Privacy statement concerning Valio’s consumer customers

In this privacy statement, we describe how Valio Ltd (”Valio” or “we“) processes consumers’ personal data for the purpose of providing online and mobile services, customer communication and marketing purposes, in connection with consumer research and surveys, and for organizing events and campaigns. Please note that the processing of personal data of consumers who have submitted customer feedback is described in a separate privacy notice, which you can find here. In addition, information on how we process personal data collected through cookies on the valio.com website can be found here.

We may update this privacy notice from time to time, for example when legislation changes. If we update this notice, we will inform you either by posting a notice on our online or mobile service or by email.

1. Controller

Valio Ltd (Business ID: 0116297-6)

Meijeritie 6

FI-00370 Helsinki

2. Data Protection Officer’s Contact Details

Valio Oy / Data Protection Officer

Meijeritie 6

00370 Helsinki

Email: privacy.office@valio.fi

If you have any questions about the processing of your personal data, you can contact us by email at privacy.office@valio.fi.

3. For what purposes and on what legal basis do we process your personal data?

We process your personal data on the basis of a contract for the following purposes:

Purpose of processing	What does this mean?
Providing and maintaining Valio’s online and mobile services for registered users	In order for you to use our online and mobile service, you must provide us with your email address and create a password so that we can create and maintain your user account, enable login, provide the service, and receive service-related communications. You can also log in to the service through your Google, Facebook or Apple account, in which case we identify you using the email address associated with the account you use.
Sending newsletters	We send you the newsletter you have subscribed to by email. The marketing automation system we use to send the newsletter automatically collects data on the opening of the newsletter and clicks on the links it contains for campaign reporting and analytics purposes. You can unsubscribe at any time via the link in the newsletter.
Other electronic direct marketing (emails and push notifications)	We send you current information about our new products, recipe tips, or other marketing messages by email or push notifications if you have given your consent to electronic marketing. The marketing automation system we use to send emails automatically collects data on the opening of emails and clicks on the links they contain for campaign reporting and analytics purposes. Sending push notifications also requires that you have enabled them in your device settings. You can withdraw your consent at any time.
Targeted marketing	We show you advertisements and content that better match your interests. Targeting may be based on, for example, the use of our mobile and online service (including the filters and selections you have made in the service) and the newsletter you have subscribed to. We display targeted advertisements both in our own and our partners’ channels (such as social media services). You can read more about targeted marketing in section 9 of this privacy notice. Cookie-based ad targeting is based on the consent you have given for the use of cookies.
Personalising recipes offered by the online and mobile service based on your selections (e.g. gluten-free, egg-free, vegetarian, lactose-free)	You can select personalised content in our service based on your dietary preferences or restrictions. You can remove your selections at any time.

We process your personal data on the basis of our legitimate interest for the following purposes:

Purpose of processing	What does this mean?
Other personalisation of online and mobile services	We use information collected from the use of our services to personalise the service so that we can offer you the most interesting content possible. For example, if you frequently browse baking-related recipes, we may offer you more baking-related recipes in the service.
Planning and developing online and mobile services	We use information collected from the use of our services so that we can improve our services and develop new features.
Product and service development	We monitor and analyse how our services are used (e.g. which pages and recipes are popular). We use this information to plan and develop our services and new products.
Organising events and campaigns	If you register for or participate in an event or campaign we organise, we process your data for the purpose of organising the event or campaign, creating content, and collecting feedback. To the extent that food is served at an event we organise, we may collect information about your food allergies on the basis of your consent.
Conducting customer surveys and consumer research	We use data from customer surveys and consumer research in which you have participated. Through surveys and consumer research, we develop our products, services, and customer experience. The results of consumer research are reported to us in aggregate form as a rule, so that individual consumers cannot be identified.
Creating customer segments and profiles for the purpose of targeted content and marketing	We may combine information obtained from various sources (including information about the newsletters you have subscribed to, information collected from the use of our service, information you have provided about your interests, and information collected through cookies based on your consent) and create customer segments so that we can offer you interesting content in our service. If you have given your consent to marketing, we may use customer segments and profiles for marketing purposes. You can object to the processing at any time.
Providing an AI-powered search function on the valio.fi website and storing log data related to search queries to investigate and prevent misuse	We process search queries made through the AI-powered search feature of our online service and related log data on our servers to prevent and investigate misuse and to ensure the technical operation of the service. Search queries may contain personal data if you enter it in the search field. However, searching for certain information is blocked in the search function. In addition, search queries are subject to an anonymisation process that removes any personal data before the data is transmitted to external service providers. Anonymisation takes place on the web server before the data is forwarded.

