our websites are General Audience sites and that we meet established online data collection and use practices on all properties where this Privacy Policy is posted. As part of the CARU Safe Harbor, we are subject to audits and frequent monitoring of our websites and other enforcement and accountability mechanisms administered independently by CARU.

If you believe that we have not responded to your inquiry or your inquiry has not been satisfactorily addressed, please contact CARU at:

CARU Safe Harbor
Attn: Director
112 Madison Avenue, 3rd Floor
New York, NY 10016
infocaru@bbbnp.org

If you are a parent and think that your child has provided Personal Data on the Website, you can request that the Personal Data be changed or deleted by contacting us by calling the following toll-free phone number: 1-800-468-1714, contacting us Online, or writing to us at:

The Hershey Company
Consumer Relations
19 E. Chocolate Ave
Hershey, PA 17033

8. How Long Do We Retain Your Personal Data

We retain your Personal Data as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or allowed under law.

To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data; the potential risk of harm from unauthorized use or disclose of the Personal Data; the purposes for which we use the Personal Data; whether we can achieve the purposes through other means; and the applicable legal requirements.

If we de-identify data, we will maintain and use the data in de-identified form and not attempt to re-identify the data except as required or permitted by law.

9. How We Protect Your Personal Data

We use commercially reasonable security measures, including physical, technical, and administrative safeguards to protect your Personal Data from loss; misuse; and unauthorized access, disclosure, modification, and deletion.

However, the Internet is not 100% secure. As a result, like all businesses, we cannot guarantee the security of the Personal Data you provide to us via the Website. We encourage you to use caution when using the Internet. This includes not sharing your passwords.

10. Cross-Border Transfers

As a global organization, we will transfer and/or store Personal Data under our control in the United States and/or other countries where we have facilities or in which we engage service providers. As a result, your Personal Data may be transferred to other countries or regions.

If you live outside of the United States, you understand and agree that we may transfer your Personal Data to the United States. When we transfer your Personal Data outside of your country of residence, we do so in accordance with applicable law and take appropriate steps to ensure your data is protected. However, please note that while outside of the jurisdiction in which you reside, your Personal Data will be subject to applicable laws (including those in the United States), which may not provide the same level of protections for Personal Data as those in your country of residence.

If you are located in the EEA, UK, or Switzerland, please note that we may need to transfer your Personal Data to countries that have not been recognized as providing an adequate level of data protection. We generally use EU Standard Contractual Clauses (or other government-approved contracts) or other lawful data transfer mechanisms that provide appropriate safeguards for Personal Data that is transferred to countries that have not been recognized as providing an adequate level of protection. To learn more about the cross-border transfer of your Personal Data and the transfer mechanism(s) we use to lawfully carry out such transfers, please contact us online.

11. Additional Information for Residents of the EEA, UK, and Switzerland

If you are located in the EEA, UK, or Switzerland, The Hershey Company acts as the “Controller” (as defined in applicable data protection law) of your Personal Data, and the following disclosures are provided in accordance with applicable law.

Our Legal Basis for Processing Your Personal Data

Below are the legal bases that we rely on to process your Personal Data:

• Consent. We may rely on the consent that you provide us at the point of data collection or disclosure to process your Personal Data. You have the right to withdraw the consent you have provided us at any time and may do so by contacting us using the contact information below. Additionally, if you have consented to our use of cookies, you can review and change your preferences and opt out of our use of cookies (other than those that are “strictly necessary”) through the cookie management tool available at the link on the bottom of the webpage.
• Contractual Necessity. We may process your Personal Data where it is either necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. This may include Personal Data used to provide you with our products and related services and related transaction information.
• Compliance with a Legal Obligation. We are subject to various legal requirements in the jurisdictions in which we operate, and we may process your Personal Data if necessary for us to comply with a legal or regulatory obligation to which we are subject. In particular, we may be required to retain your Personal Data for extended periods of time and to provide copies of such data to law enforcement, governmental, or other regulatory authorities and/or third parties.
• Legitimate Interests. We may rely on one or more of our legitimate interests to process your Personal Data, provided that our interests are not overridden by your interests or fundamental rights and freedoms. For example, we may collect and use your Personal Data in reliance on a legitimate interest in managing our relationship with you; conducting and managing our business; providing you with customer support; conducting market research; developing and enhancing the Website and the Services; detecting and preventing fraud and other harmful activities; and monitoring and maintaining the security of our data, systems, and networks.

