Privacy policy

1. Introduction

This Privacy Notice explains how Once Upon a Farm Switzerland GmbH, c/o Treforma AG, Grabenstrasse 25, 6340 Baar, Switzerland, a subsidiary of Once Upon A Farm PBC, 2111 San Pablo Avenue, Berkeley CA 94702 (“we”, “us”, “our”) collects, uses, discloses, processes and protects your personal data when you visit our website at www.onceuponafarmorganics.co.uk (the “Website”). This notice is intended for users located in the European Union (EU) and the United Kingdom (UK) and is designed to comply with the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK General Data Protection Regulation (UK GDPR),the Data Protection Act 2018 and the Swiss Data Protection Act (Schweizer Datenschutzgesetz – revDSG).

Under the Swiss Data Protection Act, the processing of personal data is carried out in accordance with the principles of lawfulness, proportionality, and good faith. We take care to ensure that no unlawful infringement of privacy occurs.

As used in this privacy notice, “personal data” means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Our Website is not intended for use by children under the age of 16. We expect that any use of our Website, will be accessed and chaperoned by a parent. We do not knowingly collect, use or process personally identifiable information from children under 16. If you are under the age of 16, do not use or provide any information on our Website. If we learn we have collected or received personal data from a child under the age of 16 without verification of parental consent, we will delete that information as soon as possible. If you believe we have any information from or about a child under 16, please contact us at hello.europe@uponafarm.com.

Please read this privacy notice carefully to understand our practices regarding your personal data and how we will treat it.

2. Data Controller

Once Upon a Farm Switzerland GmbH is the data controller regarding the collection and processing of your personal data collected when visiting and using the services provided via our Website. If you have any questions concerning the collection, use and processing your personal data, you may contact us at

Postal address: Once Upon a Farm Switzerland GmbH, c/o Treforma AG, Grabenstrasse 25, 6340 Baar, Switzerland

Email address: privacy.europe@uponafarm.com

Our data protection officer can be contacted at: Tatel Velásquez, Once Upon a Farm Switzerland GmbH, c/o Treforma AG, Grabenstrraße 25, 6340 Baar, Switzerland; email address: tatel.velasquez@uponafarm.com

Individuals and the data protection supervisory authority (“ICO”) in the UK may also contact our UK data protection representative according to Article 27 GDPR:

DP Data Protection Services UK Ltd., Attn: [Once Upon a Farm, PBC]

16 Great Queen Street, Covent Garden, London, WC2B 5AH

United Kingdom

www.dp-dock.com

uponafarm@gdpr-rep.com

3. What Personal Data We Collect and for What Purposes We Use Them

When visiting our Website, we may collect and process the following categories of personal data for the purposes outlined below:

(a) Technical Data

When you access and use our Website, we collect and process certain Technical Data that is mandatory for the functioning, provision and use of our Website. This Technical Data, is collected automatically and includes your IP-address, requested websites/data, referrer URL, operating system, browser type, language and version of Your browser, time and data of Your request, amount of data transferred, HTTP status code as well as the website from which You are coming ("Technical Data"). We process and use this Technical Data solely for the purpose of providing our Website to you, to ensure the security and functionality of it and to evaluate its utilization.

The legal basis for these processing operations is Art. 6 (1) lit. f) GDPR, Art. 6 (1) lit. (f) UK GDPR.

(b) Contact Data

When you use the contact form on the “Contact us” page on our Website and send any inquiries to us, we collect your name, address (if provided), email address and phone number (if provided) (the “Contact Data”) for the purpose of responding to your inquiries and provide you with the information requested. We may also use your Contact Data for the purposes of notifying you about changes to our Website, and to protect our intellectual property rights, trade secrets and to enforce our terms and conditions.

The legal basis for the collection and processing of the Contact Data is our legitimate interest in responding to your requests and inquiries and providing you with the requested information (Art. 6 (1) lit. f) GDPR, Art. 6 (1) lit. (f) UK GDPR). If your contact is associated with a contract we have concluded, collecting, processing and using your Contact Data serves the purpose of fulfilling the contract concluded with you and responding to your inquiries relating to that contract. In this event, the legal basis for processing your personal data and information is Art. 6 (1) lit. b) GDPR, Art. 6 (1) lit. (b) UK GDPR.

