PRIVACY POLICY

LAST UPDATED: February 6, 2024

This Privacy Policy explains how information about you is collected, used, protected, and disclosed by MOD Super Fast Pizza, LLC and/or its affiliates (collectively, “MOD,” “our,” “we,” or “us”). 

Contents

1. What this Privacy Policy Covers; Updates to this Privacy Policy
2. Collection of Personal Information
3. Use of Personal Information
4. Disclosure of Personal Information
5. Third-Party Content, Links, and Services
6. Your Choices (including as to Account Information and Tracking Technologies, and Interest-based Advertising)
7. Security of Personal Information
8. Contact Us
9. Jurisdiction-Specific Notices

• U.S. State Privacy Notice (applicable to residents of California, Colorado, Connecticut, and Virginia and other states listed in such notice)
• • PI Collection, Use, and Disclosure
  • Your Consumer Rights and How to Exercise Them
  • Incentive/Loyalty Programs Notice
  • Other State Disclosures

• California Human Resources Data Privacy Notice

1) What this Privacy Policy Covers; Updates to this Privacy Policy

This Privacy Policy applies to information we collect when you use our website, the MOD Rewards^® app, and other online products and services, as well as any communications between you and us, such as through customer service chats, and emails and other communications we send, and in-person interactions, such as when you visit or interact with us at one of our stores (collectively, the “Services”).

Please note: This Privacy Policy does not apply to the data practices of third parties that may interact with our Services, or of our authorized operators that operate MOD-branded franchise store locations.

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of the policy and, in some cases, we may provide you with additional notice, such as adding a statement to our homepage or sending you an email or push notification. We encourage you to review the Privacy Policy whenever you access the Services or otherwise interact with us to stay informed about our information practices and the ways you can help protect your privacy.

In addition, please review our Terms of Use, which govern your use of the Services. By using our Services, you consent to our Privacy Policy and our information practices described herein.

Sometimes, additional or different privacy policies or practices may apply, in which case we will provide you notice at the time of collection. Where applicable, those additional policies or practices supplement this Privacy Policy.

The definition of personal information under certain laws is limited to information that can be used to directly identify you, such as your name, email address, and similar information. Under other laws, including those which our U.S. State Privacy Notice covers, the definition of personal information is broader and also covers things like online identifiers (IP address, cookie IDs, device IDs). Where we are required by law to treat certain information as personal information, or where we combine certain information with personal information, we will treat it as such.

2) Collection of Personal Information.

1. Information You Provide to Us.We collect information you provide directly to us or through our service providers. For example, we, or a service provider acting on our behalf, collect information when you create an account, place an order or make a purchase, fill out a form, participate in contests, promotions or surveys, apply for a job, inquire about becoming an authorized operator (including, but not limited to, a franchisee), contact us about potential real estate locations, host a charity fundraiser at one of our stores or request charity donations from us, engage with us via third party social media sites, request customer support, or otherwise communicate with us. The types of information we may collect include:
   1. your name, email address, phone number, postal address, ZIP code, birth date, MOD account username and password, social media usernames;
   2. photographs, if you choose to upload a profile photo (please note that providing our application with access to a photo library on a mobile device may result in collection of personal information regarding other photos stored on the device);
   3. if you are applying for employment, your résumé information, such as employment and education history;
   4. if you are inquiring about becoming our authorized operator, financial information, such as your net worth, restaurant operation experience, and other relevant information;
   5. if you are requesting our participation in a fundraising event or seeking charity donations from us, the name and address of the charity organization, event details, and tax exempt ID; or
   6. any other information you choose to provide.

   We may collect and store information about your transaction when you place an order or make a purchase through the website, the MOD Rewards® app, or in our stores, such as the items ordered, the transaction amount, the date and location of the store of your order, and limited payment information, such as payment card type, expiration date, and the last four digits of your card number; however, we do not collect or store full payment card numbers, and all payment card transactions are processed by our third-party payment processors.

