Privacy Policy 

This Privacy Policy describes how The Hershey Company and its affiliated brands may collect, use, disclose, and protect personal information when people engage with covered websites, digital services, facilities, events, and other company activities. The practices outlined here may apply to online interactions as well as certain in-person or other communications. Some related businesses and services operate under separate privacy notices and are not covered by this policy, including Hershey Entertainment and Resorts Company, The Hotel Hershey, Hersheypark, and the Hersheypark mobile application.

The types of personal information handled may depend on a person’s relationship with the company and the ways they interact with it. Information may include identifying and contact details such as name, mailing address, telephone number, email address, age, gender, and date of birth. For purchases, the company may also handle information needed to process billing and payment. Shopping-related details may include products viewed, placed in a cart, purchased, returned, or otherwise connected to a transaction.

Individuals may choose to provide additional information through surveys, contests, sweepstakes, promotions, recipe entries, product reviews, customer service conversations, registration forms, and other activities. Submissions may include comments, photographs, videos, messages, reviews, or similar materials. Where permitted, visits to certain facilities or attendance at events may also involve the collection of photographs, recordings, or other visual content. Information connected with social media may be available when people interact with company pages, post publicly, or use social platforms in ways that make their information accessible.

Some information is collected automatically when visitors use company websites or digital services. This may include IP address, browser and operating system details, device characteristics, pages viewed, links clicked, referring websites, session activity, and other usage information. Approximate location may sometimes be inferred from technical details such as an IP address. The company may review this information to understand how people use its websites, identify general interests and trends, improve functionality, and evaluate interactions with digital content.

Cookies and similar technologies may support automatic collection. These can include pixels, tags, scripts, session tools, and comparable technologies. Third-party providers may use them to analyze site performance, measure visitor activity, create heatmaps, review sessions, evaluate advertising, and identify usability issues. These tools may also support security monitoring and fraud prevention. Where available or legally required, visitors can manage optional tracking through cookie preference tools or browser settings.

Information may come from several sources. People may provide it directly when creating accounts, placing orders, entering promotions, subscribing to communications, contacting support, completing surveys, submitting content, or communicating with the company in person. The company may also receive information from service providers, advertising and analytics firms, business partners, social networks, data suppliers, and other third parties. Where legally permitted and appropriate for business purposes, information from different sources may be combined to better understand customer interactions.

Personal information may be used to operate websites, fulfill orders, provide requested products and services, and administer customer accounts. It can support payment processing, order management, returns, customer communications, product recalls, and other transaction-related activities. Information may also be used to respond to questions, resolve service issues, send administrative notices, and communicate changes involving products, policies, accounts, or services.

Marketing is another possible use. People who choose to receive promotional messages may be contacted through available channels, including email and text programs. Marketing communications generally provide a way to opt out of future messages. Information about customer interests and interactions may also be used to make recommendations, tailor experiences, measure campaign performance, or present advertising that better reflects apparent interests.

The company may also use information for analytics, website and product improvements, operational planning, fraud detection, security, and performance evaluation. Reviewing usage patterns can help determine which content is useful, identify areas for improvement, assess promotions, and maintain reliable digital systems. Personal information may also be processed to meet legal obligations, respond to valid government or law enforcement requests, enforce applicable terms, protect the rights or safety of the company and others, investigate suspected misconduct, or address security concerns.

Depending on the circumstances, personal information may be disclosed to different categories of recipients. Affiliated companies and related brands may use information for legitimate operational and business purposes. Vendors and service providers may process information while performing services such as website hosting, order fulfillment, communications, analytics, promotion administration, security, fraud prevention, and technical support. Certain business partners or promotion sponsors may receive information needed to operate particular programs. Research providers may assist with surveys and studies, while advertising and analytics companies may help measure campaigns or deliver promotional content.