(c) Inquiry Data

We may also process any information and data you provide in connection with your inquiries sent through our contact form on the “Contact us” page or by email. This information may include, but is not limited to, information about the subject of your interest, products you are interested in or wish to receive further information on, products you have purchased and the store and location where you purchased them, and any other information you are willing to provide when contacting us (the “Inquiry Data”).

The legal basis for the collection and processing of the Inquiry Data is our legitimate interest in responding to your requests and inquiries and providing you with the requested information (Art. 6 (1) lit. f) GDPR, Art. 6 (1) lit. (f) UK GDPR). Where your inquiry is associated with a contract we have concluded, collecting, processing and using your Inquiry Data serves the purpose of fulfilling the contract concluded with you and responding to your inquiries relating to that contract. In this event, the legal basis for processing your personal data and information is Art. 6 (1) lit. b) GDPR, Art. 6 (1) lit. (b) UK GDPR.

(d) Usage Data

When you access and browse our Website, we may collect information about your use and interactions with our Website. This Usage Data includes information about your browsing history, your search history, page views, how much time you have spent on pages on our Website, clicks, mouse movements, page scrolling behavior, interactions with our chat function, and whether you search on our Website or click on the information provided (the “Usage Data”). This information is collected through our own tracking technologies, including cookies and tracking pixels (further information can be found below in Section 7 and our cookie notice, which is accessible at:https://onceuponafarmorganics.co.uk/#consent-preferences. We use the Usage Data to analyze your interactions and the way you are using our Website, to provide you with a more personalized user experience, and to remember you when you return to our Website. We also use the Usage Data to provide you with information, which we deem more relevant for you, to improve your user experience on our Website and with our products, and to analyze and track the success of our marketing activities and to provide you with advertising which corresponds to your interests.

The legal basis for these processing operations is your prior consent pursuant to Art. 6 (1) lit. a) GDPR or Art. 6 (1) lit. (a) UK GDPR and the local transpositions of Art. 5 (3) ePrivacy Directive (Directive 2002/58/EC) regarding the use of cookies and other tracking technologies. You may withdraw your consent at any time with effect for the future without giving any reason and without affecting the lawfulness of the processing carried out prior to your withdrawal. You can exercise your right of withdrawal by using the “Contact us” section on our website or by sending us an email to the contact details mentioned in this privacy notice and, in terms of the use of cookies and other tracking technologies by using our consent management platform on our Website.

(e) Social Media Data

We may also collect certain personal data from you when you are visiting our Social Media pages. We operate Social Media pages on the following Social Media Platforms:

We use the technical platform and services of the providers for these Social Media Platforms. Please note that you use these platforms and their functions at your own risk. This applies in particular to the use of interactive functions (e.g., commenting, sharing, rating).

When you interact with our Social Media pages, we collect and process information and contributions on those sites (which may be also publicly available to other visitors of our Social Media pages), your user name in the Social Media Platforms, and the content you provide in your contributions (e.g. content of your comments, or if you like our posts or content). We may also receive certain statistical data about your interactions with our Social Media pages (e.g. number of visits or how long you are staying on our page) from the operators of the Social Media Platforms (the “Social Media Data”). We collect and use this personal data to interact and communicate with you, and to provide you with latest information about our Products. The legal basis for the collection and use of this information is our legitimate interest in operating a Social Media account to directly interact and communicate with you and to provide you with the latest information about our products (Art. 6 (1) lit. f) GDPR, Art. 6 (1) lit. (f) UK GDPR).

In addition to the processing of your personal data for our own purposes you should note and take into account that when visiting our Social Media pages, the providers of the Social Media Platforms use and process your personal data (e.g. you IP-Address, account names, interactions on the platforms such as commenting on posts, information stored on your device in the form of cookies, content you are posting on our Social Media pages) for their own purposes and that we do not control or influence what personal data is collected or processed by them for which purposes. These purposes may however include that the providers of the Social Media Platforms provide you with personalized and targeted advertising across the internet.

