NESTLÉ PRIVACY POLICY
Effective from: August 1, 2026
SCOPE OF THIS PRIVACY POLICY
Please read this Privacy Policy (“Policy”) carefully to understand our policies and practices regarding your Personal Data and how Nestlé will treat it. This Policy applies to individuals who interact with Nestlé’s services as a User. This Policy explains how Nestlé Portugal, Unipessoal, Lda. (“Nestlé”) collects, uses and discloses the User’s Personal Data. It also lets the User know how they can access and update their Personal Data and make certain choices about how their Personal Data is processed.
This Policy covers online and offline data-collection activities, including Personal Data that Nestlé collects through various channels, such as websites, applications, third-party networks, the Consumer Service Center, points of sale, and events. The User should be aware that Nestlé may aggregate personal data from different sources (e.g., websites, offline events). As part of this process, Nestlé combines Personal Data that was originally collected by different Nestlé entities or their partners. See Section 9 for more information on how to object to this practice.
If the User does not provide the necessary Personal Data (we will indicate when this is the case, for example by making this clear on registration forms), Nestlé may not be able to provide the goods and/or services. This Policy may be amended periodically (see Section 11).
This Policy provides relevant information on the following matters:
1. SOURCES OF PERSONAL DATA
2. PERSONAL DATA THAT NESTLÉ COLLECTS ABOUT THE USER AND HOW IT DOES SO
3. CHILDREN’S PERSONAL DATA
4. COOKIES/SIMILAR TECHNOLOGIES, LOG FILES AND WEB BEACONS
5. PURPOSES OF PROCESSING THE USER’S PERSONAL DATA
6. DISCLOSURE OF THE USER’S PERSONAL DATA
7. RETENTION OF THE USER’S PERSONAL DATA
8. DISCLOSURE, STORAGE AND/OR TRANSFER OF THE USER’S PERSONAL DATA
9. USERS’ RIGHTS REGARDING THEIR PERSONAL DATA
10. CHOICES REGARDING THE USE AND DISCLOSURE OF THE USER’S PERSONAL DATA
11. CHANGES TO THE PRIVACY POLICY
12. DATA CONTROLLERS & CONTACT
1. SOURCES OF PERSONAL DATA
This Policy applies to the Personal Data we collect from and about the User, through the methods described below (see Section 2), from the following sources:
Nestlé Websites: User-facing websites operated by or for Nestlé, including sites operated on its own domains/URLs and mini-sites managed on third-party social networks, such as Facebook (“Websites”).
Nestlé mobile sites/applications: Mobile sites or applications aimed at the User operated by or for Nestlé, such as smartphone applications.
Email, text messages (SMS) and other electronic messages: Interactions through electronic communications between you and Nestlé.
Nestlé Consumer Service Center (CSC): Communications with the Nestlé Consumer Service Center (“CSC”).
Offline registration forms: Printed or digital registration forms and similar forms that we collect, for example through postal mail, in-store demonstrations, contests and other promotions, or events.
Advertising interactions: Interactions with Nestlé’s advertisements (for example, if the User interacts with one of the ads on a third-party website, Nestlé may receive information about that interaction).
Data we create: In the course of your interactions with the User, Nestlé may create Personal Data about them (for example, records of purchases on websites).
Data from other sources: Third-party social networks (e.g., Facebook), advertising networks (e.g., Google), messaging applications (e.g., WhatsApp), market research (when feedback is not provided anonymously), third-party data aggregators, Nestlé’s promotional partners, public sources, and data received when we acquire other companies.
2. PERSONAL DATA THAT NESTLÉ COLLECTS ABOUT THE USER AND HOW IT DOES SO
Depending on how you interact with Nestlé (online, offline, by phone, etc.), we collect various types of information about the User, as described below.
Personal contact information: Includes any information you provide that allows us to contact you, such as your name, postal address, email address, social media details, or phone number.
Account login information: Any information necessary to give you access to your specific account profile. Examples include your login ID/email address, username, password (in an unrecoverable format), and/or security question and answer.
Demographic information and interests: Any information describing the User’s demographic or behavioral characteristics. Examples include date of birth, age or age range, gender, geographic location (e.g., postal code), favorite products, hobbies and interests, and information about household or lifestyle.