Your Legal Rights

Under applicable law and subject to relevant exceptions, you have the right to:

• Request confirmation as to whether we are processing your Personal Data, and if so, to request access to your Personal Data and details regarding our processing.
• Request correction of inaccurate or incomplete Personal Data that we hold about you.
• Request deletion of your Personal Data.
• Request that we restrict our processing of your Personal Data in certain circumstances.
• Request that we transmit your Personal Data to a third party (where technically feasible).
• Object to our processing of your Personal Data under certain circumstances, including where we are using your Personal Data for our legitimate interests and for direct marketing purposes.
• Withdraw the consent you have provided us to process your Personal Data (note that this will not affect the lawfulness of any processing carried out before you withdrew your consent).
• Lodge a complaint about the way we process your Personal Data with the Dutch Data Protection Authority or your national data protection regulator.

Where applicable, you also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

How to Exercise Your Legal Rights

You can exercise the above-listed rights by contacting us using the information in the “How to Contact Us” section below. In order to protect your privacy and confirm that you are entitled to exercise the above-listed rights, we may need to request specific information from you to help us confirm your identity. Where applicable, we will use the requested information for verification purposes only.

How to Contact Our EU Representative

If you have questions about this Privacy Policy or our data handling and privacy practices, please contact our EU representative by sending an email to GDPR-services@intertrustgroup.com or writing to:

Hershey Netherlands B.V.
Attn. GDPR Services Team
Prins Bernhardplein 200
1097 JB Amsterdam
The Netherlands

12. Additional Information for Residents of Brazil

If you are located in Brazil, The Hershey Company acts as the “Controller” (as defined in applicable data protection law) of your Personal Data, and the following disclosures are provided in accordance with applicable law.

Our Legal Basis for Processing Your Personal Data

Below are the legal bases that we rely on to process your Personal Data:

• Consent. We may rely on the consent that you provide us at the point of data collection or disclosure to process your Personal Data. You have the right to withdraw the consent you have provided us at any time and may do so by contacting us using the contact information below. Additionally, if you have consented to our use of cookies, you can review and change your preferences and opt out of our use of cookies (other than those that are “strictly necessary”) through the cookie management tool available at the link on the bottom of the webpage.
• Compliance with a Legal or Regulatory Obligation. We are subject to various legal requirements in the jurisdictions in which we operate, and we may process your Personal Data if necessary for us to comply with a legal or regulatory obligation to which we are subject. In particular, we may be required to retain your Personal Data for extended periods of time and to provide copies of such data to law enforcement, governmental, or other regulatory authorities and/or third parties.
• Execution of a Contract or Preliminary Procedures Related to a Contract. We may process your Personal Data where it is either necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. This may include Personal Data used to provide you with our products and related services and related transaction information.
• Exercise of Our Rights. We may need to process your Personal Data in order to exercise our legal rights in judicial, administrative, or arbitration procedures.
• Legitimate Interests. We may rely on one or more of our legitimate interests to process your Personal Data, provided that our interests are not overridden by your interests or fundamental rights and freedoms. For example, we may collect and use your Personal Data in reliance on a legitimate interest in managing our relationship with you; conducting and managing our business; providing you with customer support; conducting market research; developing and enhancing the Website and the Services; detecting and preventing fraud and other harmful activities; and monitoring and maintaining the security of our data, systems, and networks.

Your Legal Rights

Under applicable law and subject to relevant exceptions, you have the right to:

• Request confirmation as to whether we are processing your Personal Data, and if so, to request access to your Personal Data.
• Request correction of incomplete, inaccurate, or outdated Personal Data that we hold about you.
• Request anonymization, blocking, or deletion of your Personal Data.
• Request that we transmit your Personal Data to another service or product provider.
• Request deletion of Personal Data processed with your consent.
• Request information about the public and private entities with which we have shared your Personal Data.
• Refuse to provide your consent, in which case we will inform you of the consequences of your refusal.
• Withdraw the consent you have provided us to process your Personal Data (note that this will not affect the lawfulness of any processing carried out before you withdrew your consent).

