DUTCH BROS PRIVACY POLICY

Last updated: September 25, 2024

Dutch Mafia, LLC, its affiliates, and subsidiaries (collectively, “Dutch Bros,” “we,” “our” or “us”) is a coffee shop chain, committed to building relationships and serving up smiles. This Privacy Policy (“Policy”) explains how we collect, use, disclose and otherwise process personal information about consumers (as further described below), as well as the rights and choices individuals have regarding such personal information. This Policy does not apply to the information practices of our franchisees (each a “Franchisee”), who are independent owners and operators of Dutch Bros franchise stores.

If you are a California resident, please also review Section 14. Notice for California Residents, which includes additional information about our collection, use and disclosure of personal information and your rights, as set forth by the California Consumer Privacy Act.

Table of Contents

1. SCOPE
2. COLLECTION OF PERSONAL INFORMATION
3. PURPOSES OF COLLECTION, USE DISCLOSURE AND PROCESSING
4. DISCLOSURES OF PERSONAL INFORMATION
5. AGGREGATE AND DE-IDENTIFIED INFORMATION
6. COOKIES, ANALYTICS AND TARGETED ADVERTISING
7. DUTCH REWARDS: NOTICE OF FINANCIAL INCENTIVES AND BONA FIDE LOYALTY PROGRAM
8. YOUR PRIVACY CHOICES
9. PRIVACY POLICY UPDATES
10. SECURITY
11. CHANGES TO THIS POLICY
12. CONTACT US
13. ADDITIONAL INFORMATION FOR RESIDENTS OF CERTAIN STATES
14. NOTICE FOR CALIFORNIA RESIDENTS

1. SCOPE

This Policy applies to the personal information that Dutch Bros processes about consumers, including related to:

• Orders and purchases, including mobile, in-store and phone orders (“Orders”).
• Dutch Bros websites (each a “Website”), mobile applications (each an “App”), and other online products and services that post or link to this Policy, including https://www.dutchbros.com/ and the Dutch Bros App (available from the Apple App Store and Google Play).
• Our rewards program, including Dutch Rewards^® and Dutch Pass^®.
• Contests, sweepstakes and other promotions.
• Surveys and market research (for example if you respond to a customer satisfaction survey).
• Marketing activities (e.g., marketing emails and offers) and advertising campaigns.
• Our communications and interactions with consumers about the above and our products and services (collectively, our “Services”).

Not In Scope. Unless otherwise noted, this Policy does not apply to the personal information that we collect and process about employees, personnel and contractors, job applicants and candidates, or our Franchisees.

Additional Notices. In some cases, additional or supplemental privacy notices (each an “additional notice”) may be provided and will apply to certain personal information collected and processed by us. For example, we may provide an additional notice in order to provide more specific information about how we use and disclose personal information if you choose to take advantage of a particular partner promotion or participate in certain Dutch Rewards offers or features. The additional notice will control to the extent there is a conflict with this Policy, with respect to your personal information that is subject to that notice.

2. COLLECTION OF PERSONAL INFORMATION

We collect personal information about customers, prospective customers and others as described in this section.

A. Categories of Personal Information

While the personal information we collect varies depending upon the circumstances including the nature of your interactions and communications with us (as further described below), in general, we collect the following categories of personal information:

