Hartwall’s privacy statement

The purpose of our processing of your information, if you contact us as a consumer or if you complain about one of our products or an experience with us, is that we can process your inquiry and ensure that you receive a response from us.

Our legal basis for processing your information in the above situations is our legitimate interest in processing your inquiry and ensuring that any complaints, including complaints about our products, are investigated, and handled.

In certain reclamation situations related to personal injuries, we may process your health information to determine Hartwall's legal liability.

We ask not to receive information that falls within the special category of data groups, including health data, information about religious beliefs or trade union membership, unless it is a personal injury case described above. If you nevertheless provide such information to us, we assume that you have given your explicit consent to the processing, and we therefore process this information based on your consent.

What personal data do we process about you?

We may process the following information about you as a consumer or complainant:

• Contact information: e.g. name, nickname, customer number, address, phone number, email address and other similar necessary contact information
• Work-related information: e.g. title, position, place of work
• Demographic information such as age and/or date of birth, guardian and dependent
• The position of the contact person of the represented client company or entity. In the community and the name and contact information of the community when the contact person is dealing with Hartwall as a representative of a company or other community or stakeholder group. In addition to this, we may collect other information that is necessary to manage the relationship with Hartwall or the represented company or other entity.
• Customer relationship and service usage and purchase information, such as information about purchases made in an online store or other service, reservations, discounts and other financial benefits and other activities, and marketing and communication implementation information in various business channels, such as online services and automated services, including the recording of sales service and consumer service calls.
• Other information that you provide to us when you contact us, such as customer wishes, satisfaction information, interests, hobby information or other similar information
• Health information if it is a complaint involving a reported personal injury
• Financial information: bank account information for payment of compensation or refunds
• Special categories of data, e.g. data about your health, religion or trade union membership, if you have provided them in connection with your enquiry with us.

How long do we store your data?

We do not store information longer than is necessary to fulfill the purpose. The period during which we store your information will be determined specifically depending on the case in which the information is included. We delete your information as soon as your case has been processed unless we need to be able to document the correspondence/complaint for a longer period.

In complaint matters, we will keep your information until the complaint period has passed, the requirements for food safety self-monitoring have been met, the feedback has been processed and Hartwall's legal responsibility has been clarified and the processing of the case has ended.

The purpose of processing your data is to be able to manage our ongoing business or cooperation relationship, including contract management, and to ensure effective communication with you.

If you are a direct party to the contract (e.g. if you are a sole proprietor), our legal basis for processing your data is that we can perform a contract with you as a supplier or partner.

In other cases, we process your personal data on the basis of our legitimate interest in order to secure our rights and obligations in the contracts we have made with the company you work for.

If you are the contact person of our business customer or a representative of another of our stakeholders, such as a representative of the press or a social media influencer, we may obtain your contact information for the purposes of sales and marketing communication and customer management from service providers whose business is based on maintaining such databases and selling information.

Hartwall obtains contact information and other personal information about media contacts and influencers from various sources, such as Cision. For Cision, you can obtain more detailed information about how such information is collected and used by consulting Cision's privacy notice at www.cision.com/us/legal/privacy-policy/.

In addition, we process your data to:

• ensure quality and control our supply chain, including to ensure respect for fundamental rights and the fight against crime.
• internal analyses and reporting as well as training of our employees and consultants

Our legal basis for this processing is to pursue our legitimate interest in the above. In this context, we register our correspondence with you for documentation to fulfill the purposes.

What personal data do we process about you?

We may process the following information about you as a supplier, partner or contact person for our stakeholders :

• Contact information: e.g. name, nickname, customer number, address, phone number, email address and other similar necessary contact information
• Information related to the job or position: e.g. title, position, workplace and company name and contact information when the contact person deals with Hartwall as a representative of a company or other company or stakeholder group. In addition to this, other information may be collected that is necessary to manage the relationship between Hartwall or the represented company or other entity.
• Financial information, such as payment terms, bank account information and creditworthiness. We check the credit information of our potential service providers and, in certain cases, their responsible persons before entering into a customer relationship in order to assess the ability of our service provider and its responsible person to meet their commitments as a contractual party.
• IT-related information, such as user ID, log-in details and data and logs about your use of our websites

How long do we store your data?

We store your information for as long as we have a business relationship and for a period after the end of the business relationship to comply with applicable legislation, including bookkeeping legislation in the countries in which we operate. However, the information may be processed and stored longer in anonymized form. 