Information from your computer/mobile device: Any information about the computer system or other technological device you use to access one of Nestlé’s Websites or applications, such as the internet protocol (IP) address used to connect your computer or device to the internet, the type of operating system, and the type and version of your web browser. If you access a Nestlé website or application through a mobile device, such as a smartphone, the information collected will also include, where permitted, the unique device identifier, advertising identifier, geolocation, and other similar mobile-device data.
Information about Website/communications usage: As the User browses and interacts with Nestlé’s Websites or newsletters, automatic data-collection technologies are used to collect certain information about their actions. This includes information such as the hyperlinks clicked, pages or content viewed and for how long, and other similar information and statistics about interactions, such as content response times, download errors, and duration of visits to certain pages. This information is captured through automated technologies, such as cookies and web beacons, and is also collected through the use of third-party tracking for analytics and advertising purposes. You have the right to object to the use of these technologies (for more details, see Section 4).
Market research and User feedback: Any information you voluntarily share with Nestlé about your experience using products and services.
User-generated content: Any content that the User creates and then shares with Nestlé on third-party social networks or by uploading it to one of the Websites or applications, including the use of third-party social media applications, such as Facebook. Examples include photographs, videos, personal stories, or other similar media or content. Where permitted, Nestlé will collect and publish User-generated content in connection with various activities, including contests and other promotions, community features on websites, User engagement, and third-party social networks.
Third-party social network information: Any information the User publicly shares on a third-party social network or information that is part of their profile on that social network (such as Facebook) and that they authorize that social network to share with us. Examples include basic account information (e.g., name, email address, gender, date of birth, current city, profile photo, user ID, friends list, etc.) and any other additional information or activities the User allows the third-party social network to share. We receive the User’s profile information from third-party social networks (or parts of it) whenever they download or interact with a Nestlé web application on a third-party social network, such as Facebook, whenever they use a social-network feature integrated into a Nestlé site (such as Facebook Connect), or whenever they interact with us through a third-party social network. For more information about how User information on a third-party social network is obtained by Nestlé, or to disable the sharing of such social-network information, please visit the relevant third-party social network’s website.
Payment and financial information: Any information we need to complete an order, or that you use to make a purchase, such as your debit or credit card details (cardholder name, card number, expiration date, etc.) or other forms of payment (where available). In any case, Nestlé or its payment-processing service providers handle payment and financial information in accordance with applicable laws, regulations, and security standards, such as PCI DSS.
Calls to Nestlé’s CSC: Communications with Nestlé’s CSC may be recorded or monitored, in accordance with applicable law, for local operational needs (e.g., for quality or training purposes). Payment card data is not recorded. Whenever required by law, you will be informed of such recording at the start of the call.
Sensitive Personal Data: Nestlé does not collect or process Users’ sensitive personal data in the normal course of its business. Whenever it becomes necessary to process the User’s sensitive personal data, for any reason, Nestlé relies on the User’s prior express consent for any processing that is voluntary (e.g., for marketing purposes). If Nestlé processes the User’s sensitive Personal Data for other purposes, it does so only on the following grounds:
· detection and prevention of unlawful activities (including fraud prevention);
· compliance with applicable law (for example, to comply with Nestlé’s diversity reporting).
3. CHILDREN’S PERSONAL DATA
Nestlé does not knowingly request or collect Personal Data from children under the age of 13. If Nestlé discovers that it has inadvertently collected personal data from a child under the age of 13, it will promptly remove that Personal Data from Nestlé’s records. However, Nestlé may collect personal data of children under 13 directly from the parent or guardian, and with that person’s explicit consent.
Nestlé also does not knowingly request or collect personal data from children under the age of 18 for the specific purposes of marketing communications.
4. COOKIES/SIMILAR TECHNOLOGIES, LOG FILES AND WEB BEACONS
Cookies/Similar technologies. The User should consult Nestlé’s Cookie Policy (See Here) to learn how to manage their cookie settings and to obtain detailed information about the cookies we use and the purposes for which we use them.
Log files. Nestlé collects information in the form of log files that record website activity and gather statistics about the User’s browsing habits. These logs are generated automatically and help us detect and resolve errors, improve performance, and maintain the security of Nestlé Websites.