2. Information We Collect Automatically When You Use the Services. When you access or use our Services, we automatically collect certain information, including, but not limited to:
   1. Log, Device, and Services Usage Information: This includes information collected by Tracking Technologies (defined below), such as:
      1. your device functionality (browser, operating system, hardware, mobile network information);
      2. the URL that referred you to our Services;
      3. the areas within our Services that you visit and your activities there (including emails, such as whether you open them or click on links within);
      4. your device characteristics, such as the hardware model, operating system and version, IP address, unique device identifiers and other identifiers, mobile network information; and
      5. device data and the time of day.
   2. Device Location Information: When you have enabled location services on your device, we may collect information about the location of your device, including precise location, each time you access or use our website or one of our mobile applications. For information on how to limit these activities on your device, please see the “Your Choices” section below.
   3. Information Collected by Cookies and Other Tracking Technologies: We, our service providers, and Third-Party Services use various technologies, including cookies, web beacons, embedded scripts, location-identifying technologies, device recognition technologies, in-app tracking methods, and other tracking technologies, now and hereinafter developed (“Tracking Technologies”), to collect information about you and our interaction with our Services, including information about your browsing and purchase behavior, and as otherwise described in this Privacy Policy, including in the “Third-Party Content, Links, and Services” section. Cookies are small data files stored on your hard drive or in device memory that help us improve our Services and your experience on these Services, see which areas and features of our Services are popular, and count visits. Web beacons are electronic images that may be used in our Services or emails and help deliver cookies, count visits, and understand usage and campaign effectiveness. For more information about cookies, and how to disable them, please see the “Your Choices” section below.
   4. In-Store Cameras and Customer Service Call Recordings: We use in-store cameras and customer service call recordings for security purposes and for operational purposes such as improving the customer experience.
3. Information We Collect from Other Sources.
   1. Third-Party Services. Certain functionalities on the Services permit interactions that you initiate between the Services and certain third-party services, such as third-party social networks (“Social Features”) or Tracking Technologies operated by Third-Party Services. Examples of Social Features include: enabling you to send content such as contacts and photos between the Services and a Third-Party Service; “liking” or “sharing” MOD’s content; logging in to the Services using your third-party service account (e.g., using Facebook Connect to sign-in to the Service); and to otherwise connect the Services to a Third-Party Service (e.g., to pull or push information to or from the Services). If you use Social Features, and potentially other third-party services, information you post or provide access to may be publicly displayed on the Services or by the third-party service that you use. Similarly, if you post information on a third-party service that references the Services (e.g., by using a hashtag or handle associated with MOD in social media post), your post may be used on or in connection with the Services or otherwise by MOD. Also, both MOD and the third party may have access to certain information about you and your use of the Services and any third-party service. Third-Party Services are discussed in more detail in the “Third-Party Content, Links, and Services” section.
   2. Authorized Operators. We may receive information about you from our authorized operators.
   3. From Other Third Parties. We may, from time to time, supplement the information we collect via our Services with outside records information from third parties.
   4. From your Friends and Family. In some cases, we may also collect information others provide about you, such as when they refer you to our Services (including for certain promotions), or when they make a purchase for you or specify items for you in your party. We will use this information in relation to such requests and will not send you marketing communications unless you separately consent or otherwise sign-up to receive these communications from us.
4. Information We Infer.
   We may make inferences about you based on other information we have collected or otherwise internally generate personal information. For example, based on your order history or other information about you, we may infer that you are interested in a particular product, and provide you with offers or advertisements in relation to such product.

3) Use of Personal Information.

We may use personal information we collect for various purposes, including, but not limited, to:

1. Providing our products and services, including to:
   1. provide and maintain the Services; and
   2. provide and deliver the products and services you request, process orders and transactions, and send you related information, including confirmations and receipts.
2. Operating our business and supporting our authorized operators’ businesses, including to assess and respond to applications for employment or from potential authorized operators, applications for charity events or donations, and other administrative purposes.
3. Administering accounts and rewards programs such as the MOD Rewards program.
4. Customer service and communications, including to:
   1. send you information related to your orders and transactions such as confirmations and receipts, as well as technical notices, updates, security alerts, and support and administrative messages;
   2. respond to your comments, questions, requests, and provide customer service; and
   3. communicate with you about products, services, offers, promotions, rewards, and events offered by MOD and others, and provide news and information we think will be of interest to you (for information about how to manage promotional communications, please see the “Your Choices” section below).
5. Research, development, and analytics, including to:
   1. monitor and analyze trends, usage, and activities in connection with our Services; and
   2. improve our Services, including your in-store, online, and mobile application ordering experience.
6. Targeting advertisements to you or your device, including through Interest-based Advertising and to otherwise assist us in determining relevant advertising, such as by creating advertising segments based on personal information.
7. Ad measurement, attribution, and other ad administration, including to determine the success of our advertising campaigns and to help us determine where to place our ads, including ads placed on other websites and services.
8. Personalizing your experience, offers, and content, including providing content or features on our Services that match user profiles or interests.
9. Sweepstakes and other promotions, such as to process and deliver contest and promotion entries and rewards.
10. Security and safety, including to detect and respond to threats to both our in-store and online operations, protect the health and safety of our customers, members of the MOD Squad, authorized operators and their team members, and the public, and to prevent, investigate, and prosecute criminal activities.
11. To comply with legal obligations, including as part of our general business operations, for other business administration purposes, or as otherwise required or compelled.
12. Prevention, detection, investigation, and mitigation of illegal activities, fraud, injury, or violation of our terms or policies, such as where we believe we need to in order to investigate, prevent, or take action if we think someone might be using information for illegal activities, fraud, or in ways that may threaten someone’s safety or violate of our Terms of Service or this Policy.
13. For purposes disclosed at the time you provide your personal information.
14. For our legitimate business purposes that are compatible with the purpose of collecting your personal information and that are not prohibited by law.

