Thorntons Privacy Notice

We, at Thorntons, are committed to respecting the right to data protection and the right to privacy of our customers and website users (“you”). In line with this commitment, we wish to be transparent about the way we collect and handle your personal data through the activities of this website (the “Website”).

1. Who are we and how to contact us?

   Thorntons Limited is located at 889 Greenford Road, Greenford, England, UB6 0HE (“Thorntons Limited”). Thorntons Limited is a company of the Ferrero Group, whose headquarters are located at Route de Trêves 16, L-2633 Senningerberg, Luxembourg (“Ferrero HQ”). When collecting and processing your personal data in relation to the activities on this Website, Ferrero HQ and Thorntons Limited act together as joint controllers (together, “we” or “Ferrero”).

   If you have any questions on the processing of your personal data, you may contact the Privacy Coordinator of Thorntons Limited here (in English).

2. What personal data do we collect, for what purpose and on what legal basis?
   • Website usage data: depending on your cookie preferences, we will collect internet protocol (IP) address, login details (if applicable), device operating system, location and time zone, and information about how you arrived or how you use the Website. For more information, please refer to our Cookie Policy .
   • Marketing communication data: if you decide to subscribe to our marketing communications (e.g., a newsletter, SMS, and direct mail etc), we will collect information that is necessary for you to be able to opt in and receive such communications. Typically, this will include your email address, name, and mobile number. You may also be invited to provide additional data on a voluntary basis, such as your birth date, preferred language, or favorite products to receive personalised communications. You will always be able to opt out of marketing communications and adjust your preferences after subscribing.
   • Competition activity data: if you decide to participate in a competition activity (e.g., an online contest or lottery), we will collect information that is necessary for you to become a participant. Typically, this will include your email address, name, surname, location, and other required participation data, depending on the terms of the competition activity itself. For example, if you have won a product or other tangible prize, we will collect your postal address, so we can send it to you.
   • Account data: when you purchase a product via this Website, you will be invited to checkout as a guest customer or set up a personal or corporate account. We will only collect the data that is necessary for administrating your account and for fulfilling your order, such as your IP address, user ID, name, email address, order number, payment method, delivery address and billing address. You may also decide to share additional data with us on a voluntary basis, such as saved addresses, bank details and marketing preferences.
   • Profiling: If you decide to opt in to receiving personalised marketing communications by sharing personal information on the Thorntons website, then we may request additional information that is necessary for you to receive such communication such as: name, age, shopping intent etc. You will always be able to adjust your preferences/opt should you wish to do so.

   The specific purposes and corresponding legal basis for the processing of these different categories of personal data are summarised below.

   Type of data	Purpose of the processing	Legal basis
   Website usage data	Proper functioning of the Website and Website security.	Our legitimate interest is to ensure the good functioning and the security of our Website. Obligation to perform the contract between you and us (cf. Terms of Use of this Website).
   	Improving Website performances, setting advanced functionalities, data analytics and advertising.	Your consent (you may adjust your preferences at any time by consulting our Cookie Policy .
   Marketing communication data	Promoting Thorntons products and services through marketing communications.	For existing customers: our legitimate interest is to inform you about our products and services. You will always be able to opt out.
   		For others: your consent (opt in).
   Promotional activity data	Promoting Thorntons products and services through promotional activities.	Necessity to perform the contract between you and us (see our Promotional Terms and Conditions) .
   Account data (only if applicable)	Transaction fulfilment, account administration and general communication.	Necessity to perform the contract between you and us (see our Terms and Conditions).
   	Enhancing user experience and promoting Thorntons products.	Your consent, whenever you agree to provide additional data on a voluntary basis (e.g., feedback or product reviews and product preferences).
   Profiling	Promoting Thorntons products and services through profiling.	Your consent (opt-in).

   
   

   Whenever providing personal data is mandatory (for example, your delivery address to successfully deliver your order/purchase), it will be marked as such at the time of collection of the data. By contrast, when sharing information is optional (for example, consumer feedback or preferences), you can always decide not to share this data or leave the field blank in the relevant form.