• Identifiers: direct identifiers such as name, alias, email, phone number, address, user ID or username, unique personal identifier, online identifier, IP address, or other similar identifiers, as well as government issued identifiers (such as Social Security number or driver's license number), which are considered Sensitive Personal Information under state privacy laws.
• Customer Records: your account and profile information and customer records that contain personal information, such as username, account name, name, demographics and other characteristics or descriptions, contact information, and financial or payment information (i.e., payment type, payment card details, billing, and shipping address).
• Commercial Information: includes records of Services purchased, obtained, or considered, or other purchasing or use histories or tendencies.
• Internet or Other Electronic Network Activity Information: includes browsing history, clickstream data, search history, and information regarding interactions with our Websites, App, and the Services, advertisements, or emails, including other usage data related to your use of any of our Services or other similar online services.
• Location Data: such as general location information about a particular individual or device.
• Audio, Electronic, Visual, or Similar Information: includes information collected via call recordings if you are interacting with us in a customer service capacity or if you call us on a recorded line, recorded meetings and webinars, videos, and photographs.
• Inferences: Including inferences drawn from any of the personal information we collect including inferences reflecting a consumer's preferences, characteristics, behaviors, attitudes, abilities, and aptitudes.
• Protected Classifications: includes information that is considered a protected classification under California, or other state or federal laws, which may include your gender, age, date of birth, and disability information.
• Sensitive Personal Information: includes information that is considered sensitive personal information or information, such as account log-in information, payment card information and related details, precise geolocation data, racial or ethnic origin, and personal information collected and analyzed concerning a consumer's health, sex life, or sexual orientation. Additionally, if you win a contest, promotion, or sweepstakes, we may also collect certain government-issued identifiers, such as Social Security number or driver's license number, in accordance with applicable law.

If you are a California resident, please see Section 14, for additional information about how we collect, use and disclose the above categories of personal information, as required by the CCPA.

B. How We Collect Personal Information

We collect personal information directly from individuals and, in some cases, from third parties. We also may derive or automatically collect personal information about individuals, including their use of the Services, orders and interactions with us.

Personal information Collected Directly. The personal information we may collect from you depends on how you use our Services or otherwise interact or engage with us, but generally includes:

• Account registration and profiles. When you register for an account with us, we collect certain personal information from you, such as your name, company, address, phone number, and email address, and any personal information that you otherwise submit to us through your account.
• Orders and purchases data. When you make a purchase or payment through the Services, we collect purchase and payment information in order to process your payment, such as your credit card number and applicable shipping and billing address. We also maintain records about your past purchases, as well as items that you view or add to your cart.
• Rewards transactions and activity: If you use the Dutch App or Dutch Rewards^®, we collect information about your reward transactions, redemptions and other activities.
• Your communications and interactions with us. When you email, call, use the chatbot feature, or otherwise communicate with members of our team, we collect and maintain a record of your contact details, communications, and responses, including recordings and transcripts of your communications.
• Sweepstakes, contests, and promotions. If you participate in the sweepstakes, contests, and promotions that we offer, we will collect your name, age, email address, and other registration information related to sweepstakes, contests, and promotions.
• Research and survey responses. If you fill out our surveys, we may collect your survey responses, including information regarding demographics, your food and drink consumption and preferences, and your opinion about our products and Services. Participation in our surveys is voluntary.
• Events and other requests. If you register for or attend an event that we host or sponsor, we may collect personal information related to your registration for and participation in such event. When you fill out a 'Contact Us' form, signup for our mailing lists, or otherwise request information from us, we collect and maintain the personal information you submit and a record of your request.

Personal Information Collected from Third Parties. We may collect personal information about you from third party sources, such as public databases, joint marketing partners, social media platforms, or other third parties, including as follows:

• We may receive lead and prospect information from third parties about prospective customers that may be interested in our Services. We may also engage with third parties to enhance or update our customer information.
• If you post information about us, engage with us on third party platforms, choose to log in to our Services with a third-party account, or use a third-party account to make purchases (e.g., Shop Pay, Amazon Pay, PayPal, or Google), we may collect personal information about you from that third party platform or account. These third-party platforms and services control the information that they collect and share about you. For information about how they may use and disclose your information, including any information you make public, please consult their respective privacy policies.
• When you interact with us or our Services on a social media platform, we may collect the personal information that you make available to us on that page, including your account ID or username and other information included in your posts.

If you are a California resident, please see Section 14, for additional information about the categories of third party sources from whom we may collect personal information, as required by the CCPA.

Information We Collect Automatically or Derive. When you interact with us or our Services, we may automatically collect, generate and retain information about your use of and interactions with our Services. For example, our Services use “cookies,” tagging, and other tracking technologies to help enable you to shop on our Services, and to enable us to enhance or personalize your online browsing and shopping experience. We may also analyze the information we collect about you to help us understand, personalize and improve our Services, offers, and campaigns.