The purpose of processing your information when you are a customer or potential (consumer or business) customer, including when you shop in our online stores, is that we can fulfill agreements with you, including ensuring the execution, delivery, or cancellation of an order and services related thereto.

If you are a direct party to the contract (e.g. if you are a self-employed person), our legal basis for processing your data is to enter into or perform a contract with you as a customer or po-tential customer in connection with entering into a contract.

In other cases, we process your personal data on the basis of our legitimate interest in order to secure our rights and obligations in the contracts we have made with the company you work for.

In addition, we process your data in connection with the following matters:

• Customer support and general communication
• Quality assurance of our products and services
• Development of products and services
• Credit ratings
• Ensuring the reliability of customers and the financial stability of our own business
• Internal analyzes and reporting and training of our employees and consultants

Our legal basis for this processing is basically that we can pursue our legitimate interest in the above purposes.

The processing may also be necessary for the establishment, prosecution or defence of legal claims.

What personal data do we process about you?

We may process the following information about you as a customer or potential customer:

• Contact information: e.g. name, nickname, customer number, address, phone number, email address and other similar necessary contact information
• Information related to work or position: e.g. title, position, workplace company name and contact information when the contact person deals with Hartwall as a representative of a company or other company or stakeholder group. In addition to this, other information may be collected that is necessary to manage the relationship between Hartwall or the represented company or other entity.
• Financial information and payment information, such as payment terms and method as well as invoicing information, bank account information and creditworthiness. We check the credit information of our potential customers and, in certain cases, their responsible persons before entering into a customer relationship in order to assess the ability of the customer and its responsible person to meet their commitments as a contractual party. The credit information of the customer, responsible person or guarantor can also be checked before granting credit for purchases and before paying advance payments. In connection with the check, we can transfer your information to a credit register (Suomen Asiakastieto Oy or another similar credit register) and receive information about you from the credit register. The purpose of processing this information is to grant credit, assess the customer's or potential customer's ability to meet their commitments as a contractual party, and accept a possible guarantee.
• IT-related information, such as user ID, log-in details and data and logs about your use of our websites
• Customer relationship and service usage and purchase information, such as information about purchases made in an online store or other service, reservations, benefits and other activities, and marketing and communication implementation information in various business channels, such as online services and automated services, including the recording of sales service and consumer service calls.
• Photos or videos of you

How long do we store your data?

We store your information for as long as we have a business relationship and for a period after the end of the cooperation to comply with applicable legislation, including bookkeeping legislation in the countries in which we operate. However, the information may be processed and stored longer in anonymized form. 

Personal data about you will be collected through our websites and apps in one or more of the following cases:

• When you visit and browse our websites and apps
• When you create a user profile
• When you download material from our websites and apps
• When you make use of our other features and services

In addition, we will collect your personal data via our websites and apps when you communicate with us, e.g., submit an inquiry through a contact form, when you sign up for our newsletter, when you participate in our competitions or use other services and features through our websites. These processing operations are de-scribed in separate sections of the privacy policy.

The purpose of processing your data when you are a visitor to our websites or when you use our apps is:

• that we can manage user accounts and profiles
• that we can develop, improve, and administer these platforms, including ensuring the content is relevant and presented in the most effective way on your device
• to ensure that you can participate in/register in connection with interactive features and offers from us
• to analyze traffic on our websites and apps

Our legal basis for processing your data is our legitimate interest in the above purposes.

We are also obliged to ensure that we comply with the legislation on the marketing of our products, according to which only persons of a certain age can legally purchase our products and receive marketing of our products, in particular regarding products containing alcohol. We therefore process information for this purpose, and our legal basis for processing this information is our legal obligations to comply with legislation on the purchase and marketing of our products.

Finally, we may also process information that you have manifestly made public

What personal data do we process about you?

We may process the following information about you as a visitor to one of our website or apps:

• Contact information: e.g. name, address, e-mail address, phone number, customer number
• Photos or videos
• Personal information: e.g. age and place of residence
• Other information that you have published yourself
• Cookies

How long do we store your data?

Information processed in our apps is stored for as long as your profile is active, but we may retain the information for a longer period if required by the laws of the countries in which we operate. For retention periods for cookies, please refer to the section on cookies below.

We and the providers of the relevant social media platform are joint data controllers for the processing of personal data collected in connection with your visit to our profile or page on the individual social media platform.

