Nutella®

Privacy Policy

SOREMARTEC S.A., with registered seat at 16, route de Trèves, 2633 Senningerberg, Luxembourg ("Company"), in its position as the data controller, pursuant to art. 13 and art. 14 of the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) concerning the protection of personal data ("Regulation"), wishes to provide you with the following information: 

1. Types of personal data  

The data provided by you at our Consumer Contact Center, including your name and surname, birth date, telephone number, e-mail address, physical address (if required), and data (if required) provided to describe the issue you are reporting to us (potentially including special categories of personal data, such as data related to your health), shall be processed by the Company in accordance with the Regulation and with other applicable domestic laws and regulations, including decisions (if any) of the relevant supervisory authority. 

Any data of third parties may be provided only if you are entitled to do so, such as due to your position of legal guardian regarding the third party, or because you have the express consent of the third party. You will be the sole responsible for such a provision and you acknowledge this.

2. Purposes and legal grounds of the processing  

The Company will process the data provided by you while carrying out its business and for the main purposes of 1) providing an answer to your general questions and/or 2) managing the issues that you are reporting to the Company and/or 3) defending the Company itself. 

Moreover, the data shall be processed in order to comply with the obligations established by the law (including, without limitation, obligations arising from the regulations of health and safety, for handling litigations (if existing), for the purposes of internal group reporting, for internal audit purposes (safety, productivity, quality of the services), for management control purposes, for certification purposes. 

Your data may also be processed for recurring valuations concerning whether the ethical and legal requirements established by the Company in its Code of Ethics have been complied with. 

When you ask generic questions to the Company, we will process your data as strictly necessary to allow us to provide you an answer, as per your request (Art. 6(1)(b) of the Regulation).

Where this is strictly necessary to appropriately address any questions or issues you report to the Company, the Company may also process special categories of personal data (in particular, data related to health, such as details on allergic or other adverse reactions to products, etc.) which you decide to provide to the Company. These special categories of personal data will only be processed by the Company based on your prior and explicit consent.

The processing of data for all the other listed purposes does not require your consent since the Company is authorized to avail itself of the reliefs available under letter c) and f) of article 6.1, of the Regulation. 

3. Nature of collection and processing mthods  

In most cases, with the exception of basic questions put during a telephone call to our Consumer Contact Center operators, the collection of personal data concerning Data Subjects is a requirement: failing this, it becomes impossible to provide a response to any inquiry on your part. 

The data shall be processed by the Company, and by those entrusted by the Company with processing, mainly by means of electronic or manual systems and according to the principles of fairness, integrity and transparency that are required by the Regulation and any other applicable laws on data protection, while preserving the privacy of the concerned persons through the implementation of technical and organizational measures ensuring an adequate security level (including, without limitation, by preventing access from unauthorized persons - unless such access is required by the applicable laws - or by ensuring restoration of access to data after material or technical accidents). 

4. Data storage and retention  

The data shall be stored in compliance with the Regulation and other applicable regulations on the protection of personal data for the time that is necessary to comply with the above mentioned purposes, this being a period of:

  • 12 months in case of inquiries not related with the quality of our products (e.g. availability of a certain product in a certain country) or in relation to reactions linked to publications or news about our Company/Brands;
  • 24 months in case of inquiries related with the quality of our product (e.g. complaints about the freshness of a certain product purchased in certain supermarket);
  • 24 months in case of dissatisfaction regarding one of our services;
  • 10 years in case of incident reporting (e.g. allergy or any other adverse reaction after the consumption of a certain product).

5. Disclosure, dissemination and transfer of data  

Without prejudice to the duty of disclosure in order to fulfil any legal or contractual obligations, the data may be disclosed to tax or legal consultants, to collaborators of the Company, to government or other public entities if required in the framework of tenders, as well as to those persons that are authorized by the laws to receive such data, to Luxemburgish or foreign judicial or other public authorities for the fulfilment of legal obligations, or for the performance of the obligations arising from an agreement, including for the purposes of defending before the Courts. Contact details may also be disclosed on occasional and for single reasons to suppliers of the Company, including - without limitation - if it becomes necessary to collaborate with any of these persons for the performance of services. 

Furthermore, data may also be processed by the personnel entrusted with the contract and service management within the Company. In order to perform certain services implying the need of personal data processing, the Company may also avail of third parties. Data may also be disclosed to other companies belonging to the “Ferrero Group” - meaning the Company and any other company directly or indirectly owned and/or controlled at any time by or under common ownership and/or control with the Company - if necessary for the coordination and control of the Group. These companies shall operate as data processors in compliance with specific and adequate instructions by the Company concerning the processing methods and safety measures as specified in specific agreements. Both the personnel mentioned above and the third party processors have undertaken an obligation of confidentiality or are subject to an appropriate legal obligation of confidentiality.

The full and updated list of the companies acting as data processors is available on request from our privacy department by writing to privacy@ferrero.com. 

Personal data shall not be disseminated. As a general rule, the data shall not be transferred outside the territory of the European Union. However, should the need arise to transfer the data to countries outside the European Economic Area, including countries not offering adequate data protection, the Company undertakes to ensure a level of protection and preservation, also by means of entering into specific agreements, that is adequate to the applicable laws, including by means of entering into standard contractual clauses. 

A copy of the commitments undertaken by third parties by means of any such clause, as well as the list of the countries outside the European Economic Area where personal data has been transferred (if applicable) are available on request from our Privacy Department by writing to privacy@ferrero.com. 

6. Data Subjects’ rights

Data Subjects shall have the rights contemplated in the Regulation (articles from 15-21) in respect of the processing of data contemplated thereto, including the right to: 

  • Obtain confirmation of the existence of personal data concerning him/her and to gain access to them (right of access);
  • Obtain the updating, modification and/or rectification of their personal data (right of rectification);
  • Obtain erasure, or to set limits to processing, of personal data whose processing is unlawful, including that which is no longer necessary in relation to the purposes for which it was collected or otherwise processed (right to be forgotten and right to the restriction of processing);
  • Object to processing (right to object);
  • Withdraw previously given consent, if any, without prejudice to the lawfulness of processing based on that consent;
  • Lodge a complaint with their local EU Data Protection Authority or to the data protection authority of Luxembourg (CNPD at https://cnpd.public.lu/en/support/contact.html), if they believe that the Company has handled their information in an unlawful manner;
  • Receive a copy in electronic form of their data which has been provided to the Company in the framework of an agreement and to have such data transmitted to another controller (right to data portability).

The Company has appointed a Data Protection Officer. To exercise the rights above, and to request any further information regarding how Ferrero processes your data, please send an e-mail to our Privacy Department at the following address: privacy@ferrero.com. 

7. Amendments

This Notice entered into force on September 15th, 2023.

The Company reserves the right to partly or fully amend this Notice, or simply to update its content, e.g., as a result of changes in applicable law. The Company will inform you of such changes as soon as they are introduced, and they will be binding once they are communicated to you.

If you like it, share it on