• Device and usage data. We receive and store certain types of information whenever you interact with our Services. For example, we collect usage data information about your use of our Services, such as the purchases you make, the pages you view, and other interactions you have. We also collect information you access or use our Services, such as IP address, general location information, domain name, page views, a date/time stamp, browser type, device type, device ID, Internet service provider, referring and exiting URLs, operating system, language, and similar information.
• Location information. When you visit our Services, We may receive location data. Location data allows us to provide location-based services, such as advertising, search results, remote order and payment, and other personalized services. If you would like to opt out of our collection of, and access to, specific location information (including, without limitation, GPS data and/or latitude and longitude data) then you may adjust the permissions in your device.
• Consumer inferences. We may also analyze the information that we collect about you directly, automatically and from other sources, to develop a better understanding of your preferences.

C. Information About Children.

Our Services are not targeted towards and we do not knowingly collect personal information online from children. If you are a parent or legal guardian and believe we may have inadvertently collected information from your child, please contact us as described in Section 12. Contact Us below. If we learn that we have inadvertently collected the personal information of a child under 13 we will take steps to securely delete the information, promptly.

3. PURPOSES OF COLLECTION, USE DISCLOSURE AND PROCESSING

Generally, we collect, use disclose and otherwise process the personal information we collect for the following purposes, or where otherwise authorized or directed by you:

• Providing Services and support. To provide and operate our Services; communicate with you about your use of our products, Services, offers, events, and promotions (e.g., through newsletters, emails, and texts); provide information or Services you request, such as your Dutch Bros account or the programs to which you have subscribed; provide troubleshooting and technical support; respond to your inquiries; gather customer feedback; fulfill your orders and requests; process your payments; communicate with you; and for similar Service and support purposes.
• Communicating with you. To with you about our products, services, offers, events, and promotions, and those of our third-party partners, via email, push notification and other medium;
• Analytics and improvement. To better understand how users access and use our Services, products, and offerings, and for other research and analytical purposes, such as to evaluate and improve our Services and business operations, to develop Services and features, and for internal quality control and training purposes.
• Customization and personalization. To tailor the content that we may send you and that we may display on the Services, including to offer location customization, personalized help and instructions, and to otherwise personalize your experience.
• Marketing and advertising. For marketing and advertising purposes. For example, to send you information about our Services, such as offers, promotions, newsletters, and other marketing content, including about third-party products and services we think may interest you, as well as any other information that you sign up to receive. We also may use certain personal information that we collect to manage and improve our advertising campaigns so that we can better reach individuals with relevant content.
• Administering our loyalty/rewards programs. If you use the Dutch Bros App or Dutch Bros Rewards^®, we use your personal information, including Orders and other activities, to administer the program.
• Planning and managing events. For event planning and management, including registration, attendance, connecting you with other event attendees, and contacting you about relevant events and Services.
• Research and surveys. To administer surveys and questionnaires, such as for market research or customer satisfaction purposes.
• Security and protection of rights. To protect our Services and our business operations; to prevent and detect fraud, unauthorized activities and access, and other misuse; where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or third party, or violations of our Terms of Service or this Policy.
• Legal proceedings and obligations. To comply with the law and our legal obligations, to respond to legal process and related legal proceedings.
• General business and operational support. To consider and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions, and related to the administration of our general business, accounting, auditing, compliance, recordkeeping, and legal functions.

We may use the information collected from one portion of our Services on other portions of our Services, and we may combine information gathered from multiple portions of our Services into a single record. We may also use or combine information that we collect offline or receive from third-party sources for many reasons, including to enhance, expand, and check the accuracy of our records.

