www.oatly.com Open in urlscan Pro
2620:1ec:4a::28  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Skip to contentSkip to footerAccessibility Statement
Cookies!

Cookies go nicely with oat drinks. As it happens, the digital kind does too. So
is it okay if we use cookies on this site, including functional, analytical and
advertising ones? What’s cookies?

Ok with meNo thanks
 1. Oatly
 2. Privacy Policy


Back to canvas


PRIVACY POLICY



At Oatly we believe in the importance of protecting personal information and an
individual’s right to privacy and integrity.
 
This privacy policy explains how we collect and process your personal data when
you are in contact with us. It also outlines your rights and how you can
exercise them.  

You are always welcome to contact us if you have any questions at
info@oatly.com.


WHO IS RESPONSIBLE FOR THE PERSONAL DATA WE COLLECT? 

Oatly AB, 556446-1043, P.O Box 588, 201 25 Malmö, Sweden, is the data controller
responsible for the processing of personal data described in this privacy
policy.  


WHAT IS PERSONAL DATA AND WHAT CONSTITUTES THE PROCESSING OF PERSONAL DATA?

Personal data refers to any information that can be linked directly or
indirectly (together with other information) to a natural, living person. This
means that information such as name and contact details, images, audio
recordings, IP addresses and competition entries is classified as personal data
if it can be linked to a natural person.

Any action taken with personal data is called processing, regardless of whether
it is carried out in an automated manner or not. Examples of common processing
procedures are collection, recording, organization, structuring, storage,
adaptation, transfer or erasure.




WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU AND FOR WHAT PURPOSE (WHY)?

Purpose  

To handle complaints and other consumer matters.   

Processing that is carried out

 * Communication and response to complaints and other issues related to consumer
   contact (via telephone, letter or digital channels, including social media)
 * Investigation of complaints and questions
 * Eventual dispatch of compensation  

Category of personal data

 * Name
 * Contact details (address, email and telephone number)
 * Your correspondence
 * Details of purchase date, place of purchase, possible error/complaint
 * Health data (e.g.   
   allergic reactions and health conditions that you inform us about)



Legal basis: Legitimate interest. The processing is necessary to meet our and
your legitimate interests in dealing with complaints and consumer issues.  

Storage period: Personal data relating to complaints and consumer issues is
stored for no longer than two years.   



--------------------------------------------------------------------------------



Purpose  

To carry out  competitions and manage entries therein.  

Processing that is carried out

 * Communication before and after participation in a competition (e.g.
   confirmation of registration, questions, contact with winners)
 * Handing out of winnings 

Category of personal data

 * Name
 * Contact details (address, email and telephone number)
 * Personal identity number if the winnings are to be taxed by the winner  



Legal basis: Legitimate interest. The processing is necessary to meet our and
your legitimate interests in handling your participation in competitions and
events.

Storage period: During the time that the competition/event is in progress
(including any evaluation). In the event of profit tax payable by the winner,
the filing rules of the accounting act shall apply.   



--------------------------------------------------------------------------------



Purpose  

Photography in connection with Oatly’s participation in events, festivals, trade
fairs, etc.  

Processing that is carried out

 * Photographing
 * The storage of photographs taken
 * The use of photographs in social media marketing campaigns globally 

Category of personal data

 * Photography
 * Time of photography   



Legal basis: Consent in connection with photography and a legitimate interest
with regards to so-called mingle images in connection with Oatly’s participation
in events, festivals and trade fairs.

Storage period: 5 years.  



--------------------------------------------------------------------------------



Purpose  

To handle incoming requests for sponsorship.  

Processing that is carried out

 * Communication in connection with incoming sponsorship inquiries (e.g.
   confirmation of incoming inquiry, questions, response)
 * Selection of sponsorship activities

Category of personal data

 * Name
 * Contact details (address, email)  



Legal basis: Legitimate interest and contractual duties in cases where sponsor
agreements has been entered. The processing is necessary to meet our and your
legitimate interests in handling sponsorship matters.

Storage period: As long as is necessary to handle the sponsorship case, but no
more than 1 year. Accounting documents are filed in accordance with the
regulations in the accounting act. Sponsor agreements are stored as long as
either party may take any legal action under the agreement.  



--------------------------------------------------------------------------------



Purpose  

To communicate with you as a subscriber of any of Oatly's newsletters.