Web Beacons. Web beacons (also known as “web bugs”) are small pieces of code that display a graphic image on a web page or in an email for the purpose of transmitting data to us. Information collected through web beacons will include information such as the IP address, as well as information about how you respond to an email campaign (for example, what time the email was opened, which hyperlinks were clicked in the email, etc.). Nestlé will use web beacons on Websites or include them in emails sent to the User. It uses web-beacon information for various purposes, including, among others, site traffic reporting, unique visitor counts, advertising, auditing and email reporting, and personalization.
5. PURPOSES OF PROCESSING THE USER’S PERSONAL DATA
The following paragraphs describe the various purposes for which Nestlé collects and processes Users’ Personal Data, as well as the categories of Personal Data collected for each purpose. Note that not all of the purposes listed below will apply to all data subjects.
What we use the User’s personal data for
Legal basis
Nestlé’s legitimate interests
Customer service: We use the User’s Personal Data for consumer support service purposes, including responding to information requests. This typically involves the use of certain personal contact data and information related to the reason for your request (e.g., order status, technical issue, question/complaint about a product, general inquiry, etc.).
· Performance of contractual obligations
· Compliance with legal obligations
· Nestlé’s legitimate interest
· Improvement and development of new products and services
· Efficiency gains
Contests, marketing and other promotions: With the User’s consent (where required), Nestlé uses Personal Data to provide information about goods or services (e.g., marketing communications, campaigns or promotions). This may be done by email, ads, SMS, phone calls, messaging apps, and postal mail, to the extent permitted by applicable law. Some campaigns and promotions are run by Nestlé on third-party websites and/or social networks. This use of Personal Data is voluntary, meaning the User may object to (or withdraw consent for) the processing of Personal Data for these purposes. For detailed information on how to change marketing communication preferences, see Sections 9 and 10 below. For more information on Nestlé’s contests and other promotions, see the official rules or details published with each contest/promotion.
· User consent (where necessary)
· Performance of contractual obligations
· Nestlé’s legitimate interest
· Identifying which Nestlé products and services may interest the consumer and informing them accordingly
· Building consumer profiles for new products or services
Third-party social networks: We use the User’s Personal Data when they interact with third-party social network features, such as “Like” functions, to present ads and engage with them on those social networks. You can learn more about how these features work, what profile data we obtain about you, and how to opt out, by consulting the privacy policies of the relevant third-party social networks. We use the User’s Personal Data to personalize and send communications, including through social networks, based on interests and interactions with Nestlé products and services.
· User consent (where necessary)
· Nestlé’s legitimate interest
· Identifying which Nestlé products and services may interest the consumer and informing them accordingly
· Defining consumer types for new products or services
Personalization (offline and online): With the User’s consent (where required), we use Personal Data to:
· analyze preferences and habits;
· anticipate needs based on analysis of the User’s profile;
· improve and personalize the experience on Nestlé Websites and applications;
· ensure that Nestlé website/application content is optimized for the User and for the computer or device used;
· provide targeted advertising and content;
· enable User participation in interactive features, when desired.
For example, Nestlé stores the user ID/email address or username so you can quickly log in the next time you visit the site, or so you can easily retrieve items previously placed in your shopping cart. Based on this type of information, and with the User’s consent (where required), Nestlé also presents specific Nestlé content or promotions tailored to the User’s interests.
The use of Personal Data is voluntary, meaning the User may object to the processing of data for this purpose. For detailed information on how to exercise the right to object, see Section 10 below.
Order fulfillment: We use the User’s Personal Data to process and ship orders, inform them of order status, correct addresses, and carry out identity verification and other fraud-detection activities. This involves the use of certain Personal Data and payment information.
· Performance of contractual obligations
· User consent (where necessary)
· Compliance with legal obligations
· Nestlé’s legitimate interest
· Improving and developing new products and services
· Being more efficient
· Protecting systems, networks and employees
· Compliance with legal obligations
Other general purposes (e.g., internal or market research, analytics, security): In accordance with applicable law, we use the User’s Personal Data for other general business purposes, such as account maintenance, conducting internal or market research, and measuring the effectiveness of advertising campaigns. We reserve the right, where you hold multiple Nestlé accounts, to consolidate them into a single account. Nestlé also uses Personal Data for the management and operation of communication, IT, and security systems.