4. DISCLOSURES OF PERSONAL INFORMATION

We may disclose the personal information that we collect as directed or authorized by you and for the purposes described above, which includes the following categories of disclosures:

• To vendors, service providers and processors. We engage third parties who perform functions on our behalf such as: service providers that host or operate our Services, payment processors, website hosting, content syndication, content management, marketing, analytics, data processing or other information technology services, and customer service. For example, we use third parties to process payments made to us and assist with product fulfillment, returns, and other operations. These third parties may have access to your Personal Information when needed to perform their functions.
• To our affiliates and subsidiaries. We may disclose personal information we collect to our affiliates or subsidiaries, who will use and disclose this personal information in accordance with the principles of this Policy.
• To third party platforms, providers and networks. We may disclose or make available personal information to third party platforms and providers that we use to provide or make available certain features or portions of the Services, or as necessary to respond to your requests. We may also make certain information that includes personal information available to third parties in support of our marketing, analytics, advertising and campaign management (See Section 6. Cookies, Analytics and Targeted Advertising for more information). In addition, we may upload certain customer list information (such as your email address and other contact information) for matching purposes, so that we can target ads and content to you on social media platforms and other third-party sites and services.
• To business partners. We may share information that personally identifies you with third parties who provide products and services that we think you may be interested in, or to make available complimentary or discounted products, incentives and other special offers as part of the Dutch Rewards program.

In addition, we may disclose personal information to others:

• As directed or authorized by you. From time to time, we may get your permission to share your personal information with third parties. By participating in the sharing activity, you give us permission to share the applicable information. For example, your first name is shared when you place an order, add a tip via our app, or when you share a Dutch Reward with a friend.
• In support of business transfers. If we or our affiliates are or may be acquired by, merged with, or invested in by another company, or if any of our assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected from you to the other company. We may also share certain personal information as necessary prior to the completion of such a transfer, such as to lenders, auditors, and third-party advisors, including attorneys and consultants, as part of due diligence or as necessary to plan for the transfer.
• For our legal and compliance obligations. We may also disclose personal information to third parties to comply with our legal and compliance obligations and to respond to legal process. For example, we may disclose information in response to subpoenas, court orders, and other lawful requests by regulators and law enforcement, including responding to national security or law enforcement disclosure requirements. This may include regulators, government entities, and law enforcement as required by law or legal process. In addition, it may include certain disclosures that we are required to make under applicable laws, such as the names of sweepstakes and contest winners.
• To protect, defend and secure legal rights. We may disclose personal information where we believe doing so is necessary to protect the Services, our rights and property, or the rights, property and safety of others. For example, we may disclose personal information in order to (i) prevent, detect, investigate and respond to fraud, unauthorized activities and access, illegal activities, and misuse of the Services, (ii) situations involving potential threats to the health, safety or legal rights of any person or third party, or (iii) enforce, and detect, investigate and take action in response to violations of, our Terms of Use. We may also disclose information, including personal information, related to litigation and other legal claims or proceedings in which we are involved, as well as for our internal accounting, auditing, compliance, recordkeeping, and legal functions.

5. AGGREGATE AND DE-IDENTIFIED INFORMATION

We may collect, derive, use, and disclose aggregate and other non-identifiable data related to our business and Services for quality control, analytics, research, development, and other purposes. Some of this information may be considered “deidentified” under U.S. privacy laws (i.e., data that it is no longer linked or reasonably linkable to an identified or identifiable consumer). Where we rely on data that has been “de-identified,” as defined by U.S. privacy laws, we will maintain and use such information in deidentified form and will not attempt to reidentify such information, except in compliance with applicable law.

6. COOKIES, ANALYTICS AND TARGETED ADVERTISING

We and our third-party service providers use cookies, pixels and other mechanisms to automatically collect information browsing, activity, device and similar information within our Services. We may use this information, for example, analyze and understand how users access, use and interact with others through our Services, as well to identify and resolve bugs and errors in our Services and to assess secure, protect, optimize and improve the performance of our Services. We may also use cookies and similar tools to target and collect metrics about our advertising and content across our Services and third party sites and services. You have certain choices about our use of cookies, pixels and tracking within the Services, as described in this section.

A. Cookies, Pixels and Analytics

Cookies. Cookies are alphanumeric identifiers that we transfer to your device's hard drive through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our Services, while others are used to enable a faster log-in process, support the security and performance of the Services, or allow us to track activity and usage data within Service.