We process your personal data on the basis of a legal obligation for the following purpose:

Processing notifications concerning content suspected of being illegal

We process the information you have reported through the notification form for the purpose of processing and responding to content notifications in accordance with the EU Digital Services Act.

4. Note on the Use of Cookies

We use cookies and similar technologies in our online and mobile services. We may combine information collected through cookies with the information described in this privacy notice, for example for the purpose of targeted marketing and profiling. In such cases, the processing and combination of information collected through cookies is based on your consent. We describe in more detail in a separate cookie notice what cookies we use and for what purposes.

5. Profiling

In connection with the service personalisation and targeted marketing described above for users registered in our online or mobile service, we may classify or profile you based on the content selections you have provided to us (recipe filters, interests) or based on your browsing activity in our service. In such cases, we may use profiling to offer you content of interest in our services and to target content of interest to you in our own and third-party channels.

We consider that the profiling we carry out does not have legal effects or similarly significant effects on you as referred to in the General Data Protection Regulation. You can change your content selections and prohibit profiling in the service at any time.

6. What personal data do we process?

Data Subjects	Data Processed
Users logged in to the online or mobile service	• Your email address, password, and username; • The email address of your Google, Facebook or Apple account and your Facebook profile picture, if you log in to our online or mobile service through one of the aforementioned accounts; • Images and content you have saved to the service, such as recipes, notes and shopping lists, and the content selections you have made (recipe filters, interests); • Device identifier and other technical identifiers; • Log data generated from the use of the service and analytics concerning the use of the service (information about which recipes you have browsed, error analytics); and • Information about marketing consents or objections you have given.
Newsletter subscribers	• Your email address; • Newsletter(s) you have subscribed to; • Interests you have listed; and • Information about whether you have opted out of or consented to electronic direct marketing messages. • When the newsletter is opened and links within it are clicked, the marketing automation system automatically collects the following data: IP address, geolocation data derived from the IP address, and information about the opening of the newsletter and clicking of links.
Recipients of other electronic direct marketing	• Your email address and/or device identifier; • information about whether you have opted out of or consented to electronic direct marketing messages; and • data automatically collected by the marketing automation system when emails are opened and links within them are clicked (IP address, geolocation data derived from the IP address, and information about the opening of emails and clicking of links).
Users of the AI-powered search function (valio.fi website)	• Search queries and related log data as well as technical identifiers (such as IP address).
Persons submitting notifications concerning content suspected of being illegal	• Name and email address • Description of the subject of the notification and the grounds for the notification
Persons who have registered for or participated in events and campaigns	• Email address, name and other contact details as necessary; • Your diet and any food allergies (for events); • Other information you have provided in connection with the event or campaign; • Photographs, videos or audio recordings from events; and • Information about whether you have opted out of or consented to electronic direct marketing messages
Persons who have participated in research and surveys	• Email address, name and other contact details as necessary; • Your diet and any food allergies (for certain research); • Photograph, video or audio recording of you (for research); and • Other information you have provided in connection with the research or survey.

7. Where do we obtain your personal data?

We collect your personal data, for example, when you register as a user of our service, use our services, subscribe to our newsletter, or give us marketing consent. In connection with the use of services, we may receive your personal data from third parties (Google, Meta, Apple) if you log in to our service through your Google, Facebook or Apple account.

We collect your personal data when you register for or participate in events we organise, campaigns, surveys or consumer research we carry out. With regard to events and campaigns, we may collect your personal data from your friend or another person who registers you for an event or campaign. In addition, with regard to research you have participated in, we collect your personal data from our partners who carry out consumer and other research.

