Name

Description

Lifetime

AWIN

Description of Service This is an affiliate network. Processing Company AWIN AG Eichhornstrasse 3, 10785 Berlin, Germany Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. global-privacy@awin.com Data Purposes This list represents the purposes of the data collection and processing. Affiliate marketing Tracking Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Cookies Journey tags Data Collected This list represents all (personal) data that is collected by or through the use of this service. Ads viewed Browser information Clicked advertisements Device information Device operating system Referrer URL Time advertising is clicked Time advertising is viewed Touch point to advertising medium Usage data User agent Business transactions Order information Leads Newsletter information Success of referrals Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. a GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. European Union Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. The data will be deleted as soon as they are no longer needed for the processing purposes. Data Recipients In the following the recipients of the data collected are listed. AWIN AG Click here to read the privacy policy of the data processor https://www.awin.com/us/legal/privacy-policy Storage Information Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used. Maximum age of cookie storage: 1 year Non-cookie storage: no

1 Year

Facebook Pixel

Description of Service This is a Tracking technology offered by Facebook and used by other Facebook services. It is used to track interactions of visitors with websites ("Events") after they have clicked on an ad placed on Facebook or other services provided by Meta ("Conversion"). Processing Company Meta Platforms Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. https://www.facebook.com/help/contact/540977946302970 Data Purposes This list represents the purposes of the data collection and processing. Analytics Marketing Retargeting Advertisement Conversion Tracking Personalisation Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Cookies Pixel Data Collected This list represents all (personal) data that is collected by or through the use of this service. Ads viewed Content viewed Device information Geographic location HTTP-header Interactions with advertisement, services, and products IP address Items clicked Marketing information Pages visited Pixel ID Referrer URL Usage data User behaviour Facebook cookie information Facebook user ID Usage/click behaviour Browser information Device operating system Device ID User agent Browser type Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. a GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. European Union Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. User’s interactions tracked on websites will not be stored longer than for two years. However, the data will be deleted as soon as they are no longer needed for the processing purposes. Transfer to Third Countries This service may forward the collected data to a different country. Please note that this service might transfer the data outside of the EU/EEA and to a country without the required data protection standards. If the data is transferred to the US, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. This can be for different reasons like storing or processing. Singapore,United States of America,Worldwide Data Recipients In the following the recipients of the data collected are listed. Meta Platforms Ireland Ltd., Meta Platforms Inc. Click here to read the privacy policy of the data processor https://www.facebook.com/privacy/explanation Click here to read the cookie policy of the data processor https://www.facebook.com/policies/cookies Storage Information Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used. Maximum age of cookie storage: 1 year Non-cookie storage: no

1 Year

Feefo

Processing Company Feefo Holdings Ltd Feefo Barn Heath Farm, Heath Rd E, Petersfield GU31 4HT, United Kingdom Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. gdprcompliance@feefo.com Data Collected This list represents all (personal) data that is collected by or through the use of this service. Email, name and product or service purchased Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. UK Click here to read the privacy policy of the data processor https://www.feefo.com/en/business/privacy-policy Click here to read the cookie policy of the data processor https://www.feefo.com/en/business/privacy-policy

1 Year

Google Ads

Description of Service This is an advertising service. Processing Company Google Ireland Limited Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. https://support.google.com/policies/troubleshooter/7575787?hl=en Data Purposes This list represents the purposes of the data collection and processing. Advertisement Analytics Providing Service Statistics Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Cookies Data Collected This list represents all (personal) data that is collected by or through the use of this service. Ads viewed Cookie ID Date and time of visit Device information Geographic location IP address Search terms Ads shown Client ID Impressions Online identifiers Browser information Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. a GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. European Union Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. The data will be deleted as soon as they are no longer needed for the processing purposes. Log data is anonymized after 9 months and cookie information is anonymized after 18 months. Transfer to Third Countries This service may forward the collected data to a different country. Please note that this service might transfer the data outside of the EU/EEA and to a country without the required data protection standards. If the data is transferred to the US, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. This can be for different reasons like storing or processing. Chile,Singapore,United States of America,Taiwan In the following the recipients of the data collected are listed. Alphabet Inc., Google LLC, Google Ireland Limited Click here to read the privacy policy of the data processor https://policies.google.com/privacy?hl=en Click here to read the cookie policy of the data processor https://policies.google.com/technologies/cookies?hl=en Click here to opt out from this processor across all domains https://safety.google/privacy/privacy-controls/ Storage Information Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used. Maximum age of cookie storage: 1 year Non-cookie storage: no