MOD is based in the United States and the personal information we collect is maintained and processed by us and our Vendors in the U.S. and governed by U.S. law. If you are located in the European Economic Area (EEA), please note that MOD does not intend to offer goods and services (including the Services) to EEA individuals. By accessing or using the Services or otherwise providing information to us, you consent to the processing and transfer of information in and to the U.S., where you may not have the same rights as you do under the law of the jurisdiction from which you access the Services. MOD is not responsible for, and makes no representations regarding, the policies or business practices of third parties (including where information is maintained and processed), including, without limitation, Third-Party Services (including Social Features) associated with the Services.

4) Disclosure of Personal Information.

We may disclose or otherwise make available personal information as described in this Privacy Policy, including for the processing purposes described in the “Collection of Personal Information” section above, and as follows:

1. Affiliates and Authorized Operators. We may disclose or otherwise make available personal information to our affiliates (including subsidiaries) and authorized operators, such as to provide products and services you request and to support our business function and authorized operator network.
2. Vendors, such as third-party vendors, consultants, and other service providers (“Vendors”) who need access to such information to carry out work or provide Services on our behalf.
3. Third-Party Services may collect personal information independently on the Services or we may directly provide them with personal information, including in relation to Interest-based Advertising and other purposes.
4. Third-party promotional partners. Where we have the legal right, we may disclose or otherwise make your personal information available to promotional partners or other third parties for a business purpose that we have approved. When we disclose personal information in these contexts, we make sure that we comply with applicable legal requirements, which may include providing opt-out or other rights with respect to the shared data. This may also include sponsors, co-promotional partners, and other third parties on co-branded areas of the Services. The data practices of these third parties are subject to their own privacy policies and terms.
5. For safety, security, legal, and similar/related reasons. We may disclose your personal information to other persons, organizations, or governmental authorities if we believe in good faith that doing so is necessary or appropriate to (i) to protect or defend the rights, safety, or property of MOD, its affiliates, or third parties; (ii) to investigate, prevent, or take action regarding illegal activities or suspected fraud; (iii) to enforce, investigate, or take action regarding this Privacy Policy, our Terms of Service, and other applicable agreements and policies; (iv) in litigation or other proceedings in which we, our affiliates, or our authorized operators may be involved; and (v) to comply with legal and regulatory obligations and, to the extent not prohibited by applicable law, requests from law enforcement and other public authorities or other legal process. We will exercise our discretion in electing to make or not make such disclosures, and to contest or not contest requests for such disclosures, all without notice to you, subject to applicable law or other legal requirements.
6. Corporate Transactions, such as in connection with, or during negotiations of any merger, acquisition, transfer, liquidation, restructure, sale of company assets, listing of our securities with a securities exchange, financing, reorganization, or acquisition of all or a portion of our business by another company.
7. With notice to you, or your consent or direction.

We may also use and share aggregated or de-identified information or other information for which we have an obligation to you based on this Privacy Policy (or a statement made elsewhere on the Services) or applicable law. We do not authorize recipients of information we have de-identified to re-identify the data.

5) Third-Party Content, Links, and Services.

The Services have functionality that allows certain kinds of interactions between the Services and Social Features, third-party content, web sites, applications, platform, code (e.g., plug-ins, application programming interfaces (“API”), and software development kits (“SDKs”)), and Tracking Technologies (collectively, “Third-Party Services”).

Third-Party Services may use their own cookies and other Tracking Technologies to independently collect information about you, including Third-Party Services to which you are directed from the Services, including where you click a link and leave the Services entirely. There may be certain websites and other Third-Party Services to which we may link from the Services, which are third party websites using our name under license but with their own terms and policies (except where we have explicitly linked to this Privacy Policy).

We are not responsible for the policies or business practices of Third-Party Services, including how they collect, use, or share your information, including through Tracking Technologies that collect information regarding your visit to the Services as well as after your visit is over. These Third-Party Services may have their own terms of service, privacy policies, or other policies and ask you to agree to the same. Be sure to review any available policies before submitting any personally identifiable information to, or otherwise interacting with, any Third-Party Services.