Where applicable, you also have the right to request the review of decisions made solely on the basis of automated processing of your Personal Data that affects your interests.

How to Exercise Your Legal Rights

You can exercise the above-listed rights by contacting us using the information in the “How to Contact Us” section below. In order to protect your privacy and confirm that you are entitled to exercise the above-listed rights, we may need to request specific information from you to help us confirm your identity. Where applicable, we will use the requested information for verification purposes only.

13. Additional Information for Residents of California

The California Consumer Privacy Act (CCPA) provides California residents with certain rights with respect to their “personal information” (i.e., information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household). Pursuant to the CCPA, we are providing the following additional details regarding the categories of personal information that we collect, use, and disclose. This section also describes the rights available to you in relation your personal information and how to exercise your rights.

Personal Information Collection and Disclosure

The following chart details which categories of personal information we have collected from and about California residents in the past twelve (12) months, the source(s) of each category of information, the categories of third parties to whom we have disclosed each category of information for a business purpose, and the categories of third parties to whom we have “sold” or with whom we have “shared” each category of information (as such terms are defined in the CCPA) (where applicable). Please note that the first column in the chart lists by category the types of information described in the “Personal Data We Collect” section above, as required by the CCPA.

Purposes for Collecting Personal Information

As described in more detail in the “How We Use Personal Data” section above, we collect personal information to provide and manage the Services, process and fulfill orders, to support and market our business, and to achieve other legitimate business or commercial purposes.

Disclosures of Personal Information

As detailed in the “How We Use Personal Data” section above, we disclose personal information to fulfill the purposes described. We will also disclose certain categories of personal information to competent governmental and public authorities and other third parties as necessary or appropriate, including when we have a legal or contractual obligation to disclose the information.

Sale and Sharing of Personal Information

As detailed in the chart above, we “sell” and “share” (as such terms are defined in the CCPA) certain categories of personal information to and with third parties and have “sold” and “shared” certain categories of Personal Data in the past twelve (12) months. Please refer to the chart above for additional details.

We do not knowingly “sell” or “share” the personal information of individuals under the age of 16.

Use and Disclosure of Sensitive Personal Information

As detailed in the chart above, we collect certain “sensitive personal information” (as defined in the CCPA). However, we do not use or disclose such information for any purpose outside of the limited permissible purposes set forth in the regulations implementing the CCPA. Such purposes include providing the Services and verifying, maintaining the quality of, and improving the Services.

Your Legal Rights

You have the right to request that we:

• Disclose to you the following information covering the twelve (12) months preceding your request:
  • the categories of personal information we have collected about you and the categories of sources from which we collected such information;
  • the specific pieces of personal information we have collected about you;
  • the business or commercial purpose for collecting, selling, or sharing personal information about you;
  • the categories of third parties to whom we disclosed such personal information; and
  • if we sold, shared, or disclosed your personal information for a business purpose, two separate lists disclosing:
    • sales and shares, identifying the personal information categories that each category of recipient received; and
    • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
• Correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of the processing.
• Delete the personal information that we have collected from you, subject to certain exceptions.

We will not discriminate against you if you decide to exercise your rights under the CCPA. Please note that certain rights are subject to applicable exceptions under the CCPA.

How to Exercise Your Legal Rights

You can submit a request to exercise your rights under the CCPA by:

• Calling us at 1-800-468-1714.
• Completing and submitting the form available here.

To protect your privacy, we will require the matching of up to three pieces of personal information provided with your request with information we maintain to verify that it is you making the request. Where applicable, we will use the requested information for verification purposes only. Please note that we may decline a request where we are unable to verify your identity and confirm the personal information we maintain relates to you.

Exercising your rights does not require you to create an account with us.

Authorized Agents

You may authorize someone to submit a request on your behalf (an “authorized agent”). An authorized agent will need to demonstrate that you’ve authorized them to act on your behalf, unless you have provided the agent with power of attorney pursuant to applicable probate law. Depending on the evidence provided, we may also contact you to verify your identity with us or request confirmation from you that the agent is authorized to submit the request on your behalf.