Processing that is carried out

 * Collection of addresses in order to mail out our newsletters
 * Storage of addresses in order to mail out our newsletters
 * Newsletter mailouts

Category of personal data

 * Name
 * Address (postal address for postal mailouts, email address for electronic
   mailouts)
 * Date of birth (yy,dd,mm)  



Legal basis: Consent. The consent is voluntary and you can withdraw your consent
at any time by unsubscribing. Legitimate interest. The processing is necessary
to meet our and your legitimate interests in the mailing of our newsletters.

Storage period: Until the person unsubscribes.  



--------------------------------------------------------------------------------



Purpose  

To communicate with you as a recipient of press releases from Oatly.

Processing that is carried out

 * Collection of addresses in order to mail out our press releases
 * Storage of addresses in order to mail out press releases
 * Press release mailouts   

Category of personal data

 * Name
 * Email



Legal basis: Legitimate interest. The processing is necessary to meet our and
your legitimate interests in the mailing of press releases from Oatly.

Storage period: Until the person unsubscribes.  



--------------------------------------------------------------------------------



Purpose  

To offer you as a board member or an auditor access to information through our
board portal.  

Processing that is carried out

 * Creating a user account
 * Access control
 * Notification, when new data has been uploaded to the portal
 * Storage of data 

Category of personal data

 * Name
 * Social security number
 * Company
 * Title
 * Contact information (e.g. email, address, phone number)  



Legal basis: Legitimate interest. The processing is necessary to meet our and
your legitimate interests in providing financial and corporate information.

Storage period: As long as your assignment is going and then until limitation
periods for legal action expire.  



--------------------------------------------------------------------------------



Purpose  

To handle visits to Oatly’s production facilities correctly, efficiently and
safely (e.g. fire protection and quality issues). 

Processing that is carried out

 * Visitors register their arrival and departure
 * The personal data is stored and includes data confirming that visitors to the
   production facility have read and accepted Oatly’s quality standards. 

Category of personal data

 * Name
 * Company
 * Email
 * Mobile
 * Telephone
 * Photography   



Legal basis: Legitimate interest. The processing is necessary to meet our and
your legitimate interests in providing a safe and efficient visit.

Storage period: 2 years.  



--------------------------------------------------------------------------------



Purpose  

Camera surveillance at targeted areas of our business premises, such as
entrances to office space, plants and the warehouses to prevent accidents, and
to prevent, investigate and expose possible intrusion and criminal activity.   

Processing that is carried out

 * Camera surveillance at Oatly’s production facilities, both indoors and
   outdoors.
 * Camera surveillance at entrances to office spaces, both indoors and outdoors.
 * The personal data is stored and includes data confirming that visitors to the
   production facility have read and accepted Oatly’s quality standards. 

Category of personal data

 * Video recording



Legal basis: Legitimate interest. The processing is necessary to meet our and
your legitimate interests in preventing accidents and to prevent, investigate
and expose possible intrusion and criminal activity.

Storage period: 7 days.



--------------------------------------------------------------------------------



Purpose  

To handle the necessary permissions when you, as entrepreneur, have temporarily
work at our production facility.

Processing that is carried out

 * To verify the necessary permissions
 * Filing of the permissions  

  

Category of personal data

 * Name
 * Personal identity number (for driving permission)
 * Company
 * Validity



Legal basis: Legal obligation.

Storage period: Stored during the validity period and for a maximum of one year.
 



--------------------------------------------------------------------------------



Purpose  

To handle the necessary contact information regarding our customers and
suppliers.

Processing that is carried out

 * Collection of contact information
 * Use of contact information
 * Storage of contact information

Category of personal data

 * Name
 * Position
 * Company
 * Contact information (e.g. email, company address, phone number)  



Legal basis: Agreement and legitimate interest.

Storage period: Stored during the time of the agreement and for a maximum of
five years.  



--------------------------------------------------------------------------------



Purpose  

To handle applications for published job vacancy.  

Processing that is carried out

 * Collection of applications and the appraisal/disposal in relation to the
   requirements in job advert
 * Review and selection of applicants for interview
 * Candidates are called for an interview
 * Potential tests of candidates and reference check
 * Selection of candidate
 * The application documents of dismissed candidates are deleted  

Category of personal data

Oatly has no specific requirements regarding which personal data is to be
included in an application. Usually includes:  

 * Name
 * Personal identity number/Date of birth
 * Contact details (address, email and telephone number)
 * CV data  



Legal basis: Legitimate interest. The processing is necessary to meet our and
your legitimate interests in handling recruitment applications.