In this context, you should also take into consideration that the providers of the Social Media Platforms may transfer, process and store your personal data in countries outside of the EU/EEA and the UK. These countries may include but are not limited to the USA or China. Despite careful selection and commitment of these service providers, the high level of data protection in the European Union may not necessarily be guaranteed in these third countries. For example, if data is transferred to the US or China, despite appropriate security measures, there is a risk that your data may be processed by government bodies and authorities for control and surveillance purposes without providing you with effective legal remedies or data subject rights as provided for in the GDPR, or without these being enforceable. With regard to transfer, storage, and transmission of personal data to the US, providers (especially Meta) have committed themselves to the EU-US Data Privacy Framework and are certified accordingly. You can check whether a provider is certified on the following website: https://www.dataprivacyframework.gov/list. Should a provider not be certified under the EU-US Data Privacy Framework, and if the EU Commission has not issued an adequacy decision for the third country in which the recipient is based, we have agreed upon the standard contractual clauses (“SCCs”) provided by the European Commission with the relevant provider. The purpose of these SCCs is to implement appropriate safeguards for the data transfer and to ensure an adequate level of the protection of your personal data in that third country.

You should therefore carefully review and consider their data processing practices laid down in their respective privacy policies.

(f) Lead Generation / Email Marketing

Your Contact Data and Inquiry Data can also be used and processed for the purpose of generating leads for email marketing. For this purpose we may in particular use and process your name and email address as well as information provided in your Inquiry Data to contact you via email for marketing purposes. This includes that we send you email newsletters with current information on our products (e.g. Pouches), discounts, special offers, discount codes or information on new products and their release dates.

To subscribe to our newsletter, we use the so-called double opt-in procedure. This means that after you have registered, we will send you an email to the email address you provided, in which we ask you to confirm that you are the owner of the email address provided and that you wish to receive marketing communications. If you do not confirm your registration within 72 hours, your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you used and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

The legal basis to process your Contact Data and Inquiry Data for these purposes is your prior consent pursuant to Art. 6 (1) lit. a) GDPR or Art. Art. 6 (1) lit. (a) UK GDPR. You may withdraw your consent at any time with effect for the future without giving any reason and without affecting the lawfulness of the processing carried out prior to your withdrawal. You can exercise your right of withdrawal by using the unsubscribe link in the emails received, by using the “Contact us” section on our website or by sending us an email to the contact details mentioned in this privacy notice.

To achieve these lead generation and marketing purposes, we cooperate with and have appointed our service provider and cooperation partner Klaviyo, who operates a direct marketing automation platform and service and processes your personal data on our behalf and on our instructions. Klaviyo has its registered office at Klaviyo, Inc.,125 Summer Street, Floor 6,Boston, MA, 02110,United States (“Klaviyo”). For these purposes Klaviyo may process your personal data in the USA, which may include your name, email address, the time of receipt, retrieval, and opening of the email, the IP address, the browser type, and the operating system of your device

With regard to transfer, storage, and transmission of personal data to the US, Klaviyo has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. Data Privacy Framework and the United Kingdom in reliance on the UK Extension to the EU-U.S. Data Privacy Framework. The EU Commission has adopted its adequacy decision for the EU-U.S. Data Privacy Framework, which permits the transfer of personal data from the EU to the U.S. without the necessity of additional safeguards. You can check whether a provider is certified on the following website: https://www.dataprivacyframework.gov/list. In addition, according to Klaviyo’s privacy notice, they are using the SCCs approved and provided by the European Commission. Further information on Klaviyo’s data processing practices can be found in Klaviyo’s privacy notices, accessible at https://privacy.klaviyo.com/policies/en/?name=klaviyo-privacy-notice.

The data processing agreement pursuant to Art. 28 GDPR/Art. 28 UK GDPR, which we have concluded with Klaviyo and which incorporates the SCCs can be accessed at https://www.klaviyo.com/legal/data-processing-agreement.

4. Children Data

We do not knowingly collect personal data from children under 16. If you believe we have collected such data, please contact us immediately using the contact details provided in this privacy notice or using the contact form in the “Contact us” section on our Website.