3. How long do we keep your personal data?

   Thorntons will keep your personal data as long as necessary for achieving the purposes listed above. In particular:

   • Website usage data: for more information on the retention period of cookies or similar technologies used on this Website, please refer to our Cookie Policy.
   • Marketing communications data: if you have subscribed to a newsletter or similar mailing list, your data will be kept as long as the newsletter remains active or up to 12 months after you decided to unsubscribe.
   • Promotional activity data: if you participated in a promotional activity (e.g., online contest), your data will be kept for a period up to 3 years after the end of that activity to ensure that Thorntons has fulfilled all its obligations.
   • Account data:
     • o For all customers who place an order with us, a record of your order information is kept for a period of 6 years.
     • o Account holders: as a registered user, your account data will be kept as long as you have an active account with us. If you do not use your account for a consecutive period of 5 years, we will notify you about our intention to delete your account. If you do not object within a month of this notification, your account information will be deleted. You may of course create a new account at any time.
     • o Upon expiration of these retention periods, your personal data will be deleted or anonymized, except if it is still necessary for us to keep them to comply with a legal obligation (for example, information on orders and invoices to comply with consumer law or tax law) or to protect or defend our interests (for example in the event of a claim). In these cases, Ferrero will store your personal data until the applicable statutory limitation period has expired and/or the claim has been fully resolved.
4. With whom do we share your personal data?

   To achieve the above-mentioned purposes, Thorntons will share specific personal data (only those relevant and necessary) with the following categories of Recipients:

   • Internal Recipients (within Thorntons and Ferrero):
     • o Our Marketing Services team to better understand the interests and needs of our website’s visitors and customers.
     • o Our Consumer Care team, whenever their intervention is necessary to handle a request or act based on your comments or feedback.
   • External Recipients:
     • o Our website analytics service provider (only when you have consented to cookies or similar technologies and in line with your marketing preferences).
     • o Our marketing agencies when necessary for refining our brand messaging, administrating our marketing communications, and organising promotional events (only when you opted-in).
     • o Our website platform and payment provider - if you purchase a product or service via this Website and our logistics and delivery providers when necessary for shipment and delivery of your orders (only if you ordered products through our webstore).

   You may further inquire about the identity of these Recipients by contacting us here.

5. Do we transfer your personal data to another country?

   As a rule, and unless stated otherwise in our specific communications with you, your personal data will only be processed in the country where you are located and – when allowed by law – in the European Economic Area (EEA), where our headquarters are located. However, some of the above-mentioned Recipients may be located in other countries. When that is the case, Thorntons will only transfer your personal data to these other countries in accordance with the applicable privacy and data protection law. You may request a copy of the applicable transfer tools (if any) by contacting us here.

6. What are your data protection rights?

   You have several rights in relation to the processing of your personal data. In particular:

   • Right to information and access: you have the right to obtain additional information or clarifications on the processing of your personal data, and to obtain a copy of your personal data.
   • Right to rectification: you have the right to obtain the correction of your personal data if it is inaccurate or incomplete. If you notice any error, please contact us via the contact us page and we will swiftly update your data.
   • Right to object to the processing of your personal data: whenever we process your personal data based on our legitimate interests (e.g., improving website security or performances), you may object to this processing on grounds relating to your situation. We will review your request with careful consideration. Whenever your personal data is being processed for marketing purposes, your right to object is absolute. This means that you will always be able to unsubscribe from any marketing communications.
   • Right to data portability: whenever you provided us with a structured set of data, you have the right to receive your personal data in a commonly used and machine-readable format and transmit them to another controller.
   • Right to request the erasure of your personal data (‘right to be forgotten’): in some cases, you have the right to request us to erase your personal data. For example, you can request to close and delete your user account or other (non-mandatory) user profile data.
   • Right to obtain restriction of processing from us: you have the right to obtain the temporary suspension of the processing of your personal data while we assess the validity of another request relating to your personal data (e.g., an objection or an erasure request).
   • Right to withdraw your consent: whenever consent is the legal basis for the processing of your personal data, you have the right to withdraw your consent. For example, if you subscribed to our newsletter, you are free to opt out at any time.

You may exercise these rights at any time by adjusting your user preferences, cookies preferences, subscription options or by contacting us here. If you exercise any of these rights, we will analyze your request and get back to you as soon as possible.

In the event you believe that Thorntons did not handle your request properly or infringed the applicable data protection law, you may file a complaint with the Luxembourg data protection authority (the Commission Nationale pour la Protection des Données), in its capacity as lead supervisory authority, or with your national or local data protection authority.