Pixels. Pixel tags (sometime called web beacons or clear GIFs) are tiny graphics with a unique identifier, similar in function to cookies. While cookies are stored locally on your device, pixel tags are embedded invisibly within web pages and online content. We may use these, in connection with our Services to, among other things, track the activities of users, help us manage content and compile usage statistics.

We may also use pixels these in HTML e-mails we send, to help us track e-mail response rates, identify when our e-mails are viewed, and track whether our e-mails are forwarded.

Third-Party Analytics and Tools. We use third party tools, such as Google Analytics, which are operated by third party companies. These third-party analytics companies may collect usage data (using cookies, pixels and similar tools) about our Services in order to provide us with reports and metrics that help us to evaluate usage of our Services and improve performance and user experiences. You can also download the Google Analytics Opt-out Browser Add-on to prevent their data from being used by Google Analytics at https://tools.google.com/dlpage/gaoptout.

B. Targeted Advertising

We work with third parties, such as ad networks, channel partners, mobile ad networks, analytics and measurement services and others (“third-party ad companies”) to personalize content and display advertising within our Services, as well as to manage our advertising on third-party sites, mobile apps and online services. In order to do so, we may share certain information with these third-party ad companies, and we and these third parties may use cookies, pixels, and other tools to collect usage and browsing information within our Services, as well as on third-party sites, apps and services, such as IP address, location information, device ID, cookie and advertising IDs, and other identifiers, as well as browsing information.

In addition, if you have push notifications enabled in the Dutch App we may send you special offers and other promotional notifications and where you have location services enabled we may send you location-based offers.

C. Managing Your Preferences

We make available several ways for you to manage your preferences regarding targeted advertising and cookies within our Services. Many of these are browser and device specific, which means that you need to set the preference for each browser and device you use to access our Services; in addition, if you delete or block cookies, you may need to reapply these preferences. Further, opting out of cookies and advertising as discussed below does not mean that you will no longer receive advertising content from us. You may continue to receive generic or “contextual” ads.

Browser Preferences. You can set or communicate your preferences for cookies, tracking and targeted advertising on our website as described below. Please note that these preferences are browser and device specific, which means that you need to set the preference for each browser and each device you use to access our website.

• Website preference manager: You can review or change your preferences for targeting cookies on our Website by adjusting your cookie settings here.
• Browser signals: If our website detects that your browser is transmitting a “global privacy control”—or GPC— signal, we will apply that to opt that browser on your device out of targeting cookies on our Website. If you come to our Website from a different device or from a different browser on the same device, you will need to apply GPC for that browser and/or device as well. Our Website does not recognize or respond to browser “do not track” signals.

Most browsers also allow you to block certain cookies, review and delete cookies and receive notifications when a third party cookie is set. You can find more information through the “Help” menu of your browser. Visitors to our Services who disable cookies may browse the Site, but some features may not function.

Mobile Privacy Settings. Most mobile devices allow you to control or disable the use of precise location services and push notifications by any application on your mobile device through the device's settings menu. However, in order to use certain mobile application functionality, such as mobile order and payment and other location-based services and technology requiring location data, you must either (1) enable “location services” in our mobile application, or (2) set the permissions in your mobile device to allow communication of this location data information. Some services or features may not function properly without this location information.

Industry Ad Choices Programs. You can also control how participating third-party ad companies use the information that they collect about your visits to our websites and use of our mobile applications, and those of third parties, in order to display more relevant targeted advertising to you. Users in the US can obtain more information and opt out of receiving targeted ads from participating third-party ad networks at aboutads.info/choices (Digital Advertising Alliance). You may also download the DAA AppChoices (https://youradchoices.com/appchoices) tool in order to help control interest-based advertising on apps on your mobile device.

Please note that opting out of participating ad networks does not opt you out of being served advertising. You may continue to receive generic or 'contextual' ads on our Services. You may also continue to receive targeted ads on other websites, from companies that do not participate in the above programs.