8. Recipients of Personal Data

Your personal data is processed only by those of our employees within the Valio Group whose job duties require it. In addition, personal data is processed by the service providers we use from time to time and who act on our behalf, such as IT service providers, service providers carrying out marketing and analytics activities, and partners involved in organising events and campaigns. You can obtain information about the partners to whom we disclose your personal data by contacting us as described in section 2.

If you log in to our service through your Google, Facebook or Apple account, Google, Facebook or Apple may collect your data in accordance with their applicable privacy policies. Valio is not responsible for how Google, Meta or Apple process your personal data.

If you participate in an event we organise, we may disclose your personal data on a case-by-case basis to, for example, restaurants, hotels and other similar partners organising events, who process your personal data as independent controllers. We disclose your personal data to authorities on a case-by-case basis if there is a legal basis for doing so.

9. Targeted Advertising and Marketing Partners

We show you targeted digital advertising in cooperation with our marketing partners if you have given your consent to this. The purpose of targeted advertising is to show you more relevant advertisements about Valio’s products and services in digital channels, such as websites and social media services. We create target groups, for example, from users who are interested in baking or vegetarian food.

Please note that even if you have not given your consent to targeted advertising, you may still see our general advertising in digital channels.

For the purpose of targeted advertising, we provide our marketing partner with your email address in an encrypted, mathematically converted form (a so-called hash value). The hash value is used to compare it against the marketing partner’s own user data so that advertising is targeted to the right target groups. If the hash value does not match the marketing partner’s user data, the marketing partner deletes the hash value. We do not disclose your email address as such to marketing partners.

Our marketing partner does not learn the basis on which each targeted advertising target group has been created, nor do they receive any other data about you from us.

The marketing partners we use include, for example, Sanoma Oyj, Meta Platforms Ireland Limited, Google Ireland Limited, and TikTok Technology Limited. You can review their privacy policies at the following links:

To the extent that we act as joint controllers with our marketing partner in the targeting of advertising, we have entered into joint controllership agreements with the relevant partners. The marketing partner may also process data generated from the display of advertisements for its own purposes, such as the development of its own service. In such cases, the marketing partner acts as an independent controller and is solely responsible for informing data subjects about the processing of personal data.

You can withdraw your consent to targeted advertising at any time from the settings of the online or mobile service (Profile à Settings à Consents and notification settings).

10. Do we transfer your data outside the EU or the EEA?

Some of our subcontractors have access to your personal data from outside the EU and EEA. In such situations, we ensure the lawfulness of the transfer of your personal data by one of the following means:

by verifying whether the European Commission has issued an adequacy decision regarding the level of data protection in the relevant country;
by ensuring appropriate safeguards for the transfer as required by law, such as signing the standard contractual clauses approved by the European Commission and, where necessary, carrying out a transfer impact assessment; or
by ensuring the lawfulness of the transfer by other means, such as requesting your explicit consent for the transfer of your data.

11. How long do we retain your personal data?

In the table below, we have described how long we retain your personal data for different purposes:

Purpose of processing	Retention period
Providing online and mobile services to registered users	We process your personal data as long as you use the service and you have not asked us to delete your account or deleted your account yourself. If your account has been inactive for two (2) years, we will automatically delete or anonymise your personal data.
Marketing communications (incl. newsletter subscriptions and other electronic direct marketing) and profiling	Until you cancel your newsletter subscription and/or withdraw your marketing consent, or until you prohibit the use of your data for profiling. Data automatically collected when emails are opened and links are clicked (IP address and geolocation data) is retained in the marketing automation system for the duration of the marketing consent or newsletter subscription. Data is automatically deleted if you have not been active for two (2) years. Please note that after this you may still receive cookie-based targeted advertising if you have given your consent to the use of such cookies.
Organising campaigns and events	If you have registered for an event or campaign we organise, we process your personal data for the duration of the event or campaign, after which we delete the personal data no later than six months after the end of the event or campaign. Please note that we have the right to publish the name and other possible details of the winner of a prize draw in accordance with the applicable rules of the draw.
Conducting research and surveys	If you have participated in a consumer research study or responded to a customer survey we have organised, we process your personal data for the duration of the research/survey and for one year thereafter, after which we delete or anonymise the personal data.
AI-powered search feature (valio.fi website)	We retain search queries made through the AI-powered search feature and related log data on our servers for a maximum of 30 days, after which the data is deleted or anonymised. Log data stored for the purpose of investigating and preventing misuse is retained in Microsoft Azure for a maximum of 90 days, after which the data is deleted. Search queries stored in your browser are under your control, and you can delete them from your browser settings. Search history is stored on your device for a maximum of one day.
Notifications concerning content suspected of being illegal	Notifications are retained for three (3) years from the completion of the processing of the notification, after which the data is deleted.