Legal reasons or merger/acquisition: If Nestlé, or its assets, are acquired by another entity or merged with another company, including as part of an insolvency proceeding, we will share the User’s Personal Data with any legal successors. We will also disclose Personal Data to third parties:
· when required by applicable law;
· in the context of judicial proceedings;
· in response to a request from a competent law enforcement authority;
· to protect the rights, privacy, safety, or property of Nestlé, or of the public; or
· to enforce the terms of any agreement or the terms of the Nestlé Website.
· Compliance with legal obligations
· Nestlé’s legitimate interest
· Protecting Nestlé’s assets and employees
6. DISCLOSURE OF THE USER’S PERSONAL DATA
Without prejudice to the Nestlé entities identified in the section on data controllers and their contacts (Section 12), the User’s Personal Data may be disclosed to the following categories of third parties:
Service providers: These are external companies that Nestlé uses to help manage its business (e.g., order fulfillment, payment processing, fraud detection and identity verification, website operation, market research companies, support services, promotions, website development, data analytics, CRC, etc.). Service providers, and their selected staff, are only authorized to access and use the User’s Personal Data on Nestlé’s behalf for the specific tasks requested of them, based on Nestlé’s instructions, and are required to keep Personal Data confidential and secure.
Credit reporting agencies/debt collection companies: To the extent permitted by applicable law, credit reporting agencies and debt collection companies are external companies that Nestlé uses to verify creditworthiness (particularly for invoiced orders) or to collect outstanding invoices.
Third-party companies that use Personal Data for their own marketing purposes: Except where you have given your consent, we do not license or sell the User’s Personal Data to third-party companies for their own marketing purposes. Their identity will be disclosed at the time your consent is requested.
Nestlé may share with partners, such as Meta Platforms Ireland Limited (“Meta”), Google Ireland Limited (“Google”), The Trade Desk and others, certain data relating to actions taken on Nestlé Websites, such as visits, interactions, use of Facebook Connect, and information collected through cookies or similar technologies, including the Facebook pixel, Google tags, and The Trade Desk’s unique identifiers.
This allows Nestlé to measure the effectiveness of its advertising, improve marketing practices, and helps present the User with advertising that is more relevant to them and to people with similar profiles (including on social networks). Nestlé is a joint controller with Meta and with some other partners it may engage for this processing. The User can find more information, including on how these partners enable the exercise of data protection rights and how they subsequently process information as independent controllers, directly on their respective privacy websites (Meta Privacy Policy, Google Privacy Policy and The Trade Desk Privacy Policy).
Third-party recipients that use Personal Data for legal reasons or due to a merger/acquisition: We will disclose the User’s Personal Data to third parties for legal reasons or in the context of an acquisition or merger (see Section 5 for more details).
7. RETENTION OF THE USER’S PERSONAL DATA
Nestlé takes all reasonable measures to ensure that the User’s Personal Data is processed only for the minimum period necessary for the purposes set out in this Privacy Policy. The criteria for determining the retention period of the User’s Personal Data are as follows:
a) Nestlé will retain copies of the User’s Personal Data, in a form that allows identification, only for as long as:
· There is an ongoing relationship with the User (for example, when the User is included in Nestlé’s contact list and has not unsubscribed); and/or
· The User’s Personal Data is necessary in the context of the purposes set out in this Privacy Policy and there is a valid legal basis;
b) The duration of:
· Any applicable legal deadline (for example, the period during which a user may bring legal action against Nestlé), and
· An additional period of 2 months after the end of the applicable limitation period (so that Nestlé can identify any personal data of a user who may file a claim at the end of the applicable period),
· If relevant legal proceedings are initiated, we may continue to process the User’s Personal Data for the additional period necessary in connection with those proceedings.
During the periods referred to in (b)(i) to (iii), Nestlé will limit the processing of the User’s Personal Data to storage and maintaining the security of that data, except to the extent it is necessary to analyze it in the context of any legal proceedings or to comply with an applicable legal obligation.
After the end of the periods set out in (a) and (b), as applicable, we will (i) permanently delete or destroy the relevant Personal Data or (ii) anonymize the relevant Personal Data.
