Privacy and Cookie Policy

This Privacy and Cookie Policy explains how Swinkels Nederland B.V., referred to in this policy as the “Entity”, uses personal data in connection with its publicly accessible websites, apps, webshops, social media channels, campaigns, events, newsletters, promotions, products and services. In this policy, the Entity may also be referred to as “we”, “us” or “our”. The policy explains what personal data we collect, how we use those data, on which legal bases we rely, with whom we may share personal data, how long we keep personal data, and what rights you have.

We may process personal data when you purchase or use our products or services, contact us, visit our websites, participate in campaigns or events, create an account, subscribe to newsletters, interact with our social media channels, or otherwise engage with us as a consumer, customer, supplier, business partner, visitor or other contact person.
 

Depending on how you interact with us, we may process personal data to:

• provide our products and services;
• process and deliver orders;
• manage accounts and loyalty programmes;
• handle customer service requests, questions and complaints;
• organise campaigns, events and prize draws;
• send service messages and, where permitted, marketing communications;
• manage our relationships with customers, suppliers and business partners;
• improve our products, services and digital channels;
• protect our business, systems, users and assets;
• prevent fraud and misuse;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal claims;
• support internal administration and reporting within the Entity and, where relevant, Royal Swinkels.

We use personal data only where this is necessary for the relevant purpose and in accordance with applicable privacy, data protection and e-privacy laws. We aim to keep this policy accurate, easy to find and up to date as our use of personal data changes.

We use personal data only where we have a valid legal basis. Depending on the circumstances, the Entity may rely on one or more of the following legal bases for the purposes described in this policy.
 

Consent, where you have given consent that is freely given, specific, informed and unambiguous. For example, we may rely on consent for certain marketing communications, certain cookies and similar technologies, and certain optional promotional activities.
 

Contract, where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract. For example, this may apply when we process your order, arrange delivery, manage your account or respond to a request relating to our products or services.
 

Legal obligation, where processing is necessary to comply with a legal obligation to which the Entity is subject. For example, this may apply to tax, accounting, product safety, fraud prevention, reporting and other compliance obligations.
 

Legitimate interests, where processing is necessary for the legitimate interests of the Entity or a third party and those interests are not overridden by your interests or fundamental rights and freedoms. Where required, we carry out a balancing test. This may include fraud prevention, network and information security, internal administration, customer service, limited direct marketing where permitted by law, business reporting and improving our products, services and digital channels.

4.a Categories of personal data

We use only personal data that are adequate, relevant and limited to what is necessary for the relevant purpose. Depending on the context, this may include the following categories of personal data.
 

• identity data, such as your name, title, date of birth or age information where relevant;
• contact data, such as your address, telephone number and email address;
• account and profile data, such as login details, preferences and loyalty programme information;
• transaction and order data, such as order details, delivery details, payment status and related correspondence;
• communications data, such as messages, requests, complaints, survey responses and customer-service records;
• campaign, event and promotion data, such as registration details, participation details and prize-delivery information;
• technical and usage data, such as IP address, browser type, device type, log data and information about how you use our websites, apps and other digital channels;
• cookie and similar-technology data, including online identifiers and preference data where relevant;
• marketing and preference data, such as your communication preferences and consent choices;
• other personal data you choose to provide to us.

The categories processed depend on the relevant service, relationship or interaction.

4.b When personal data are required

You are generally not required to provide personal data. However, if certain data are needed to provide a product, service or requested communication and you choose not to provide them, we may be unable to do so.
 

For example, we may need contact, order, delivery or payment details to fulfil an order, administer an account, or send a newsletter or other requested communication.
 

4.c Campaigns, events and prize draws

If you participate in a campaign, event or prize draw, we may process the personal data necessary to administer your participation, verify eligibility, communicate with you, arrange access or attendance, and, where applicable, award or deliver a prize.

We do not retain personal data for longer than necessary for the purposes for which they were collected and processed, unless a longer retention period is required or permitted by law. Retention periods depend on the nature of the data, the purpose of processing, the relevant relationship and applicable legal or regulatory obligations.

For example, we may retain transaction, payment and accounting records for statutory retention periods; customer-service records for a limited period after a matter has been resolved unless they are needed for a dispute or compliance purpose; and marketing preference or consent records for as long as they are needed to respect your choices and demonstrate compliance.