Storage period: The application documents of dismissed candidates are stored
until the expiration of the appeal period, for example in accordance with
anti-discrimination legislation.  



--------------------------------------------------------------------------------



Purpose  

To handle incoming spontaneous applications/letters of interest.  

Processing that is carried out

 * Answers to the applicant saying that we do not currently have the opportunity
   to handle the letter of interest and recommend that the candidate monitors
   vacancies published on our website.
 * Following that, the letter of interest and associated documents are deleted.
     

Category of personal data

Oatly has no specific requirements regarding which personal data is to be
included in spontaneous job application. Usually includes:

 * Name
 * Personal
 * Identity number/Date of birth
 * Contact details (address, email and telephone number)
 * CV data  



Legal basis: Legitimate interest in responding to a spontaneous application to
Oatly.

Storage period: Canceled immediately following response to the sender as above,
unless consent has been collected for the purpose of storing the application.  




FROM WHAT SOURCES DO WE RETRIEVE YOUR PERSONAL DATA?

In addition to the information you provide to us or that we collect from you
based on your purchases and how you use our services, we may also collect
personal data from someone else (third party). The data we collect from third
parties is address details obtained from public records in order to verify your
address.   


WHO DO WE SHARE YOUR PERSONAL DATA WITH?

We do not sell or trade your information to third parties but we may disclose
your data to other companies, such as data processors, when it is necessary for
us to offer our services or fulfill our commitments to you. Data processors are
companies that process data on our behalf and according to our instructions.

When your personal data is shared with a data processor, it is only for purposes
that are compatible with the purposes for which we have collected the data. We
have written agreements with all our data processors through which they
guarantee the security of the personal data processed and undertake to comply
with our security requirements as well as restrictions and requirements
regarding the international transfer of personal data.

Personal data may also be disclosed by us if it is necessary to comply with
applicable legal or governmental requirements, to safeguard our legal interests
or to detect, prevent or be attentive to fraud and other security or technical
issues.

We also share your personal data with companies that are independent data
controllers. Sharing data with an independent data controller means that it is
not us who control how the data will be processed.

When your personal data is shared with a company that is an independent data
controller, that company’s privacy policy and personal data management
guidelines apply.


WHERE DO WE PROCESS YOUR PERSONAL DATA?

Personal data may be transferred between different companies within Oatly group.

We always strive for the processing of your personal data to take place within
the EU/EEA. However, in case of systematic support and maintenance, we may be
required to transfer the data to a non-EU/EEA country, for example if we share
your personal data with a data processor who, either themselves or through a
subsupplier, is established or stores data in a non-EU country. In this case,
the data processor shall only be granted access to data relevant to the purpose
(e.g. log files). Regardless of the country in which your personal data is
processed, we take all the necessary legal, technical and organizational
measures to ensure that the level of protection is the same as within the
EU/EEA.

In cases where personal data is processed outside the EU/EEA, the level of
protection is guaranteed either by a decision of the EU Commission that the
country concerned ensures an adequate level of protection or through the use of
so-called appropriate safeguards. Examples of appropriate safeguards are:
Approved code of conduct in the destination country, Standard Contractual
Clauses (SCCs) or Binding Corporate Rules (BCRs).  


HOW LONG DO WE STORE YOUR PERSONAL DATA?

We will never store your personal data beyond what is necessary for each
purpose. Please refer to the specific storage period for each purpose.  


WHAT ARE YOUR RIGHTS AS DATA SUBJECT?

Right of access (Subject Access Request): We are always open and transparent
about how we process your personal data, and if you require further information
regarding which personal data we process about you in particular, you can
request access to the data. Please note that if we receive a subject access
request, we may ask for additional data to ensure the effective handling of your
request and that the information is given to the correct person.

Right to rectification: If your personal data is incorrect, you may request its
correction. Within the stated purpose, you also have the right to supplement any
incomplete personal data.

Oatly may also, on its own initiative, correct, disassociate, delete or
supplement data that is found to be incorrect, incomplete or misleading.

Right to erasure: You may request the deletion of the personal data we process
about you if:

 * The data is no longer necessary for the purposes for which it has been
   collected or processed.
 * You oppose a balance of interest that we have made based on a legitimate
   interest, and your reason for the objection weighs heavier than our
   legitimate interest.
 * You oppose processing for direct marketing purposes.
 * The personal data is processed in an unlawful way.
 * The personal data must be deleted to comply with a legal obligation we are
   subject to.
 * Personal data has been collected pertaining to a child (under 13 years) for
   which you have parental responsibility, and collection has been made in
   connection with the offer of information society services (e.g. social
   media).   