How to Exercise Your Sale and Sharing Opt-Out Right

As detailed in the chart above, we “sell” and “share” certain categories of personal information to and with third parties. If you are 16 years of age or older, in addition to the rights described above, you have the right to direct us to not “sell” or “share” your personal information at any time. To exercise your opt-out right, you may submit a request to us by:

• Completing and submitting the form available here (note that the form is also accessible via the “Do Not Sell or Share My Personal Information” link in the footer of the Website).
• Calling us at 1-800-468-1714.

Upon receipt of your request, we will endeavor to honor it based on the information that we collect and maintain.

Alternatively, where available, you can use certain preference signals to exercise your opt-out right automatically with all businesses that you interact with online, including Hershey. If you enable a browser-based opt-out preference signal that complies with the CCPA, such as the Global Privacy Control (GPC), upon receipt or detection, we will treat the signal as a valid request to opt out of the sale or sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each once that you use.

An authorized agent may also use the methods described above to submit a request to opt out on your behalf if you provide the agent with signed permission to do so. Please note that we may request from the agent documentation demonstrating that they have your authority to act on your behalf.

Notice of Financial Incentive

We may provide discounts or promotions when you agree to receive marketing and promotional communications from us or claim a specific offer when you interact with us and/or the Website (each, an “Offer”). The terms of each Offer will be provided to you when it is made available. You may opt out of marketing and promotional communications from us at any time as described in our messages to you and as described in the “Your Choices and Legal Rights” section above.

We collect and retain personal information to support and fulfill certain Offers, which may include information in the following categories:

• Identifiers (like your name and email address)
• Personal information categories listed in the California Customer Records statute
• Commercial information (like your purchase history)
• Internet or other electronic network activity information
• Geolocation data
• Inferences

The personal information we collect and retain may also be used to make your account or to supplement your account information (where applicable). Additional details regarding our use of personal information can be found in the “How We Use Personal Data” section above.

Because we collect and retain personal information in connection with our administration of certain Offers, they may be considered “financial incentives” or “price or service differences” under California law. The value of the personal information we collect will vary based on the Offer and is calculated based on expenses related to offering the Offer, which may include the costs associated with providing discounts or promotions, IP or marketing-related costs, and other related expenses.

You have the right to opt out of any Offer at any time in accordance with the terms of the Offer or by contacting us using the information in the “How to Contact Us” section below.

“Shine the Light” Notice

In addition to the rights described above, California’s “Shine the Light” law permits California residents that have an established business relationship with us to request certain information regarding our disclosure of certain types of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year.

To make such a request, please click here, follow the onscreen prompts to send us an email, select “Privacy Policy/Ad and Cookie Policy” as the subject of your message, and indicate in your message that you are a California resident making a “Shine the Light” inquiry. This request may be made no more than once per calendar year. We will respond to your request in accordance with applicable law.

14. Additional Information for Residents of Other U.S. States

Depending on your U.S. state residency, under applicable law, you may have certain rights in relation to your Personal Data, including the right to:

• Request details about our handling of your Personal Data and to access, or receive a copy of, your Personal Data in a readily usable format that allows you to transmit the data to another entity.
• Request that we correct inaccuracies in the Personal Data that we hold (taking into account the nature of the data and the purpose(s) for which we are processing it).
• Request that we delete the Personal Data we hold about you (subject to certain exceptions prescribed by law).
• Opt out of: (i) the “sale” of your Personal Data; (ii) the processing of your Personal Data for “targeted advertising” purposes; and (iii) certain forms of “profiling” (as these terms are defined in the applicable law).
• Withdraw the consent that you have given us to process your Personal Data (where applicable).

We will not discriminate against you if you decide to exercise your legal rights.

If you reside in Colorado, Connecticut, Utah, or Virginia and are interested in exercising one or more of the rights outlined above, you can do so by contacting us using the information in the “How to Contact Us” section below.

To protect your privacy, we may require you to provide certain information to verify that it is you making the request. Where applicable, we will use the requested information for verification purposes only. We may decline certain requests if we cannot verify your identity and confirm the Personal Data we maintain relates to you.