8. DISCLOSURE, STORAGE AND/OR TRANSFER OF THE USER’S PERSONAL DATA
We use appropriate measures (described below) to keep Users’ Personal Data confidential and secure. However, we note that these protections do not apply to information you choose to share in public areas, such as third-party social networks.
People who may access the User’s Personal Data: The User’s Personal Data will be processed by Nestlé’s authorized employees or Service Providers, on a “need to know” basis, depending on the specific purposes for which the Personal Data was collected (the team responsible for CSC matters will have access to the Consumer record).
Measures adopted in operational environments: Nestlé stores Users’ Personal Data in operational environments that use reasonable security measures to prevent unauthorized access. Nestlé follows reasonable standards to protect Personal Data. Unfortunately, the transmission of information over the Internet is not completely secure, and although Nestlé makes every effort to protect the User’s Personal Data, it cannot guarantee the security of data during transmission through Nestlé’s Websites or applications.
Measures the User should take: It is important that the User also plays a role in maintaining the security of their Personal Data. When creating an online account, you should make sure to choose a password that is difficult for third parties to guess and never reveal your password to anyone. The user is responsible for keeping that password confidential and for any use of their account. If the user uses a shared or public computer, they should never choose to have their login ID/email address or password remembered, and should always make sure to log out of their account whenever they leave the computer. The User should also use any privacy settings or controls made available to them on the Nestlé Website/application.
Transfer of the User’s Personal Data: The storage, as well as the processing of the User’s Personal Data as described above, may require that the User’s Personal Data ultimately be transferred/transmitted to, and/or stored in, a destination outside the user’s country of residence. In particular, Nestlé may transfer the User’s Personal Data to countries outside the European Economic Area (“EEA”) (for example, other Nestlé entities), including to countries that have different data protection standards than those applicable in the EEA (such as the USA, Ukraine, Brazil, and the Philippines). Nestlé (i) has implemented Nestlé’s Binding Corporate Rules to protect Users’ Personal Data and/or (ii) uses other applicable transfer mechanisms (where required by law).
9. USERS’ RIGHTS REGARDING THEIR PERSONAL DATA
Right of access to Personal Data: The data subject has the right to access Personal Data concerning them and to request a copy, in physical or electronic form, of the information we hold about them. They also have the right to obtain information about the origin of the User’s Personal Data.
These rights may be exercised by sending us the completed form available here, by email to faleconnosco@pt.nestle.com, or by postal mail to Nestlé Portugal, Unipessoal, Lda., Rua Alexandre Herculano, 8, 2799-554 Linda-a-Velha, together with proof of identification, attaching a copy of your identification document or equivalent data. If the request is submitted by a person other than the data subject, without proof that the request is legitimately made on their behalf, the request will be refused. Note that any identifying information provided to us will only be processed in accordance with applicable law.
Additional rights of data subjects: Under applicable law, the data subject also has, as applicable, the right to obtain rectification of inaccurate Personal Data, its erasure, restriction of processing, data portability, as well as the right to object to the processing of the User’s Personal Data. Whenever processing is based on the User’s consent, they may withdraw it at any time, without affecting the lawfulness of processing carried out based on consent previously given.
Without prejudice to applicable law, the data subject may also have the following additional rights regarding the processing of their Personal Data:
· the right to object, on grounds relating to their particular situation, to the processing of their Personal Data carried out by Nestlé or on our behalf; and
· the right to object to the processing of their Personal Data for direct marketing purposes.
Note that, in certain circumstances, Nestlé may not be able to delete the User’s Personal Data without also deleting their user account. Nestlé may be required to retain some of the User’s Personal Data after having received a deletion request, in order to comply with its legal or contractual obligations. Applicable law may also allow Nestlé to retain some of the User’s Personal Data to meet its business needs.
Where available, Nestlé Websites have a dedicated feature through which you can view and edit the Personal Data you have provided. We note that Nestlé requires its registered users to verify their identity (e.g., login ID/email address, password) before being able to access or change their account information. This helps prevent unauthorized access to users’ accounts.
Nestlé hopes to be able to answer any questions the User may have about how we process their Personal Data. However, if the User has concerns that have not been resolved, they also have the right to file a complaint with the competent data protection authorities.