We have profiles or pages on various social media (platforms). You can customize your privacy settings individually on each platform. We refer to the provider's privacy policies as well as settings for using the platform.

You can also contact us if you have questions about the joint data responsibility and the processing of your information on social media.

What personal data do we process about you?

When you visit or interact with our social media profiles, we, and the provider of the social media platform may collect, process and store the following types of personal data about you:

• Information available on your profile, including your name, gender, marital status, workplace, interests and city
• Whether you "like" or have used other reactions to our profile
• Comments you leave on our posts, including in connection with competitions
• That you have visited our profile

What are the purposes of the processing?

We process your personal data for the following purposes:

• Improving our products and services, including our social media profiles and pages
• Statistics and analysis
• To communicate with you if you comment on a post, leave a review or send us a message
• Marketing in general, including the organization of competitions/campaigns

The social media providers process, among other things, your personal data for the following purposes:

• Improving their ad system
• To provide us with statistics that the social media providers compile on the basis of, among other things, your visit to our profiles and pages
• Advertising and personalization of activities on the Site

Our legal basis for processing your information is our legitimate interest in being able to communicate with and market ourselves to you on our social media profiles, as well as our legitimate interest in improving our products and services.

The social media providers base the processing of your personal data on their legitimate interests, including their interest in improving their advertising system and providing us with statistics that the social media provider, for example, compiles based on your visit to our profile or social media page.

In addition, social media providers have a legitimate interest in providing an innovative, individually adapted, secure and cost-effective service. The social media providers process certain of your personal data in accordance with your consent, which you can withdraw at any time via your privacy settings on the social media.

How can you influence the processing of your data?

We encourage you to delete comments, likes and other interactions you have left on our profile if you no longer want them to appear on our pages. We do not delete such publicly available interactions.

If you communicate with us via the social media messaging function, we will delete the messages when you request it.

Please refer to the privacy policy of the individual social media providers for information on how long they keep your personal data.

Information sharing by social media platform providers

The providers of social media platforms may, among other things, share your personal data with the following categories of recipients:

• Other entities within the group of companies of which the social media provider is part
• Externally with business partners who provide analysis and survey services
• Advertisers
• Other people who visit our profile or social media page (to the extent your information is publicly available)
• Researchers and other academics

You can find more information about with whom the social media providers share your personal data in the privacy policy of the individual providers, including in which cases the social media providers may transfer your personal data to recipients outside the EU/EEA.

If you participate in one of our events, including events sponsored by us, the purpose of processing your in-formation is that we can hold the event and register your and any companions' participation for administration purposes and to maintain security in connection with the event.

Our legal basis for the processing is that we can pursue our legitimate interest in hosting events and meeting your specific wishes and needs in connection with our events.

If we process photos or video of you in connection with one of our events, it is based on your consent, which we obtain if this is required by law. Please note that by law, we may in many cases process images or video where you are included if it is an image or video where you are not in focus, e.g., if you are part of the audience at an event.

If you provide us with allergy information, we will process it and take it into account to carry out the event safely.

We ask not to receive information that falls within the special category of data, cf. Article 9(1) of the General Data Protection Regulation, including health data, information about religious beliefs or trade union membership, except for possible allergy information. If you nevertheless provide such information to us, we assume that you have given your explicit consent to the processing, and we therefore process this information based on your consent.

What personal data do we process about you?

• Contact information: e.g. name, address, e-mail address, phone number, customer number
• Information related to work or position: e.g. title, position, place of work
• Photos or videos
• Other information that you yourself have provided in connection with the event
• Allergy information you provide
• Special categories of data, such as information about your health or religion, religion or trade union membership, provided by you in connection with your participation in the event

How long do we store your data?

As a rule, we store your information for up to 1 year, unless we are obliged to store your information for a longer period in the country where we have held the event, or for as long as necessary for us to handle any matters relating to the event, including to document participants in the event and respond to inquiries from you.

The purpose of processing your information when you are a visitor to one of our locations is to ensure security for both our own and our visitors' sake, as well as to investigate, prevent and document accidents and criminal matters.

In addition, we are obliged to ensure safety around the processes that are part of our food production, for example to comply with applicable legislation on food quality and safety.   

We have installed video surveillance as well as logging of the use of access cards at certain of our locations.