The Entity is part of Royal Swinkels NV (Royal Swinkels). In most cases, the Entity itself is responsible for the personal data it collects and uses for those activities. This policy is intended as a worldwide baseline. Where possible, Royal Swinkels applies a level of privacy protection that is at least equivalent to the EU General Data Protection Regulation. If stricter local privacy, data protection or e-privacy laws apply, those stricter requirements will apply. In some cases, Royal Swinkels or another Royal Swinkels entity may also be responsible, for example where group systems, shared services or central processes are used. If more than one Royal Swinkels entity is responsible, they will agree how privacy responsibilities are handled. You can use the contact details in section 7.b if you have questions or wish to exercise your rights.
 

6.a Recipients and service providers

We may share personal data only where this is needed for the purposes described in this policy, where the law requires it, or where the law otherwise allows it. If a service provider processes personal data for us, we put appropriate contractual safeguards in place, including a data processing agreement where required.

• providers of website, app, hosting, cloud and infrastructure services;
• providers of e-commerce, payment, logistics and delivery services;
• providers of customer-service, CRM, email marketing and other communication tools;
• providers of analytics, measurement, market-research and survey services;
• advertising, media and campaign partners where relevant;
• professional advisers such as lawyers, auditors, insurers and other consultants;
• debt collection, fraud-prevention and security providers where relevant;
• competent authorities, regulators, courts and law-enforcement bodies where required or permitted by law.

We may also share personal data if this is necessary to comply with the law, respond to lawful requests, protect our rights, investigate incidents or defend legal claims.
 

6.b Sharing within Royal Swinkels, international transfers and security

Royal Swinkels is headquartered in the Netherlands and operates internationally. We may share personal data within Royal Swinkels where this is needed for normal business purposes, such as IT support, cybersecurity, finance, reporting, legal, compliance, procurement, customer relationship management, marketing operations and internal administration. We do this only where there is a valid legal basis and a genuine business need.
 

Personal data may be shared with recipients in other countries or regions. Where applicable law requires safeguards for such transfers, we use an appropriate transfer mechanism. This may include adequacy decisions, standard contractual clauses, binding corporate rules, intra-group arrangements, approved certification frameworks, contractual safeguards or another mechanism allowed by applicable law. Where required, we also assess whether additional contractual, technical or organisational measures are needed.
 

Where allowed by law, we may combine personal data collected through different channels, for example to keep records accurate, improve our services, protect our systems, prevent misuse and communicate with you more effectively. If this involves cookies, online identifiers or similar technologies, we follow the rules that apply to those technologies and ask for consent where required.
 

We take appropriate security measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. These measures may include access controls, encryption, logging, network and endpoint security, staff training, incident response procedures and checks on service providers.
 

6.c Children and age-restricted products

Some of our products, services, websites and campaigns may only be intended for people who meet the applicable legal age requirements. Where relevant, we may use age checks or age gates. We do not knowingly collect personal data from children where this is not allowed by law, and we do not intentionally direct age-restricted marketing to people who do not meet the applicable age requirements.

If you have questions about this policy or wish to exercise your rights, you may contact us using the details below. Specific websites, apps, campaigns, products or services may provide additional local information where required by local law. Where we obtain personal data from sources other than you, for example from business partners, social media platforms, publicly available sources, event organisers, distributors, retailers, service providers or other Royal Swinkels entities, we will provide any additional information required by applicable law within the required timeframe. We will handle requests in accordance with applicable law. To protect personal data, we may ask for information to confirm your identity. You may also have the right to complain to the relevant privacy or data protection authority in your country or region.
 

7.a Your rights

Depending on where you are and which law applies, you may have one or more of the following rights:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete personal data;
• ask us to delete personal data where the law allows this;
• ask us to restrict or stop certain uses of your personal data;
• object to certain uses of your personal data, including direct marketing where applicable;
• withdraw consent where we rely on consent;
• request data portability where this right applies; and
• lodge a complaint with a relevant privacy or data protection authority where this right is available.

7.b Contact details

Privacy contact details

Depending on the relevant use of personal data, the Entity, Royal Swinkels and/or another Royal Swinkels entity may be responsible, as described in section 6. You may contact us through the central Royal Swinkels privacy contact point below. Where the Entity or another Royal Swinkels entity provides local contact details on the relevant website, app or service, you may also use those details.
 

Royal Swinkels privacy contact point
Royal Swinkels Privacy Team
PO Box 1
5737 RV Lieshout, Netherlands
Email: privacy@swinkels.com
 

Supervisory authority

Where applicable law gives you this right, you may lodge a complaint with the relevant privacy or data protection authority in your country or region. For personal data use that falls within the EU GDPR one-stop-shop mechanism, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) may act as lead supervisory authority.