7. DUTCH REWARDS: NOTICE OF FINANCIAL INCENTIVES AND BONA FIDE LOYALTY PROGRAM

Dutch Bros may offer certain perks, such as rewards, exclusive offers and other incentives —including Dutch Rewards and other programs, such as sweepstakes, contest, or other similar promotional campaigns or offers (each a “Program”)—that are considered a “financial incentive” under the California Consumer Privacy Act or a “Bona Fide Loyalty Program” under the Colorado Privacy Act and its implementing regulations. For example, you can choose to sign up for Dutch Rewards by downloading the Dutch App and creating a Dutch account—once you sign up, you can start earning rewards using the Dutch App, subject to our Terms of Service, including the applicable Dutch Rewards Program terms. We will not include you in a Program without your consent. You are not required to create an account or use the App to make a purchase.

The incentives we provide generally include complimentary or discounted products and other special offers (“Rewards”). If you are a California resident, pursuant to the CCPA, the value of your personal information we process as part of a Program is related to the value of the free or discounted products or services, or other benefits that you obtain or are provided as part of the applicable Program, less the costs and expenses associated with making the Rewards available to Program participants.

When you sign up for Dutch Rewards or other Programs, we typically ask you to provide your name, email, mobile number, zip code, and birthday (optional), and we will also collect and maintain records about your purchases, rewards and redemptions. Dutch Bros collects, shares, uses and retains the personal information it collects, including information related to these Programs, as described in our Privacy Policy. For example, your personal information may be collected and retained, and may be shared with our franchisees and other third party partners, in order (a) to administer and promote the Program, (b) maintain records of rewards and redemption, (c) provide tailored offers and rewards; (d) contact you about available rewards and special offers; (d) improve our marketing and ad campaigns and reach you with more relevant, targeted ads and offers, and (f) send your information and offers about third party products and services you may be interested in, and (g) for research and analytics purposes. You may opt out of a Program at any time. However, if you do so or request deletion of your personal information, you will no longer be eligible for rewards because your purchase and rewards data and related information is necessary to the management and administration of the Program.

To learn more about Dutch Rewards, please see our Terms of Service.

8. YOUR PRIVACY CHOICES

You have certain choices regarding our processing of your personal information. For example:

• Account information. You can review and update certain communication preferences and some of the personal information that we maintain about you by logging into your account, where applicable. You can also update your profile information, and review your recent purchases, rewards and redemption transactions, by logging into your account.
• Marketing communications. You can opt out of receiving our marketing emails by using the unsubscribe link at the bottom of each marketing email or by emailing [email protected]. You can opt out of receiving our marketing text messages by replying STOP to any text we send you. Dutch Bros Short Code Messaging Program is subject to the terms set forth in our Terms of Service.
• Push notifications. We may send push notifications on occasion. If you no longer wish to receive these types of communications, you may turn them off at the device level.
• Cookie preferences. As described under “Managing Your Preferences” in Section 6. Cookies, Analytics and Targeted Advertising, there are several ways for you to manage your preferences related to our use of targeting and advertising cookies associated with your use of our Website, including by using our cookie preference manager here to adjust your cookie settings.
• Location tracking. You can control or disable the use of location services and push notifications by any the Dutch Bros App through the settings menu for your mobile device. However, some services or features may not function properly without this location information.

State Privacy Rights. Residents of certain states have additional rights, as set forth below in Section 13. Additional Information for Residents of Certain States and Section 14. Notice for California Residents.

9. PRIVACY POLICY UPDATES

Dutch Bros may make changes to this Policy from time to time. We will post any such changes to our Services, and we will make the version immediately preceding this current Policy available upon request so that you can see what the changes are and when the changes occurred. If we make any material changes to this Policy, we will notify you by means of a notice on this Website. We will also seek your consent to any material changes that retroactively affects how we use your personal information that was collected under a prior version of this Policy.

10. SECURITY

We have implemented safeguards that are intended to protect the personal information we collect from loss, misuse, unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our efforts, no data security measures can guarantee security.

11. CHANGES TO THIS POLICY

We may update this Policy from time to time, so please be sure to check back periodically. We will post updates to the Policy on www.dutchbros.com. If we make any material changes to this Policy, that retroactively affect how we use your personal information that was collected under a prior version of this Policy, we will endeavor to notify you in advance, such as via email.