The legal basis for processing your data is our legitimate interest in registering visitors to our locations and maintaining the security level of our locations.

If you provide us with allergy information, we will process it so that your visit can be carried out safety.

We ask not to receive information that falls within the special category of data, including health data, information about religious beliefs or trade union membership, except for possible allergy information. If you nevertheless provide such information to us, we assume that you have given your explicit consent to the processing, and we therefore process this information based on your consent.

What personal data do we process about you?

We may process the following information about you as a visitor to one of our locations:

• Contact information: e.g. name, nickname, customer number, address, phone number, email address and other similar necessary contact information
• Information related to work or position: e.g., title, position/seniority, field of work, access card ID
• Other identifiers: e.g., your license plate if you have used our parking area
• Allergy information you provide
• Special categories of data, such as data concerning your health, religion, or trade union membership, if you have provided these during your visit.

How long do we store your data?

As a rule, we store your information for up to 1 year, unless we are obliged to store your information for a longer period in the country where you have visited one of our locations, or for as long as necessary for us to handle any matters relating to your visit, including to document your visit and respond to inquiries from you.

Video surveillance is stored for up to 30 days, after which it is automatically deleted.

The purpose of processing your data when you receive marketing or participate in a marketing competition is that we can carry out and administer marketing, including sending newsletters and conducting and administering competitions and campaigns.

We also process your information to ensure that we comply with relevant legislation, in the country where the marketing activities are carried out, when you receive marketing of our products or participate in our competitions.

We will only send you product information, newsletters, and other marketing material by e-mail if you have given your prior and explicit consent to this, unless applicable law allows us to contact you without such consent. In this connection, we make sure to fulfill our legal obligations to comply with legislation on the purchase and marketing of our products.

Consumer Marketing Communications

We send digital newsletter to share information about, for example, our products, website content, competitions and campaigns or new products and services.

We ask for your consent to send newsletters. If you have given us a general marketing permission, we can send you news and newsletters that we assume you are interested in based on the services you use.

You can cancel the newsletter through the link at the end of the email at any time. Please note that despite canceling the individual newsletter, you can still receive other marketing communications from Hartwall if you have not canceled the general marketing permission you have given to Hartwall.

You can remove the general marketing permission by contacting our consumer service at consumerservice@hartwall.fi. Revoking your general marketing consent will remove all marketing communications to consumers, including your newsletter subscription.

Marketing communications aimed at representatives of companies and other stakeholders

You can receive marketing communications from Hartwall related to your work or your area of responsibility, for example, if your company is our customer, you have shown your interest in Hartwall's services or products as a company representative, you belong to another stakeholder group, or you have subscribed to the Juomamaailma online store's newsletter.

We act this way based on the customer relationship or Hartwall's legitimate interests. If required by local legislation, we ask for consent to communication. You can always deny marketing communications from Hartwall related to your work or your area of responsibility using the link at the end of the message you receive.

We use the services of third parties to implement newsletters aimed at companies, which is why your data may be transferred to the United States. You can read more about the transfer of data to third countries in the section Sharing and transferring personal data.

If you participate in one of our competitions and win a prize, we may make your and your potential guests' information available on our website or on our social media pages. We may also share your information with third parties if necessary to provide you with your prize. The legal basis for processing in connection with competitions is generally the performance of an agreement with you.

For the above purposes, we may also process information that you have manifestly published, e.g., on one of our social media pages.

What personal data do we process about you?

• Contact information: e.g. name, nickname, customer number, address, phone number, email address, initials and other similar necessary contact information
• Participant information: for example, information about you and your guests in connection with a competition or campaign that you enter or have won

in connection with participation or winning

• Photos or videos of you and your potential guests
• Personal information: age or date of birth, guardian or dependent
• Other information that you yourself have provided in connection with participation in a competition or similar
• Marketing permits and prohibitions
• Interest and profiling information, in addition to the information you provide, your interest can be inferred or derived from other information we collect, such as based on the newsletters you receive (e.g. whether the message has been opened). We can target content and marketing to different customer groups based on e.g. online store purchases, given feedback or answers to surveys. If you are a subscriber to the Hartwall VIP newsletter, we will target you with content, benefits and services based on your interest information to offer you the highest possible quality content and service.

How long do we store your data?

In relation to marketing competitions and similar campaigns, we will retain your data until the relevant campaign has ended and the subsequent actions (e.g. sending the prize) have been completed, and we have no reason to assume that you would be in contact with us in connection with the campaign.