Advertising and Analytics

We may allow others to serve advertisements on our behalf across the Internet and elsewhere online and to provide analytics and other services. Some information about your use of the Services and certain third-party services may be collected using Tracking Technologies across time and different services and used by MOD, our Vendors, and other third parties for purposes such as to associate different devices you use and to deliver relevant ads and/or other content to you on the Services and elsewhere online (“Interest-based Advertising”). These entities may use Tracking Technologies to collect information about your use of the Services and other websites, including your IP address, web browser, pages viewed, time spent on pages, links clicked, and conversion information. This information may be used by MOD and others to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our Services and other websites, and better understand your online activity. For more information about your choices with respect to interest-based ads, or to submit opt out of having your web browsing information used for Interest-based Advertising purposes, please visit aboutads.info/choices.

We may also work with third parties to serve you ads as part of a customized campaign on third-party platforms (such as Facebook or Twitter). As part of these ad campaigns, we or our Vendors may convert information about you, such as your email address and phone number, into a unique value that can be matched with information from a third party, such as a user account on a social media platform to learn about your interests and to serve you advertisements customized to your interests, or to serve ads to people with similar interests or characteristics. Note that the third-party platforms may offer you choices about whether you see these types of customized advertisements.

We use Vendors and Third-Party Services for analytics services. These analytics services may use cookies and other Tracking Technologies to help us analyze Services users and how they use the Services. Information generated by these analytics services (e.g., your IP address and Services usage information) may be transmitted to and stored by these Service Providers on servers in the U.S. (or elsewhere) and these Vendors and/or Third-Party Services may use this information for purposes such as evaluating your use of the Services, compiling statistic reports on the Services’ activity, and providing other services relating to Services activity and other Internet usage. See the “Your Choices” section immediately below for more information on your choices regarding certain Tracking Technologies analytics.

6) Your Choices

1. Account Information. You may update, correct, or delete account information at any time by logging into your account. If you wish to delete your account, please send an email to feedback@modpizza.com, and include your name, account name (if different), contact information, and a request to delete your account. If you access your account through the MOD app on Apple iOS, you can delete your account through the functionality provided on our app.  Please be aware that if you delete your account, you will no longer be able to participate in our MOD Rewards, including redeeming or using any rewards that you had compiled prior to such deletion. We may retain certain information that you provide through our Services as required or permitted by applicable law. We also may retain cached or archived copies of information about you for a certain period of time.
2. Tracking Technologies and Interest-based Advertising.
   
   Consent Management Platform
   
   We offer a platform, often called a consent management platform, or CMP, which allows you to manage certain Tracking Technologies on our website. Please click here to visit the CMP.

   Browser Settings
   
   Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of our Services. Your browser settings may allow you to automatically transmit a “Do Not Track” signal to web sites you visit. Like many online services, we currently do not alter our practices (that is, honor the do-not-track signal) when we receive a “Do Not Track” signal from a visitor’s browser. To find out more about “Do Not Track,” you can visit http://www.allaboutdnt.com, but we are not responsible for the completeness or accuracy of this third-party information.

   Company-Specific Opt-Outs
   
   You may exercise choices with respect to Google Analytics by going to https://tools.google.com/dlpage/gaoptout or downloading the Google Analytics Opt-out Browser Add-on.
   You may choose whether to receive some Interest-based Advertising by submitting opt-outs.

   Advertising Industry Opt-Out Programs
   
   Some of the Vendors and Third-Party Services that perform advertising-related services for us and third parties may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising, including use of cross-device data for serving ads, visit http://www.aboutads.info/choices/, and http://www.aboutads.info/appchoices for information on the DAA’s opt-out program specifically for mobile apps (including use of precise location for third-party ads). Some of these companies may also be members of the Network Advertising Initiative (“NAI”). To learn more about the NAI and your opt-out options for their members, see http://www.networkadvertising.org/choices/. Please be aware that, even if you are able to opt out of certain kinds of Interest-based Advertising, you may continue to receive other types of non-targeted ads, such as contextual ads. Opting out only means that those selected members should no longer deliver certain Interest-based Advertising to you but does not mean you will no longer receive any targeted content and/or ads (e.g., from ad networks that do not participate in the above opt-out programs).MOD is not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. You will need to exercise the above choices on each browser or device that you use. Please be aware that if you disable or remove certain Tracking Technologies, technologies, some parts of the Services may not work or will function with more limited capabilities. In addition, please note that your choices sometimes rely on Tracking Technologies, such that when you clear or disable them, your choices are reset.