1 Year

Google Ads Remarketing

Description of Service This is a remarketing service. Processing Company Google Ireland Limited Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. https://support.google.com/policies/troubleshooter/7575787?hl=en Data Purposes This list represents the purposes of the data collection and processing. Remarketing Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Cookies Data Collected This list represents all (personal) data that is collected by or through the use of this service. Duration of visit IP address Pages visited Content user is interested in Website use Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. a GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. European Union Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. The data will be deleted as soon as they are no longer needed for the processing purposes. Transfer to Third Countries This service may forward the collected data to a different country. Please note that this service might transfer the data outside of the EU/EEA and to a country without the required data protection standards. If the data is transferred to the US, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. This can be for different reasons like storing or processing. United States of America,Singapore,Taiwan,Chile Data Recipients In the following the recipients of the data collected are listed. Google Ireland Limited Google LLC Alphabet Inc. Click here to read the privacy policy of the data processor https://policies.google.com/privacy Click here to read the cookie policy of the data processor https://policies.google.com/technologies/cookies Click here to opt out from this processor across all domains https://safety.google/privacy/privacy-controls/ Storage Information Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used. Maximum age of cookie storage: 1 year Non-cookie storage: no

1 Year

Name

Description

Lifetime

Magento

Description of Service This is an e-commerce platform. This service improves shopping experiences. Processing Company Magento Commerce International Ltd., Magento Inc. 25-28 North Wall Quay, Dublin, 662880, Ireland Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. dpo@adobe.com Data Purposes This list represents the purposes of the data collection and processing. Optimization Personalisation Providing Service Advertisement Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Cookies Pixel Data Collected This list represents all (personal) data that is collected by or through the use of this service. Actions of users of the services Ad campaign success rates Ads viewed Anonymous traffic data Browser language Browser type Browser version Clicked advertisements Cookie ID Credit and debit card number Demographic data Device information Device manufacturer Device model Device operating system Device type E-mail address Geographic location Hardware/software type IP address Media Access Control (MAC) address Name and version of the services used Pages visited Postal address Referrer URL Screen resolution Search terms Statistical information Usage data Browser information Telephone number Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. a GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. United States of America,European Union Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. The data will be deleted as soon as they are no longer needed for the processing purposes. Transfer to Third Countries This service may forward the collected data to a different country. Please note that this service might transfer the data outside of the EU/EEA and to a country without the required data protection standards. If the data is transferred to the US, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. This can be for different reasons like storing or processing. United States of America Data Recipients In the following the recipients of the data collected are listed. Magento Commerce International Ltd., Magento Inc., Adobe Click here to read the privacy policy of the data processor https://magento.com/legal/terms/privacy Click here to read the cookie policy of the data processor https://docs.magento.com/user-guide/stores/cookie-reference.html

1 Year

Mirasvit GDPR Cookie Consent Extension

Description of Service This is a consent management service. Mirasvit GDPR Cookie Consent Extension is used on the website as a processor for the purpose of consent management. Data Purposes This list represents the purposes of the data collection and processing. Compliance with legal obligations Consent storage Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Local storage Data Collected This list represents all (personal) data that is collected by or through the use of this service. Opt-in and opt-out data Referrer URL User agent User settings Consent ID Time of consent Consent type Template version Banner language Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. c GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. United Kingdom Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. The consent data (given consent and revocation of consent) are stored for three years. The data will then be deleted immediately. Storage Information Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used. Maximum age of cookie storage: Session Non-cookie storage: no

1 Year

Name

Description

Lifetime

Google Analytics

Description of Service This is a web analytics service. With this the user can measure the advertising ROI as well as track Flash, video, and social networking sites and applications. Processing Company Google Ireland Limited Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. https://support.google.com/policies/contact/general_privacy_form Data Purposes This list represents the purposes of the data collection and processing. Marketing Analytics Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Cookies Pixel Data Collected This list represents all (personal) data that is collected by or through the use of this service. App updates Click path Date and time of visit Device information Downloads Flash version Location information IP address JavaScript support Pages visited Purchase activity Referrer URL Usage data Widget interactions Browser information Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. a GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. European Union Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. The Retention Period depends on the type of the saved data. Each client can choose how long Google Analytics retains data before automatically deleting it. Transfer to Third Countries This service may forward the collected data to a different country. Please note that this service might transfer the data outside of the EU/EEA and to a country without the required data protection standards. If the data is transferred to the US, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. This can be for different reasons like storing or processing. United States of America,Singapore,Chile,Taiwan Data Recipients In the following the recipients of the data collected are listed. Google Ireland Limited, Alphabet Inc., Google LLC Click here to read the privacy policy of the data processor https://policies.google.com/privacy?hl=en Click here to read the cookie policy of the data processor https://policies.google.com/technologies/cookies?hl=en Click here to opt out from this processor across all domains https://tools.google.com/dlpage/gaoptout?hl=de Storage Information Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used. Maximum age of cookie storage: 2 years Non-cookie storage: no