Information may also be disclosed to government agencies or other authorized parties when required by law, court order, legal process, investigation, or another valid governmental request. If the company participates in a merger, acquisition, restructuring, asset sale, bankruptcy, or comparable corporate transaction, personal information may be transferred as part of that process. Other disclosures may occur at an individual’s request or with their authorization, when necessary to protect safety or legal interests, or when otherwise permitted by law. Aggregated or de-identified information may also be used or shared when it can no longer reasonably be linked to a particular person.

Privacy options depend on a person’s location and the laws applicable to their circumstances. Depending on the jurisdiction, individuals may be able to request details about personal information collected about them, access or correct it, ask for deletion, obtain certain information in a portable format, limit particular processing, object to certain uses, or restrict specified disclosures. Some laws also provide choices concerning targeted advertising, certain sales or sharing practices, and particular automated processing activities.

Privacy requests may require verification of identity or authorization. These procedures are intended to reduce the risk of unauthorized access or changes to personal information. Where permitted, an individual may authorize another person to submit a request on their behalf, though proof of that authority may be required. If a request is denied, applicable law may provide a process for appealing or challenging the decision.

Where legally recognized, certain privacy preference signals may be honored. For example, a supported browser or device may transmit a Global Privacy Control signal indicating a preference relating to certain data sharing or targeted advertising. Cookie preference tools may also allow visitors to manage optional tracking technologies. Disabling nonessential cookies can affect personalized functions or other features that rely on information stored by those technologies.

The company does not knowingly seek to collect children’s personal information where applicable law prohibits it. Its digital services are generally designed for broader audiences, particularly adults. Parents or guardians who believe that information about a child may have been collected through a covered service can contact the appropriate company team for assistance and, where available, request that the information be reviewed or removed.

Personal information is generally kept only as long as reasonably necessary for the purposes for which it was collected. It may be retained longer when required or permitted by law, or when needed for legitimate business operations, security, dispute resolution, accounting, or recordkeeping. Retention decisions may take into account the sensitivity of the information, the reason for collection, potential risks, operational needs, and legal requirements. De-identified information may continue to be held and used when it can no longer reasonably identify an individual.

The company uses physical, technical, and administrative safeguards intended to protect personal information from unauthorized access, misuse, loss, alteration, or disclosure. These measures are designed to reduce risk, but no electronic system, internet connection, or transmission method can be guaranteed entirely secure. Individuals should also take reasonable steps to protect their accounts, including using strong passwords, safeguarding credentials, and avoiding unnecessary disclosure of sensitive information through unsecured channels.

Because the company operates across multiple countries and regions, personal information may be processed or stored outside an individual’s home country. Cross-border transfers may rely on legal mechanisms recognized by the applicable privacy framework, such as contractual protections or other approved safeguards. The rights available to an individual and the rules governing information processing may differ based on their place of residence.

Additional privacy provisions may apply to people in particular regions, including Brazil, Canada, Mexico, India, and various jurisdictions within the United States. Certain U.S. state privacy laws provide further rights and choices concerning the collection, use, disclosure, sale, or sharing of personal information. Depending on the law, individuals may also have additional options related to targeted advertising, analytics, sensitive information, or other processing activities.

Cookie and advertising practices may be explained in separate notices or preference tools. Essential cookies can support account access, forms, security, and basic site functions. Functional technologies may remember preferences and make services more convenient, while performance tools can provide insight into site traffic and visitor interactions. Advertising technologies may help marketing providers understand general interests and present promotional content that is more relevant to visitors.

Limiting targeted advertising or optional tracking does not necessarily eliminate advertising from the online experience. Promotional content may still appear, but it may be selected using broader information rather than activity linked to an individual’s browsing behavior. Available privacy choices can generally be reviewed or changed through the controls provided.

The company may revise its privacy practices as technology, operations, legal requirements, and expectations for data protection evolve. Where appropriate, material changes may be accompanied by additional notices. Individuals are encouraged to review this policy periodically to stay informed about how personal information is handled and what rights or choices may be available to them.

Add clear privacy policy headingsMake privacy rights more actionable