Exercising your rights does not require you to create an account with us.

Upon receipt of your request, we will endeavor to honor it based on the information that we collect and maintain.

Additionally, where available, you can use certain preference signals to exercise your opt-out rights automatically with all businesses that you interact with online, including Hershey. If you enable a browser-based opt-out preference signal that complies with applicable law, upon receipt or detection, we will treat the signal as a valid opt-out request linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each once that you use.

Authorized Agents

You may authorize someone to submit a privacy rights request on your behalf (an “authorized agent”) using the submission methods outlined above. An authorized agent will need to demonstrate that you have authorized them to act on your behalf, unless you have provided the agent with power of attorney pursuant to applicable law. Depending on the evidence provided, we may also contact you to verify your identity directly with us or request confirmation from you that the agent is authorized to submit the request on your behalf.

Appealing Privacy Rights Decisions

Depending on your U.S. state residency, you may have the right to appeal a decision we have made in connection with your privacy rights request. To appeal a decision, please contact privacy@hersheys.com If you are unsatisfied with the way that we have handled your appeal, you may have the right to complain to your state’s Attorney General.

15. How to Contact Us

If you have any questions or concerns about this Privacy Policy or our data handling and privacy practices or would like to submit a request relating your Personal Data, please feel free to contact us online, call us at 1-800-468-1714, or write to us at:

Consumer Relations Department
The Hershey Company
19 E. Chocolate Ave.
Hershey, PA 17033

16. We May Updates to this Privacy Policy

From time to time, we may update this Privacy Policy to reflect changes in our practices with respect to the collection, use, and disclosure of Personal Data and/or changes in applicable law.

The “Last Updated” date at the top of this page indicates when this Privacy Policy was last revised. If we make changes, we will revise the date at the top of this page and, in the case of material changes, we will provide you with additional notice (in accordance with applicable law).

Unless otherwise stated, the current version of this Privacy Policy applies to all Personal Data under our control. We encourage you to review this Privacy Policy periodically to remain informed about our data handling and privacy practices.

Hershey Cookie & Ads Policy

Last Updated: May 15, 2023

In this Cookie & Ads Policy, you will find information on the use of cookies and other similar technologies on our websites and how you can control them. This Cookie & Ads Policy also describes our interest-based advertising practices and your choices.

This Cookie & Ads Policy (“Cookie Policy”) explains how The Hershey Company (“Hershey,” “we,” “us,” or “our”) uses cookies and other similar technologies (collectively, “cookies”) on the following Hershey Company Brands websites, which are owned and operated by The Hershey Company:  TheHersheyCompany.com, Hersheyland.com, CadburyUSA.com, Shop.hersheys.com, chocolateworld.com, and any other websites or online services that link to or display this Privacy Policy (collectively, the “Website”).

This Cookie Policy does not apply to the websites of and your interactions with Hershey Entertainment and Resorts Company, including The Hotel Hershey and Hersheypark. It also does not apply to the Hershey Park mobile app.

This Cookie Policy should be read together with our Privacy Policy and our Terms of Use.

1. What are Cookies?

“Cookies” are small text files sent from a website and stored on your device.  Cookies are used for various purposes, including to make site navigation more efficient, help remember your preferences, and improve your browsing experience. They can also enable the delivery of relevant and personalized advertisements.

There are different types of cookies, which are distinguishable on the basis of their origin. “First-party cookies” are cookies that are stored by the website you are visiting, while “third-party cookies” are stored by a domain other than that of the website you are visiting. Cookies can also be distinguished on the basis of their functions and lifespan, as described below.

2. The Types of Cookies We Use and How We Use Them

Some of these cookies are temporary and erased once you close your browser (“session cookies”), while others stay on your browser until you delete them manually or until your browser deletes them based on the duration period set within the cookie (“persistent cookies”).

3. How to Control Cookies

You can customize or change your cookie preferences at any time by accessing our cookie management system, available here.

Additionally, your browser may give you the ability to control cookies or other similar technologies or to reject cookies.

Because the options you select relating to cookies and other similar technologies are browser and device specific, you must exercise your choices on each browser and device you use.