1 Year

Google Analytics 4

Description of Service This is service enables the user to measure traffic and engagement across their websites and mobile apps using customisable reports. Processing Company Google Ireland Limited Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. https://support.google.com/policies/contact/general_privacy_form Data Purposes This list represents the purposes of the data collection and processing. Marketing Analytics Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Tracking code Cookies Data Collected This list represents all (personal) data that is collected by or through the use of this service. Account data Anonymised IP address Bounce rates Browser information Click path Date and time of visit Device information Downloads Duration of visit Location information Internet service provider Mouse movements Screen resolution Behavioural data Referrer URL App updates Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. a GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. European Union Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. The client can choose how long Google Analytics retains data. The maximum amount of retention period is 26 months. Transfer to Third Countries This service may forward the collected data to a different country. Please note that this service might transfer the data outside of the EU/EEA and to a country without the required data protection standards. If the data is transferred to the US, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. This can be for different reasons like storing or processing. United States of America,Singapore,Taiwan,Chile Data Recipients In the following the recipients of the data collected are listed. Alphabet Inc., Google LLC, Google Ireland Limited Click here to read the privacy policy of the data processor https://policies.google.com/privacy?hl=en Click here to read the cookie policy of the data processor https://policies.google.com/technologies/cookies?hl=en Click here to opt out from this processor across all domains https://tools.google.com/dlpage/gaoptout?hl=de Storage Information Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used. Maximum age of cookie storage: Session Non-cookie storage: no

1 Year

Google Tag Manager

Description of Service This is a tag management system. With this the user can update measurement codes and related code fragments collectively known as tags on the users website or mobile app. Processing Company Google Ireland Limited Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. https://support.google.com/policies/contact/general_privacy_form Data Purposes This list represents the purposes of the data collection and processing. Tag Management Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Pixel Data Collected This list represents all (personal) data that is collected by or through the use of this service. Aggregated data about tag firing Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. a GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. European Union Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. The data will be deleted after 14 days of retrieval. Transfer to Third Countries This service may forward the collected data to a different country. Please note that this service might transfer the data outside of the EU/EEA and to a country without the required data protection standards. If the data is transferred to the US, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. This can be for different reasons like storing or processing. United States of America,Singapore,Taiwan,Chile Data Recipients In the following the recipients of the data collected are listed. Alphabet Inc., Google LLC, Google Ireland Limited Click here to read the privacy policy of the data processor https://policies.google.com/privacy?hl=en Click here to read the cookie policy of the data processor https://policies.google.com/technologies/cookies?hl=en Click here to opt out from this processor across all domains https://safety.google/privacy/privacy-controls/

1 Year

Microsoft Advertising

Description of Service This is a tracking and advertising service. Processing Company Microsoft Ireland Operations Limited One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland Data Protection Officer of Processing Company Below you can find the email address of the data protection officer of the processing company. https://aka.ms/privacyresponse Data Purposes This list represents the purposes of the data collection and processing. Advertisement Conversion Tracking Technologies Used This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser. Cookies Web beacons Data Collected This list represents all (personal) data that is collected by or through the use of this service. Browser language Clicked advertisements Digital signature GUID generated by UET tag IP address Microsoft Click ID Microsoft cookie Page title Referrer URL Screen color depth Screen resolution UET ID tag Page load time Publisher/URL accessed Legal Basis In the following the required legal basis for the processing of data is listed. Art. 6 para. 1 s. 1 lit. a GDPR Location of Processing This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately. European Union Retention Period The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes. Data will be deleted as soon as they are no longer needed for the processing purposes. Transfer to Third Countries This service may forward the collected data to a different country. Please note that this service might transfer the data outside of the EU/EEA and to a country without the required data protection standards. If the data is transferred to the US, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. This can be for different reasons like storing or processing. Worldwide Data Recipients In the following the recipients of the data collected are listed. Microsoft Corporation Click here to read the privacy policy of the data processor https://privacy.microsoft.com/en-gb/privacystatement Click here to read the cookie policy of the data processor https://privacy.microsoft.com/en-gb/privacystatement Click here to opt out from this processor across all domains https://account.microsoft.com/privacy/ad-settings/signedout?ru=https:%2F%2Faccount.microsoft.com%2Fprivacy%2Fad-settings Storage Information Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used. Maximum age of cookie storage: 1 year, 25 days Non-cookie storage: no

1 Year

Willie's Cacao Raisin & Hazelnut 100% No Added Sugar Chocolate 50g