Privacy Policy

Effective Date: This policy was last updated on 15 June 2023.

Introduction

We respect your privacy and are committed to protecting your personal information. We have developed this Privacy Policy to inform you about:

• the kind of information collected by us;

• the purposes for which we may collect, hold, use and disclose your Personal Information;

• how we hold, use, and disclose your Personal Information;

• how you can access or correct your Personal Information that is held by us; and

• how you may lodge a complaint and how We will deal with it.

You should read this Privacy Policy in conjunction with our Terms and Conditions of Use, which incorporate this Privacy Policy. You can find them here.

Information About Us

This Privacy Policy is intended to cover H.J. Heinz Company Australia Limited (Heinz Heinz) and where applicable includes its directors, employees, related bodies corporate and the following Kraft Heinz affiliates: Golden Circle Limited (Australia), Cerebos (Australia) Limited (Australia), Heinz Wattie’s Limited (New Zealand), Cerebos Gregg’s Limited (New Zealand) and Kraft Heinz Foods Company (United States Operating Entity). Were say “Heinz” or “Kraft Heinz”, “we”, “us” or “our” we are referring to Heinz or the Kraft Heinz affiliate responsible for processing your Personal Information.

We are regulated (as relevant) by the Privacy Act 1988 (Cth) (Privacy Act) containing the Australian Privacy Principles and the Spam Act 2003 (Cth).

Collection of Your Personal Information

“Personal Information” means any information about an identified individual, or an individual who is reasonably identifiable. It does not include information which you cannot link to a specific person, such as Aggregated Information, as described below. Your Personal Information is therefore information about and linked to you.

We may collect, use, store and transfer different kinds of your Personal Information, which could include:

• Identity and contact Information such as first name, last name, marital status, date of birth, gender, home address, billing address, email address and telephone numbers;

• Financial Information such as bank account and payment card details;

• Transaction Information which may include details of purchases you have made from us;

• Technical Information such as an internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website;

• Profile and Usage Information such as your website username and password, purchases or orders made by you, information about your interests, preferences, feedback and survey responses and how you use our website, products and services;

• Marketing and Communications Information such as your preferences in relation to receiving marketing from us and third parties and for the ways we communicate with you;

• Social Media Information such as likes, comments and other interactions with our social media accounts.

We also collect, use and transfer Aggregated Information such as statistical or demographic information. Aggregated Information may be derived from your Personal Information but is not Personal Information because it does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Information to find out how many users access a specific website feature.

If we combine or connect Aggregated Information with your Personal Information so that it can directly or indirectly identify you, we treat the combined data as Personal Information and will process it as set out in this Policy.

We may collect some items of Sensitive Personal Information (which could include information about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, information about your health or biometric data) but will only do so where this is provided to us by you (or is provided to us with your consent) or we believe it is necessary to fulfil our legal obligations or in connection with issues relating to our products or for some other reason that we will advise you of when we request your consent to collect the information.

How Your Personal Information is Collected

We use various methods to collect your personal information, including:

• Directly from you – where you give us Personal Information such as your Identity, Contact, and Marketing Information by filling in forms or by communicating with us by email, post, phone or otherwise. This includes Personal Information you provide when you: - apply to receive our products or services; - create an account on our website; - subscribe to our services or publications; - request marketing material to be sent to you; - enter a competition, promotion or survey; or - contact us on social media (such as Instagram, Facebook or Twitter); - directly interact with our social media accounts or advertising, such as by posting or liking posts and/or on our website such as by reviewing products, liking or downloading recipes; or - provide feedback or raise a concern or complaint. When you contact us by phone, email or social media we may keep a record of that communication.

• By automated means – when you interact with our website or social media accounts or platforms, we may automatically collect Technical Information about your equipment and browsing actions and patterns. We collect this Personal Information by using cookies and other similar technologies, which use small pieces of computer code to help us understand how consumers interact with our website and communications. We may also receive information about you if you visit other websites or social media accounts employing our cookies. Please see our Cookie Policy below for further details.

• From third parties and publicly available sources. In some instances, we may collect your Personal Information from various third parties that may include: - Technical Data from analytics providers such as Google; - other companies who have obtained your consent to share or sell it (such as consumer goods retailers or marketing partners engaged in selling consumer data); - Contact, Financial and Transaction Data from providers of technical, payment and delivery services.

Cookies Our Cookie Policy can be found Here

How We Use or Disclose Your Personal Information

We collect, use and disclose your Personal Information for a range of purposes where lawfully permitted. Most commonly, we will use your Personal Information for the following purposes:

• where necessary to establish and perform your agreement with us, such as where you buy products directly from us;

• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;

• where we need to comply with a legal or regulatory obligation.