We retain your personal data for longer to the extent required by mandatory legislation, a legal claim directed against us, or a statutory or contractual limitation or complaint period. In such cases, we retain only the data required by law, the limitation or complaint period, or necessary for handling the legal claim, and delete other data.

We may use anonymised data for reporting and for the development of our services regardless of the retention periods mentioned above.

12. How do we ensure the security of your personal data?

We ensure the security of your personal data through appropriate administrative and technical safeguards. We have limited the scope of personal data processing to those persons whose job duties require the processing of the personal data in question. Access to the systems containing your personal data is granted only through individually assigned personal usernames and passwords.

13. What are your rights and how can you exercise them?

Under applicable data protection legislation, you have the right at any time to:

withdraw your consent to the extent that we process your personal data on the basis of your consent;
access your personal data (right of access);
request the rectification of inaccurate and incorrect personal data or the supplementation of your personal data;
object to the processing of your personal data to the extent that we process your personal data on the basis of legitimate interest;
request the erasure of your personal data;
request the restriction of the processing of your personal data (for example, for the period while you are waiting for a response to your request for rectification of your personal data); and
receive the personal data you have provided to us in electronic form and transfer it to another controller.

As a user logged in to the online or mobile service, you can manage your consents and object to profiling from the online or mobile service: Profile à Settings à Consents and notification settings. If you wish to delete your user account in the online or mobile service and the data it contains (username, password, search filters, preferences and saved recipes), you can delete them by selecting from the online or mobile service: Profile à Settings à Delete account.

Otherwise, you can submit a request to exercise your rights by contacting us by email at privacy.office@valio.fi. We may ask you to verify your identity or clarify your request before fulfilling it. We may also refuse to fulfil your request on a ground provided for in data protection legislation, in which case we will inform you of the relevant ground.

14. Your Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with the relevant supervisory authority if you consider that we have not processed your personal data in accordance with applicable data protection legislation. You can lodge a complaint with the supervisory authority of the member state where your habitual residence or place of work is located, or where the alleged infringement of data protection legislation has occurred.

Version 1.4, updated in August 2026.

Changes to the privacy statement:

August 2026: We have updated the instructions for exercising data subjects’ rights and added the contact details of Valio’s Data Protection Officer to the privacy notice. In addition, we have added information about the AI-powered search function on the valio.fi website, the processing of notifications concerning content suspected of being illegal, and the data processed in connection with the opening of newsletters. In these respects, the updates concern the purposes of processing, the personal data processed, and the retention periods.

November 2025: We have merged the privacy notice for Valio’s mobile application and the privacy notice for Valio’s consumer customers. We have added the creation of customer segments and profiles for the purpose of targeted marketing to the purposes of processing. We have added a description of the implementation of targeted marketing in third-party channels. We have created tables for the processing purposes, legal bases, and retention periods of personal data.

February 2023: We have made the following changes to the privacy notice: updated the notice to cover the processing of personal data in Valio’s new mobile application.

February 2022: We have made the following changes to the privacy notice: updated the contact details section and removed the reference to the Privacy Shield framework.

December 2019: We have made the following changes to the privacy notice: added a reference to the disclosure of personal data based on law; updated the privacy notice with regard to the transfer of personal data; added extensions to the retention period of personal data due to statutory, legal claim, or complaint/limitation period requirements; clarified the language of the notice and condensed the content to improve readability.