Regarding marketing, we will keep your data until you have canceled the marketing permission or the newsletter.

However, data can be processed and stored longer in an anonymized form.

If you participate in a market survey, questionnaire survey or similar, the purpose is to understand you as a customer or consumer. We process your data to understand, calculate or determine the perception of our products, us as a supplier or the effectiveness of our services, performance, or marketing. This supports that we can, among other things, improve our products, services, information, and marketing aimed at you, and that you can receive recommendations regarding products and services.

Our legal basis for processing is that we can pursue our legitimate interest in ensuring the quality of and im-proving our products and services as well as offering you relevant offers and services.

If required by law, we obtain your prior consent to contact you about market research before processing your data.

What personal data do we process about you?

• Contact information: e.g. name, nickname, customer number, address, phone number, email address and other similar necessary contact information
• Personal information: gender, age or date of birth, guardian or dependent
• Information related to work or position: e.g. title, position, workplace
• Information related to consumption habits and preferences

How long do we store your data?

We will retain your data until the market research or survey has ended and the purpose of the research or survey has been fulfilled. As a starting point, we store your information for up to 6 years.

We only store your information for as long as it is legal and as long as it is necessary to be able to answer any inquiries from you. However, the information may be processed and stored longer in anonymized form.

If you apply for a job, you must create a profile in our recruitment system, where you can also read more about the processing of your information in connection with recruitment in our separate personal data policy for job applicants, which you can find in the recruitment system.

If you are an applicant for a position, the purpose of processing information about you is to assess whether you are a qualified candidate for a vacant position. We also register your information to document your ap-plication after the recruitment process has been completed.

Our legal basis for processing your personal data is your request for our processing of your application and CV prior to possibly entering an employment contract.

If you are hired, we store the information that has been part of the recruitment in your personnel folder.

The data controller for the processing of personal data collected as part of our whistleblower scheme is Royal Unibrew A/S.

The purpose of processing your data in connection with our compliance, anti-crime or similar activities is that we can:

• Check that our transactions and dealings, including with business partners and third parties, comply with applicable law and our ethical guidelines, and ensure that we only have business partners and suppliers who meet these standards
• Ensure compliance with our policies, procedures, guidelines and standards if you use our services or visit physical locations
• Ensure the quality of our products and services
• Contribute to the fight against crime, including fraud, and to establish, defend or assert a legal claim.
• Manage and operate our whistleblower portal. If you have reported a case anonymously, we will not have access to your information.

The processing of your data is necessary for us to pursue our legitimate interests in the above purposes and to ensure documentation of the fulfillment.

In certain cases, we are obliged to process the information to comply with anti-money laundering legislation or other legislation.

Furthermore, we may process your data to establish, defend or assert a legal claim.

What personal data do we process about you?

• Contact information: e.g., name, address, e-mail, telephone number, postcode, customer number, initials, as well as information about you and any companions in connection with an event, competition, survey or similar in which you have participated.
• Work-related information: e.g., title, position/seniority, field of work, admission card ID
• ID information: Personal identifikation number, driver's license information, passport information
• Other ID: e.g., your license plate if you have used our parking area
• Financial information: Bank account information, transaction information, purchase history
• Photos and video, e.g., from an event
• Special categories of data, such as information about your health, religion or trade union membership, that you have provided to us in the course of an interaction with us
• Digital footprints: browser "fingerprint", your devices' "fingerprint", IP address, MAC address, OS, location information, browsing history, user ID/login name, password, online nicknames, social media profiles, voIP names (e.g., skype name), logs, device ID (e.g., IMEI, ICCID, IMSI)
• Other information included in a report made on the whistleblower portal
• Cookies (You can read more about the use of cookies in the section below)

How long do we store your data?

We do not store information longer than is necessary to fulfill the purpose. The period during which we store your information will be determined specifically depending on the case in which the information is included. The period depends, among other things, on the basis on which your data is processed.

We delete the information as soon as the case in which your information is included has been closed, unless your information is included in other cases, or has been collected for other purposes, after which we can store the information longer.

Whistleblowing reports will be deleted within 5 years of receipt of the notification, unless its retention is necessary for the exercise of rights or obligations under law or for the establishment, exercise, or defense of legal claims. Personal data which are clearly irrelevant to the processing of the notification shall be deleted without undue delay.