When submitting a request, please provide sufficient information to enable us to understand and, where necessary, verify your request. We may ask for additional information where reasonably necessary to confirm your identity.
 

We may amend this policy from time to time to reflect changes in legislation, regulatory guidance, our processing activities, our systems or our organisational structure. The latest version will be made available through the relevant website, app or other channel of Royal Swinkels. Where required, we will also take appropriate steps to bring material changes to your attention.

We use cookies and similar technologies on our websites, apps and other digital channels. Some cookies are strictly necessary for the functioning and security of the relevant service. Other cookies or similar technologies may be used for analytics, personalisation, embedded content, social media features or advertising, subject to applicable legal requirements.
 

Where required by law, we ask for your consent before placing or reading non-essential cookies or similar technologies. Non-essential cookies or similar technologies will not be used before consent has been obtained where consent is required. Where the storage of or access to information on your device requires consent under applicable e-privacy or similar rules, that requirement applies even if a separate legal basis may be relevant for later personal-data processing. You can manage your preferences at any time through the cookie banner, consent management platform or, where relevant, your browser settings.
 

Where consent is required, consent choices must be presented clearly, in plain language and without misleading design, dark patterns or pre-ticked selections. Rejecting non-essential cookies or similar technologies must be as easy as accepting them where required by law or regulatory guidance, and withdrawing consent must be as easy as giving consent. Choices should be offered with appropriate granularity so that users can make a meaningful choice between relevant categories of non-essential technologies.

The exact cookies and similar technologies used may differ by website, app or country. The relevant cookie banner, consent management platform or cookie overview will identify the categories used, their purposes, retention periods and, where relevant, the third parties involved.
 

Strictly necessary cookies

These cookies are necessary for the website, app or service to work properly and securely. They may be used, for example, to remember privacy preferences, enable login, complete forms or support basic functionality. You can block them in your browser, but some parts of the service may not work properly.
 

Analytics cookies

These cookies help us understand how our digital channels are used and how we can improve them. In some countries, limited analytics may be used without consent if the legal conditions are met and the impact on privacy is low. Otherwise, we ask for consent where required.
 

Functional cookies

These cookies enable enhanced functionality and personalisation, such as embedded videos, live chat or preference settings. If you do not allow these cookies, some features may not function properly.
 

Targeting cookies

These cookies may be set by advertising partners to build a profile of your interests and show relevant advertising on other sites. They work by uniquely identifying your browser and device.

We may use analytics tools to measure and improve the performance of our websites and digital services. Where required by law, we will obtain consent before using analytics cookies or similar technologies that are not exempt from consent requirements.
 

Where analytics or other digital service providers receive personal data, the sharing and transfer safeguards described in section 6.b apply where required by applicable law.

Our digital channels may include content or features provided by third parties, such as embedded videos, maps, social media buttons, chat functions, measurement tools or advertising technologies. These third parties may place cookies or collect information through similar technologies. Where required, such technologies will be activated only after consent has been obtained. Where these providers receive personal data, the sharing and transfer safeguards described in section 6.b apply where required by applicable law.
 

These providers may also use personal data for their own purposes under their own privacy and cookie notices. We recommend reviewing those notices where relevant.

You can usually control cookies and similar technologies through your browser settings and, where available, through the cookie banner or consent management platform on the relevant website or app. Blocking certain cookies may affect the availability or functionality of parts of the service.

Age verification (1 cookie)

Use:

• remembering that the visitor has completed the age check,
• preventing the age question from being displayed again on every visit.

OneTrust (2 cookies)

Use:

• recording the visitor’s cookie preferences,
• remembering whether the cookie banner has already been shown or closed,
• managing consent for analytics, functional and marketing cookies.

Playable (6 cookies)

Use:

• running interactive promotions and campaigns,
• remembering participation and form data,
• optimising the user experience within campaigns,
• technical operation and security of campaign pages.

Google Analytics 4 (4 cookies)

Use:

• measuring website usage,
• analysing visitor behaviour,
• improving website performance and user experience.

Hotjar (2 cookies)

Use:

• analysing user behaviour on the website,
• improving usability and navigation,
• distinguishing between new and returning visitors.

Google / YouTube (12 cookies)

Use:

• embedded videos and YouTube functionality,
• measuring interactions with video content,
• security, fraud prevention and user preferences within Google services.

Google Ads (1 cookie)

Use:

• conversion measurement,
• measuring the effectiveness of advertising campaigns,
• optimising online marketing activities.

Meta Platforms, Inc. (1 cookie)

Use:

• measuring conversions,
• building advertising audiences (Meta Pixel),
• remarketing.