5. With Whom We Share Your Personal Data

In addition to the cases explicitly mentioned in this privacy notice, we will not share your personal data with any third party without your prior consent, unless such processing and data sharing is permitted and required by law.

(a) We may share your Technical Data, Contact Data, Inquiry Data and Usage Data with recipients engaged in the conduct of our business (e.g. auditors, financial institutions, insurance companies, legal advisors, regulators, parties involved in acquisitions of our company or the establishment of joint ventures) to the extent necessary for the provision of our website and associated services or for the sale of our business based on our legitimate business interest (Art. 6 (1) lit. f) GDPR, Art. 6 (1) lit. (f) UK GDPR).

(b) Your Technical Data, Contact Data, Inquiry Data, Usage Data and Social Media Data may also be shared with law enforcement authorities, regulators, authorities that prosecute administrative offenses subject to fines, tax authorities or harmed third parties and legal counsel. We may also disclose these categories of data to authorized third parties if we are permitted to do so by law (e.g. in the case of (third-party) information claims for intellectual property rights infringement) or if we are required to provide this information by administrative or court order. We may also share it, particularly with our legal counsel, if necessary to enforce our terms and conditions or other legal claims. The legal basis for the disclosure of your personal data is either our respective legal obligation to comply with binding disclosure requests or our obligations under applicable laws (Art. 6 (1) lit. c) GDPR, Art. 6 (1) lit. (c) UK GDPR) or our legitimate interest pursuant to Art. 6 (1) lit. f) GDPR or Art. 6 (1) lit. (f) UK GDPR. If there are indications of unlawful or abusive behavior, we have a legitimate interest in disclosing the data to enforce our terms and conditions, our own legal claims or those of third parties, and our interests outweigh your interest in protecting your personal data.

(c) In addition to the above, we may share your Technical Data, Contact Data, Inquiry Data, Usage Data and Social Media Data with our service providers who help us to perform contracts concluded with and to fulfill our contractual obligations towards you. These service providers include the following recipients:

Any transfer of your personal data to the recipients mentioned in the paragraph above is necessary for the provision of our Website, services and the fulfilment of any contracts concluded with you or justified by our legitimate interest in offering our Website and services to you (Art. 6 (1) lit. b) GDPR, Art. 6 (1) lit f) GDPR, Art. 6 (1) lit. (b) UK GDPR, Art. 6 (1) lit. (f) UK GDPR). If we use any such external service providers, we have carefully selected them beforehand as processors and verified their reliability in accordance with Art. 28 (1) GDPR and contractually obligated them within the scope of Art. 28 (3) GDPR to process all personal data provided by us exclusively in accordance with our instructions.

(d) We do not sell your personal data.

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the EU, including the United States. Where we transfer your data outside the EU, we take appropriate measures to provide guarantees that the recipients comply with the principles of the GDPR. Unless there are other appropriate safeguards or transfer mechanisms (such as adequacy decisions of the EU Commission) in place, we use the SCCs approved by the EU Commission when drafting the contracts concluded with our service providers. The standard contractual clauses currently approved by the EU Commission are available on this website. Furthermore, you can request further information on these measures taken at any time using the contact details provided in this privacy notice.

7. Cookies and Tracking Technologies

(a) When you visit our Website, we may store one or more cookies (a small text file containing a string of alphanumeric characters) on your device and may access and use the information provided by these technologies. Some of these cookies and code may remain on your devices and may be used by your browser or devices on subsequent visits to the Website. This allows us to "remember" what you have done on the Website before and personalize the Website and our services for you and in accordance with your settings. Some of our cookies and code are technically necessary for the Website to function and to provide you with our services and some are optional. When visiting our Website for the first time you will be informed in detail of the different cookies and codes we use, for what purposes they are used and on what legal basis. Please note that disabling or rejecting certain cookies or code may prevent you from accessing some of the functionality and offerings available on our Website and my impair your User experience.

Further information on the cookies and tracking technologies we are using can be found in our cookie notice, which can be accessed at: http://onceuponafarmorganics.co.uk/#consent-preferences.