10. CHOICES REGARDING THE USE AND DISCLOSURE OF THE USER’S PERSONAL DATA
Nestlé seeks to ensure adequate control mechanisms regarding Users’ Personal Data provided to us. The mechanisms described below allow the User to manage, within legally applicable limits, how their Personal Data is used:
Cookies/Similar technologies: You can manage your consent through:
· Nestlé’s consent management solution; or
· your browser, to refuse all or some cookies/similar technologies, or to be alerted when they are being used (See Section 4).
Advertising, marketing and promotions: The User may give their consent for their Personal Data to be used by Nestlé to promote its products or services, by selecting the boxes provided for this purpose on registration forms or through responses given to CSC representatives. If the User no longer wishes to receive such communications, they may, at any time, withdraw their consent or unsubscribe from marketing communications, following the instructions in each communication. To stop receiving marketing communications through any channel, including through third-party platforms, you may also change your preferences via the links provided in Nestlé’s communications, by accessing the Websites/applications or the platforms in question, adjusting your account preferences, unchecking the relevant options, or contacting our CSC. Note that even if you exercise the right to object or withdraw consent regarding marketing communications, you will continue to receive communications of a contractual nature, namely order or other transaction confirmations, account-related notifications, and other notices necessary for the provision of services.
Personalization (offline and online): Whenever legally required, if you wish your Personal Data to be used by Nestlé to provide you with a personalized experience, personalized advertising, or targeted content, you may express this preference by using the relevant checkboxes on the registration form or by responding to questions posed by CSC representatives. If the User later no longer wishes to benefit from this personalization, they may, at any time, change their preferences through the Websites/applications, their user account, or by contacting the CSC.
Targeted advertising: Nestlé works with advertising networks and other advertising service providers (“Advertising Providers”), which present advertising on behalf of Nestlé and on behalf of unaffiliated entities on the internet. Some of this advertising may be tailored to the User’s interests based on information collected, over time, on Nestlé’s websites and on third-party websites. You can visit https://optout.aboutads.info/ for more information about this type of advertising and about the opt-out mechanisms for interest-based advertising practices made available by entities participating in the Digital Advertising Alliance’s (“DAA”) self-regulatory program. You may also exercise opt-out options in mobile applications through the DAA’s AppChoices application. The User can also prevent the collection of precise location data from their mobile device by changing the relevant location settings. Nestlé also works with third parties, including social media platforms, to present ads to you or measure the effectiveness of its advertising campaigns. For this purpose, we may convert the User’s email address, phone number, or other data into a unique identifier and share it with these partners, for the purpose of matching it with user identifiers on their respective platforms or websites, or with other data they hold. Such matching enables the presentation of personalized advertising to the data subject and to other users with similar profiles. The User may object, at any time, to receiving this type of personalized advertising by clicking here.
11. CHANGES TO THE PRIVACY POLICY
If Nestlé changes how it processes the User’s Personal Data, it will update this Policy. Nestlé reserves the right to make changes to its practices and to the Privacy Policy at any time; please check regularly for any updates or changes.
12. DATA CONTROLLERS & CONTACT
For any questions, comments, or complaints regarding Nestlé’s Privacy Policy, its privacy practices, or compliance with applicable data protection legislation, you may contact us through the form at https://empresa.nestle.pt/fale-connosco, by email to faleconnosco@pt.nestle.com, by mail to Nestlé Portugal, Unipessoal, Lda., Rua Alexandre Herculano, 8, 2799-554 Linda-a-Velha, or by phone to Nestlé’s CSC at 800 203 591, from 8:30 AM to 8:30 PM, Monday to Saturday (except holidays).
You may also contact Nestlé’s data protection contact point at the email address dataprotectionPT@pt.nestle.com.
Nestlé will acknowledge receipt of and investigate any complaint about how it manages Personal Data (including complaints alleging that Nestlé has violated the User’s rights under applicable privacy laws).
Data Controllers
Responsible for
Nestlé Portugal, Unipessoal, Lda
Rua Alexandre Herculano, 8
2795-010 Linda-a-Velha
All activities.
Additionally, all of the following Nestlé entities
Nestlé Treasury International S.A.
7, Rue Nicolas Bové
L-1253 Luxembourg
Payment card operations related to the website/app.