For more information about cookies, including how they work and how to manage them, please visit www.allaboutcookies.org.

4. Our Use of Social Media Features and Widgets

The Website includes social media features, such as the Facebook “like” button, and widgets, such as the “share this” button or other interactive mini-programs. These features may collect your IP address and other data about your visit to the Website and may set a cookie to enable the feature to function properly. We are not responsible for the privacy practices of the third parties that provide these services. We encourage you to read the privacy policy of every service with which you interact.

5. Interest-Based Advertising

We engage in interest-based advertising to deliver online, relevant advertising to you. We also permit third-party online advertising networks, social media companies, and other third-party services to collect data about your use of the Website over time so that they may display advertisements tailored to you both on the Website and on third-party online services and across the devices you may use.

Generally, the data used to deliver interest-based advertising to you is collected through cookies or other similar technologies. These technologies collect data about your browser and device (e.g., IP address, device ID, cookie ID, mobile advertising ID, general location information, and geolocation information (with your consent)) and your activity on the Website. These technologies may also collect similar data on other websites you visit and across the devices you use, and such data may be linked to certain online and offline data. In addition to serving interest-based advertisements, our third-party partners may use data to deliver certain advertising-related services, such as reporting, attribution, analytics, and market research.

6. Your Interest-Based Advertising Choices

Some web browsers, websites/platforms, and mobile devices allow you to exercise certain choices with respect to interest-based advertising, as described below.

• You can limit our use of targeting cookies through our cookie management tool, available here.
• You may be able to opt out of receiving interest-based advertising using the browser opt-out tools and consumer choice mechanisms provided by interest-based advertising self-regulatory groups by following the links below:
  • Network Advertising Alliance (NAI): www.networkadvertising.org/choices
    
  • Digital Advertising Alliance (DAA): https://optout.aboutads.info/?c=2&lang=EN
  • European Interactive Digital Advertising Alliance (EDAA): https://youronlinechoices.eu/
  • Digital Advertising Alliance of Canada (DAAC): https://optout.aboutads.info/?c=3&lang=en
• You may control your advertising preferences or opt out of certain Google advertising products by visiting the Google Ads Preferences Manager, currently available at https://google.com/ads/preferences or by visiting the NAI opt-out tool linked to above.
• You have the ability to control whether you see interest-based advertisements on your mobile device in the following ways:
  • Your device operating system may provide mechanisms that allow you to opt in or opt out of the use of data about your usage of mobile apps to deliver interest-based advertising to your mobile device. For more information, consult your device settings.
  • The DAA offers a tool for opting out of the collection of cross-app data on a mobile device for interest-based advertising. To exercise your choices with respect to participating companies, please download the AppChoices tool here.

Please note that you will need to opt out separately on all of your browsers and devices, as each opt-out will apply only to the specific browser or device from which you opt out. If you delete or reset your cookies or mobile identifiers, change browsers, or use a different device, any opt-out cookie or tool may no longer work and you will have to opt out again. Even if you choose to opt out of receiving interest-based advertising, you may still receive advertising, but the advertisements may be less relevant.

Some of our partners may provide you with additional choices with respect to interest-based advertising. For example, certain social media platforms allow you to control your advertising preferences directly through their services. Please review the privacy policies of the third-party services you use for more information.

Depending on your U.S. state residency, our use and disclosure of Personal Data for interest-based advertising purposes constitutes “sharing” or the processing of Personal Data for “targeted advertising” under applicable law. Details on how to exercise your legal rights with respect to “sharing” or “targeted advertising” can be found in the “Additional Information for Residents of California” and “Additional Information for Residents of other U.S. States” sections of our Privacy Policy.

7. How to Contact Us

If you have any questions about this Cookie & Ads Policy, please contact us online, call us at 1-800-468-1714, or write to us at:

Consumer Relations Department
The Hershey Company
19 East Chocolate Avenue
Hershey, PA 17033

8. How to Contact our EU Representative

Hershey Netherlands B.V.
Attn. GDPR Services Team
Prins Bernhardplein 200
1097 JB Amsterdam
The Netherlands
Email: GDPR-services@intertrustgroup.com