Generally, we do not rely on consent as a legal basis for processing your Personal Information although we will obtain your consent before:

• sending third party direct marketing communications to you via email or text message;

• obtaining Contact Information from our third party partners;

• sending targeted advertising to you on social media platforms such as Instagram and Facebook.

You have the right to withdraw consent to marketing at any time by contacting our Privacy Team at PrivacyAU@kraftheinz.com

We may use your Personal Information for or in connection with the following purposes:

1. Where necessary to establish and perform your agreement with us, such as where you buy products directly from us;

2. Where necessary to comply with a legal obligation;

• in connection with any potential or actual corporate transaction or transfer of employment arising in relation to a business transfer or change of service provided in which case the Personal Information may only be processed to the extent permitted by the applicable law;

• compliance with applicable procedures, laws or regulations including in relation to retaining records or business activities or payment of taxes;

• to comply with our mandatory legal obligations, which can arise in a variety of ways such as in connection with health and safety, transfer of a business, regulatory investigations, in connection with legal proceedings or disclosure to a law enforcement agency;

3. Where it is necessary for our legitimate interests in connection with the purposes listed below, and where our interests are not overridden by your information privacy protection rights:

• the proper conduct and development of our business and operations;

• to notify you of recipes, products and services that may assist you by direct marketing including any special offers available;

• to personalize your experience when logged into the Heinz website; to deal with any queries;

• to verify or update your contact details;

• to improve the quality and level of our products and services;

• with our partners to help run our marketing campaigns and manage our owned marketing platforms;

• to aggregate with other data sources to better understand individual interactions with Heinz and other Kraft Heinz branded products and services;

• research including consumer and market preferences to assist with the operation and development of our business;

• assisting with the development of existing and creation of new Heinz and/or Kraft Heinz products and services;

• the manufacture of Heinz and/or Kraft Heinz products and the supply of those products to our customers;

• promotional and marketing activities (including running competitions and prize draws) in relation to Heinz and/or Kraft Heinz business and products;

• other disclosures required in the connection with promoting or marketing of Heinz, and other Kraft Heinz affiliate products or services;

• financial and other forecasting and modelling;

• operation, maintenance and development of our systems, networks and the equipment associated with or connecting to those systems and networks;

• development of our business through mergers, acquisitions, disposal and other corporate actions;

• dealing with actual and potential shareholders, investors and other stakeholders in our business;

• maintenance and protection of Heinz and Kraft Heinz physical and intellectual property and assets;

• protecting corporate and personal security (which may include use of CCTV and other visual or audio monitoring);

• recording, responding to, dealing with and resolving matters arising in respect of Heinz and/or Kraft Heinz products or staff;

• recording, responding to, dealing with and resolving actual or potential complaints from customers and consumers;

• investigations to ensure compliance with or identify/confirm any potential breaches of any applicable procedures, laws or regulations;

• establishing, exercising or defending legal rights;

• working with suppliers to whom we have outsourced business or other services;

• in connection with business acquisition, disposal or reorganisations other than where information is exchanged in connection with a legal obligation as set out above; and

• processing necessary for the purposes of other legitimate interests pursued by Kraft Heinz.

We may, where necessary for our business, contract various services associated with our functions and activities to third parties. This may involve the disclosure and sharing of your Personal Information to other persons or organisations that we engage on our behalf or to other companies within the Kraft Heinz affiliates described in the Information About Us section further above subject to this Privacy Policy and the provisions of the Privacy Act.

Please note that these where a supplier’s countries’ laws may not provide the same privacy protections as Australian law, we ensure those suppliers are contractually required to protect your Personal Information in accordance with the Privacy Act. If you would like more information about our suppliers, please email us at PrivacyAU@kraftheinz.com.

Advertising and Promotional Offers from Us

We may use your Identity and Contact, Technical, Usage and Profile Data, including Identity, Contact and Profile Information we have received from data brokers and/or aggregators such as LiveRamp which have operations in a number of countries including the United States and United Kingdom to form a view on what we think you may want or need, or what kinds of products and services may be of interest to you. Combining information from multiple sources in this way is commonly known as “enriching data” or “profile building”. This is how we decide which products, services and offers to include in marketing messages we send. This process may involve automated decision-making to determine which marketing messages will be most meaningful to you. If you would not like us to use information from data brokers and/or aggregators to enrich the information, we have collected from you or if you would like to object to automated decision- making, please contact the Data Privacy Team at PrivacyAU@kraftheinz.com.

We will not use Sensitive Personal Information in building a profile about you unless you give us your consent to do so.

You can ask us to stop sending you email marketing messages at any time by clicking on the “unsubscribe” link within the message or by contacting the Data Privacy Team at PrivacyAU@kraftheinz.com.