(b) We use the web tracking service Google Analytics on our Website. This service is offered and operated in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google“). We use Google Analytics to analyze user interactions on the Website to improve our offerings and make them more interesting for you as our customers through the statistics and reports obtained.

User interactions on our Website are primarily collected using cookies and include data about the device/browser, IP addresses and your website/app activities. In addition, your IP address is collected in anonymized form to ensure the security of the service and to provide information about the region of the respective customer (so-called IP geolocation). Using the anonymization function (so-called IP masking), Google truncates your IP address by the last octet within the EU/EEA.

Google acts as our processor in this context. We have concluded a corresponding agreement with Google. The information received about the use of our Website and the anonymized IP addresses are generally transmitted to and processed on a Google server in the USA. To provide you with appropriate safeguards for the protection of your personal data and to enable and facilitate the transfer of your personal data to the USA, Google has committed to the EU-US Data Privacy Framework.

Further information on the scope of Google Analytics services can be found at https://marketingplatform.google.com/about/analytics/terms/us/. at Information General information on the processing of personal data, which according to Google also applies to Google Analytics, can be found in Google's privacy notice at https://policies.google.com/privacy?hl=en&gl=us.

The legal basis for the processing of your personal data in connection with Google Analytics is your prior consent pursuant to Art. 6 (1) lit. a) GDPR or Art. 6 (1) lit. (a) UK GDPR and the local transpositions of Art. 5 (3) ePrivacy Directive regarding the storage of and retrieval of information stored in cookies. You may withdraw your consent at any time with effect for the future without affecting the lawfulness of the processing carried out prior to your withdrawal. To withdraw your consent, you can, for example, use the Google browser add-on available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de/, use the contact details in this privacy notice or our consent management tool.

8. Is The Provision Of Personal Data A Statutory Or Contractual Requirement Or A Requirement Necessary To Enter Into The Contract With Us And Are You Obliged To Provide Your Personal Data?

The provision of personal data is not subject to a statutory or contractual requirement, and you are not obliged to provide your personal data to us. However, without the provision of the requested personal data, we are not able to offer and provide our services and our Website to you.

9. Automated Decision-Making

We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

10. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, deletion or misuse.

11. Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected, or as required by law. We may anonymize your data for statistical purposes, in which case it is no longer considered personal data.

12. What Data Subject Rights Do You Have?

If you are a data subject located in the European Economic Area you have the right to request information about the data we have stored about you in accordance with Art. 15 GDPR or Art. 15 UK GDPR (Right of Access), to request the rectification of inaccurate data in accordance with Art. 16 GDPR or Art. 16 UK GDPR (Right to Rectification) and to request the erasure of data in accordance with Art. 17 GDPR or Art. 17 UK GDPR (Right to erasure “Right to be Forgotten”) or the restriction of data processing in accordance with Art. 18 GDPR or Art. 18 UK GDPR (Right to Restriction of Processing). Under the conditions of Art. 20 GDPR or Art. 20 UK GDPR, you may also request the transmission of personal data to you or a third party (Right to Data Portability).

In accordance with Art. 21 GDPR or Art. 21 UK GDPR, you have the right to object to the processing of your data, provided that the reason for the objection arises from your particular situation and it concerns data that we process to protect one of our interests worthy of protection or if it concerns the use of your data for direct marketing.

You also have a right to lodge a complaint with a competent supervisory authority pursuant to Art. 77 GDPR or with the Commissioner in the UK pursuant to Art. 77 UK GDPR if you consider that we are not processing your personal data in accordance with applicable law. This can be, for instance, the supervisory authority at the place of Your residence. Furthermore, you have the option of filing a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland.

If You have given us consent to process your personal data, you can withdraw this consent at any time without providing reasons and with effect for the future at the contact details provided in this privacy notice or any other way mentioned herein.

To exercise your rights, please contact us at privacy.europe@uponafarm.com.

13. Changes to This Privacy Notice

We may update this notice from time to time. We will notify you of material changes as required by law. Please review this notice periodically.

14. Contact Us

If you have any questions or concerns about this Privacy Notice or our data processing practices, please contact us, our DPO, or our EU representative at the contact details provided above in Section 2 of this privacy notice.

Effective Date: March 2026