12. CONTACT US

Dutch Bros welcomes your questions and comments about your privacy or this Policy. Please contact us by emailing [email protected] or calling +1-833-539-4700 (toll free) for additional information.

13. ADDITIONAL INFORMATION FOR RESIDENTS OF CERTAIN STATES

Residents of certain U.S. states (including Colorado, Connecticut, Montana, Oregon, Texas Utah, and Virginia) have additional rights under applicable privacy laws, which may include, subject to certain limitations:

• Correct. To correct inaccuracies in their personal information, taking into account the nature and purposes of the processing of the personal information.
• Delete. To delete their personal information provided to or obtained by us.
• Access. To confirm whether we are processing their personal information and to obtain a copy of their personal information in a portable and, to the extent technically feasible, readily usable format.
• Opt-Out. To opt out of certain types of processing, including:
  • to opt out of the “sale” of their personal information.
  • to opt out of targeted advertising by us.
  • to opt out of any processing of personal information for purposes of making decisions that produce legal or similarly significant effects.
  • to opt out or withdraw consent to the processing of sensitive personal information.
• Appeal: to appeal our denial of your privacy request.

Oregon residents also have the right to request a list of the “third parties” as defined by the Oregon Consumer Privacy Law to who we disclose personal information.

Submitting a Request. You may submit a request to exercise most of your privacy rights under U.S. state privacy laws by filling out our webform (available at: https://www.requesteasy.com/63a3-3777) or calling us at +1-833-539-4700 (toll free). To opt out of targeted advertising by us, you can adjust your cookies settings here or on your device. See Section 6. Cookies, Analytics and Targeted Advertising and Section 8. Your Privacy Choices for more information.

We will respond to your request as required under applicable U.S. privacy law(s). When you submit a request, we will take steps to verify your identity and request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial. If we deny your request, in certain jurisdictions you may be able to appeal our decision according to the instructions we provide in our response.

To the extent required under applicable U.S. privacy laws, you may also designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization and we may also require the relevant consumer to directly verify the identity and authority of the authorized agent.

Nevada Residents. Nevada residents have the right to opt out of the “sale” of “personally identifiable information” as defined by Nevada law. However, we do not sell personally identifiable information as defined by Nevada law.

14. NOTICE FOR CALIFORNIA RESIDENTS

This section of the Policy provides additional information for California residents about our collection, use and disclosure of personal information and their privacy rights, as required by California privacy laws, including the California Consumer Privacy Act (the “CCPA”). This section does not address or apply to our handling of publicly available information or personal information that is otherwise exempt under the CCPA.

A. Categories of Personal Information Collected and Disclosed.

The categories of personal information we collect about consumers, as further described in Section 2.A of our Privacy Policy, may vary depending upon the circumstances including the nature of a consumer's interactions and communications with us.

As required by the CCPA, the table below identifies the categories of personal information we have collected about California residents in the prior 12 months, as well as the categories of third parties to whom we may disclose this personal information for a business or commercial purpose. We may also disclose personal information to service providers who process the personal information our behalf, as well as to others where required by law or authorized by you.

Sales and Sharing of Personal Information. The CCPA defines “sale” as disclosing or making available personal information to a third-party in exchange for monetary or other valuable consideration, and “sharing” includes disclosing or making available personal information to a third-party for purposes of cross-context behavioral advertising. While we do not disclose personal information to third parties in exchange for monetary compensation, we may “sell” or “share” (as defined by the CCPA) the following categories of personal information: Identifiers; Commercial Information; Location Data; and Internet and Network Activity Information. We may disclose these categories to advertising networks and social media platforms, analytics providers, and franchisees for purposes of marketing and advertising and to improve and measure our ad campaigns. We do not sell or share sensitive personal information, nor do we sell or share personal information about individuals we know are under age sixteen (16).