We may also use your Identity, Technical, Usage, and Profile Data to help us understand the types of products and services that might be of interest to other consumers like you. To do this, we partner with digital media companies such as Meta, or digital media buying platforms such as The Trade Desk, to identify and deliver marketing messages to audiences of their consumers who share your characteristics, which are known as “lookalike audiences.” We will not use any Sensitive Personal Information we collect from you to create lookalike audiences unless you give us your consent to do so. Delivering advertising to you through lookalike audiences involves the use of automated decision-making to build the lookalike audiences and deliver marketing messages to them. If you would like to object to our use of automated decision- making, please contact the Data Privacy Team at PrivacyAU@kraftheinz.com.

Unsolicited Personal Information

Unless otherwise specified in this Privacy Notice, we generally only collect Personal Information directly from you. If we do receive your Personal Information without requesting it (unsolicited), we will treat such information in the same way as if we had asked for it, that is, in accordance with this Privacy Policy and the Privacy Act.

If within a reasonable time, we determine that the unsolicited Personal Information received by us is not reasonably necessary for one or more of our functions or activities or where it is it collected by unlawful and unfair means or without your consent, we will destroy or de- identify your Personal Information as soon as is practicable, but only if it is lawful and reasonable to do so and if the information is not contained in a government record.

Security of Your Personal Information

We take reasonable steps to protect your Personal Information from misuse, interference and loss and from unauthorised access, modification or disclosure. We do this by means of various physical and electronic security measures, including restricting physical access to Our offices and implementing several technological and security policies and procedures.

We may use servers outside Australia to process and store your Personal Information. A number of policies and procedures are in place to ensure the safety and secure storage of your Personal Information handled and stored by Us subject to this Privacy Policy and the provisions of the Privacy Act.

Data Retention

We are required by law to retain various types of records for different periods, depending on their contents.

We will therefore keep Personal Information for as long as we reasonably consider we may need to in connection with those obligations.

Where we no longer require your Personal Information for the purpose for which this information was collected, we will take all steps reasonable in the circumstances to destroy the information.

Use of Your Personal Information for Direct Marketing

We only use or disclose your Personal Information for direct marketing purposes (that is, to communicate with you directly to promote our goods and services which may include communications with you on other social media platforms such as Instagram and Facebook) when we have your permission to do so, or where you have a reasonable expectation that your Personal Information will be used for this purpose and where you have not opted out from Us contacting you.

If you decide you would not like to receive email marketing messages from Us, you can unsubscribe by clicking the “unsubscribe” link in Our email or if you would not like to receive other types of advertising you can unsubscribe when managing your subscription preferences when logged into your account or by sending Us an email at PrivacyAU@kraftheinz.com.

Access to Your Personal Information

You may request details of the Personal Information we hold about you be deleted or for it to be corrected, edited or have its processing restricted by writing to us. We will respond to your request within a reasonable period of time and give you access to the information in the manner requested by you if it is reasonable and practicable to do so.

If in the unlikely event that we deny you access to any Personal Information following an access request or provide you with access not in the manner requested by you, we will give you a written notice that will set out the reasons for the denial and the mechanisms available to you to complain about our refusal.

Where your consent has already been provided, you may withdraw consent to our use of your Personal Information at any time by notifying us at PrivacyAU@kraftheinz.com. We will respond to your request within a reasonable period of time.

We will take all reasonable steps to ensure that your Personal Information that is in our possession is accurate, up-to-date and complete. If you are aware that any of your Personal Information is inaccurate, incomplete or out of date, please inform us so that we can update our records.

Information About Our Complaints Resolution Process

If you have a complaint about the way we collect, store or handle your Personal Information please contact us via PrivacyAU@kraftheinz.com so that we may investigate

You can also contact The Office of the Australian Information Commissioner (OAIC) (https://www.oaic.gov.au(opens in a new window)) but we appreciate the opportunity to resolve your concern with you directly by contacting the Data Privacy Team.

Sale of Goods ANZ

The Terms and Conditions for Sale of Goods in ANZ can be found Here(opens in a new window).

Changes to the Privacy Policy

Our Privacy Policy is reviewed on a regular basis. We may change our policies and update the Privacy Policy from time to time. We may send you updated the Privacy Policy using methods we choose from time to time, and the most up- to-date copy will be published on our website at http://www.heinz.com.au(opens in a new window)

Enquiries

If you have any concerns or enquiries about how we deal with your Personal Information, you should contact us:

Data Privacy Team H.J. Heinz Company Australia Limited By email: PrivacyAU@kraftheinz.com Level 27, 2 Southbank Boulevard Southbank, VIC 3006 Australia