Please note that Oatly may have the right to deny your request if there are
legal obligations that prevent us from immediately deleting certain personal
data. These obligations are related to accounting and tax legislation, banking
and money laundering, and consumer law. It may also be possible that the
processing is necessary for us to determine, enforce or defend legal claims.
Should we be prevented from meeting a request for deletion, we will instead
block personal data from being used for purposes other than the purpose that
prevents the requested deletion.

Right to restriction: You have the right to request that our processing of your
personal data be limited when the processing is based on a legitimate interest.

You may, in some cases, have the right to demand that the processing of your
personal data is limited. By limitation, it means that the data is marked so
that in future it will only be processed for certain limited purposes.

The right to restriction applies, inter alia, to the fact that the data is
incorrect and relates to a request for it to be corrected. In such cases, you
may also request that the data processing be restricted during the time that the
data is being corrected.  
If processing is restricted, we may, in addition to storage, only process the
data in order to apply or defend legal claims to protect someone else’s rights
or if you have given your consent.

Direct marketing: You may object to the processing of your personal data for
direct marketing purposes by sending an email to info@oatly.com. Once we have
received your objection, we will discontinue the processing of your personal
data for that purpose, as well as cease all types of direct marketing actions.

Right to data portability: If our right to process your personal data is based
on your consent or performance of an agreement with you, you have the right to
request for the data that relates to you and which you have provided to us to be
transferred to another data controller (so-called data portability). A
prerequisite for data portability is that the transfer is technically feasible
and can be automated.  


HOW DO WE HANDLE PERSONAL IDENTITY NUMBERS?

We will only process your personal identity number when motivated by the
purpose, necessary for a secure identification or if there is any other worthy
reason. We always minimize the use of your personal identity number as much as
possible.


HOW IS YOUR PERSONAL DATA PROTECTED? 

We have taken appropriate technical and organizational security measures to
protect your personal data against unlawful and unauthorized processing, e.g. we
use IT systems to protect the privacy, integrity and availability of personal
data for which we are data controller.


THE NATIONAL DATA PROTECTION AUTHORITY IS THE SUPERVISORY AUTHORITY. WHAT DOES
THIS IMPLY?

The National Data Protection Authority is responsible for monitoring the
application of the legislation. If a person believes that a company is handling
personal data incorrectly, they can file a complaint with the National Data
Protection Authority. For cross-border processing, the Swedish Data Protection
Authority (IMY) will act as a lead supervisory authority since it is the
supervisory authority for the main establishment.  


CONTACT

Please do not hesitate to contact us at info@oatly.com if you have any questions
regarding this Privacy Policy, the processing of your personal data, or if you
wish to request subject access. We may be required to make changes to our
privacy policy. The latest version of our privacy policy is always available on
our website.

Oatly AB
Integritetspolicy - Oatly AB (SV)
Privacy statement - Oatly AB (ENG)

Oatly EMEA AB
Integritetspolicy - Oatly EMEA AB (SV)
Privacy statement - Oatly EMEA AB (ENG)

Havrekärnan AB
Integritetspolicy - Havrekärnan AB (SV)
Privacy statement - Havrekärnan AB (ENG)

Havre Global AB
Integritetspolicy - Havre Global AB (SV)
Privacy statement - Havre Global AB (ENG)

Cereal Base CEBA
Integritetspolicy - Cereal Base CEBA AB (SV
Privacy statement - Cereal Base CEBA AB (ENG)

SPAM BY OATLY CLICK HERE TO SUBSCRIBE SPAM BY OATLY SAVE 100% ON OUR FREE
NEWSLETTER SPAM BY OATLY CLICK HERE TO SUBSCRIBE SPAM BY OATLY YESTERDAY’S NEWS
TODAY!
SPAM BY OATLY CLICK HERE TO SUBSCRIBE SPAM BY OATLY SAVE 100% ON OUR FREE
NEWSLETTER SPAM BY OATLY CLICK HERE TO SUBSCRIBE SPAM BY OATLY YESTERDAY’S NEWS
TODAY!
Dig deeper
 * Community
 * Sustainability
 * Careers
 * For Investors
 * Privacy Policy
 * Cookie Policy
 * Contact
 * Accessibility

Be social
 * facebook
 * twitter
 * instagram
 * youtube
 * tiktok