Sources of Personal Information. In general, we may collect personal information directly from you, automatically through your use of our Services, from our services providers and from the following categories of sources:

• Affiliates and subsidiaries
• Franchisees
• Business and marketing partners
• Data analytics providers
• Advertising networks and social media platforms
• Internet service providers, operating systems and platforms
• Data brokers and public records

Purposes of Collection, Use, and Disclosure. As further described in Section 3. Purposes of Collection, Use and Processing and Section 4. Disclosures of Personal Information, we may collect, use, disclose and otherwise process the above listed personal information for the following business or commercial purposes and as otherwise directed or authorized to by you:

• Providing Services and support
• Communicating with you
• Analytics and improvement
• Customization and personalization
• Marketing and advertising
• Administering our loyalty/rewards programs
• Planning and managing events
• Research and surveys
• Security and protection of rights
• Legal proceedings and obligations
• General business and operational support
• In support of business transfers
• For our legal and compliance obligations
• To protect, defend and secure legal rights

Sensitive Personal Information. Notwithstanding the purposes described above, we do not use or disclose of sensitive personal information beyond the purposes authorized by the CCPA. Accordingly, we only use and disclose sensitive personal information as reasonably necessary (i) to perform our services requested by you, (ii) to help ensure security and integrity, including to prevent, detect, and investigate security incidents, (iii) to detect, prevent and respond to malicious, fraudulent, deceptive, or illegal conduct, (iv) to verify or maintain the quality and safety of our services, (v) for compliance with our legal obligations, (vi) to our service providers who perform services on our behalf, and (vii) for purposes other than inferring characteristics about you.

Retention. We retain the personal information that we collect only as reasonably necessary for the purposes described above or as otherwise disclosed to you at the time of collection. For example, we will retain your account information for as long as you have an active account with us and additional information as necessary to comply with our tax, accounting, and recordkeeping obligations, to provide you with the Services you have requested, as well as an additional period of time as necessary to protect, defend, or establish our rights, defend against potential claims, and comply with our legal obligations. In some cases, rather than delete your personal information, we may deidentify or aggregate it and use it in compliance with the CCPA.

B. California Privacy Rights.

CCPA Rights. California residents have the following rights (subject to certain limitations) under the CCPA:

• Know/access: to know what personal information we have collected about them, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.
• Delete: to request deletion of their personal information.
• Correct: to request correction of inaccurate personal information.
• Opt out of sales and sharing: to opt-out of our sale and sharing of their personal information.
• Limit uses and disclosures of sensitive personal information: to limit certain uses or disclosures of sensitive personal information to those authorized by the CCPA. However, as noted, we do not use or disclosure your personal information beyond the purposes authorized by the CCPA.
• Non-discrimination: to not be subject to discriminatory treatment for exercising their rights under the CCPA.

Submitting CCPA Requests to Know/Access, Correct or Delete. California residents may exercise their rights to know/access, correct and delete their personal information by:

• Submitting a request through our webform.
• Calling us at +1-833-539-4700 (toll free).

When you submit a request to know/access, correct or delete, we will take steps to verify your identity and request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.

You may also designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization and we may also require the relevant consumer to directly verify the identity and the authority of the authorized agent.

Opting Out of Sales and Sharing under the CCPA. You may exercise your right to opt out sales and sharing by:

• Webform. You may submit a request through our webform. We will apply your opt out to the personal information in our records that is linked or reasonably linkable to the information provided in your request. You may also access our webform by clicking the “Do Not Sell or Share My Personal Information“ link at the bottom of our Website.
• Browser and opt out signals. Turning on “Global Privacy Control” signals for your browser, which our website will process as a request to opt out of sales and sharing for the relevant browser and device. If we detect that your browser is transmitting a GPC signal, we will opt that browser out of cookies that result in a “sale” or “sharing” of your personal information. More information about GPC is available at: globalprivacycontrol.org. You may also turn off “optional cookies” in our cookie preference manager, accessible here, which will opt your browser out of cookies that are not required for our Website to function properly.
  
  If you come to our Website or use our Services from a different device or from a different browser on the same device, you will need to opt out of optional cookies or set GPC signals for that browser and device as well.

California Shine the Light Rights. California's “Shine the Light“ law (Cal. Civ. Code § 1798.83) permits California residents who provide us certain personal information to request and obtain from us, free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing purposes. To make a California Shine the Light request, please email us at [email protected]. Requests may be made once per calendar year.