3. Location Information. When you first launch some of our mobile applications or visit one of the pages on our website that collect location information, you may be asked for your permission to collect of location information, including precise location (such as by enabling certain settings). If you initially consent to our collection of location information, you can later stop this collection by changing the settings on your mobile device or Internet browser. If you do so, certain features of our Services will no longer function. You can also stop our collection of location information by our mobile application(s) by removing the MOD application(s) from your mobile device.
4. Promotional Communications. You agree that we may send promotional and non-promotional notifications or alerts to you, including to your mobile device. You may opt out of receiving promotional communications from us as follows: (i) for promotional e-mails, following the instructions provided in emails to click on the unsubscribe link; (ii) for text messages, following the instructions provided in text messages from us to text the word, “STOP” (or as otherwise instructed); and (iii) for app push notifications, turn off push notifications on the settings of your mobile device. We may, from time-to-time, provide functionality to allow you to change your communication preferences by logging into your account. If you opt out of marketing communications, we may still send you non-promotional communications, such as those about your account, your transactions, or our ongoing business relations.

7) Security of Personal Information.

MOD takes reasonable measures to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration, and destruction. However, no data transmission over the Internet, mobile networks, wireless transmission, or electronic storage of information can be guaranteed to be 100% secure. Please note that we cannot ensure the security of any personal information you transmit to us, and you use our Services and otherwise provide us with your information at your own risk.

 

8) Contact Us.

If you have any questions about this Privacy Policy, please contact us at feedback@modpizza.com.

U.S. State Privacy Notice

LAST UPDATED: February 6, 2024

This U.S. State Privacy Notice (“State Notice”) applies to “Consumers” as defined under certain state laws, including the California Consumer Privacy Act, including as amended by the California Privacy Rights Act (together, the “CCPA”), the Virginia Consumer Data Privacy Act (“VCDPA”), the Colorado Privacy Act (“CPA”), and the Connecticut Data Privacy Act (“CTDPA”) (Conn. Public Act. No. 22-15), and all laws implementing, supplementing, or amending the foregoing, including regulations promulgated thereunder (collectively, “U.S. Privacy Laws”).

This State Notice does not apply to data collected in a human resources (HR) context.  For example, if you are a California resident and an employee, former employee, or applicant of MOD, or if we have collected data from or about you otherwise in an HR context, please visit our California HR Privacy Policy below.

This State Notice is designed to meet our obligations under U.S. Privacy Laws and supplements our other privacy policies or notices, including, without limitation, our Privacy Policy above.  In the event of a conflict between any other MOD policy, statement, or notice and this State Notice, this State Notice will prevail as to Consumers and their rights under the applicable state privacy law.  Capitalized terms used but not defined herein will have the meanings given to them in the Privacy Policy above, unless otherwise indicated.

This State Notice is designed to provide you with notice of our recent, historical data practices over the prior 12 months (from the Last Updated date above), including through the Services and anywhere this State Notice is posted.  This State Notice will be updated at least annually.  This State Notice also applies to our current data practices such that it is also meant to provide you with “notice at collection,” which is notice of personal information we collect online and offline, and the purposes for which we process personal information, among other things required by the U.S. Privacy Laws.  For any new or substantially different processing activities in this State Notice, we will notify you as required by the U.S. Privacy Laws, including by either notifying you at the time of collecting personal information, or by updating this State Notice earlier than required.  We reserve the right to amend this State Notice at our discretion and at any time.  When we make changes to this State Notice, we will post an updated version on the Services and update the Last Updated date.

• Section A of this State Notice covers our collection, use, and disclosure of personal information or personal data (referred to herein as “personal information” or “PI”) under the U.S. Privacy Laws.
• Section B of this State Notice describes your rights under the U.S. Privacy Laws and explains how to exercise those rights.
• Section C of this State Notice includes disclosures required under other state laws, including in California and Nevada.

Notably, this State Notice does not apply to data that is not treated as PI under the applicable laws or to the extent the data is subject to an exemption under applicable laws.  This State Notice also does not apply to information collected by Third-Party Services.

A. PI Collection, Use, and Disclosures
We collect, retain, use, and disclose your PI in order to provide you our products and services and as otherwise related to the operation of our business and more specifically, for the business and commercial purposes set forth in our Privacy Policy above, including in the “Collection of Personal Information” and “Disclosure of Personal Information” sections (the “Processing Purposes”). Some of the Processing Purposes, as we discuss below the table, implicate “Sale,” “Sharing,” and “Targeted Advertising.”

The table immediately below describes the categories of PI we collect as well as examples of types of data that fit within such categories, in the left column. The right column states the categories of recipients that receive such PI as part of disclosures for business purposes, as well as disclosures which may be considered a Sale or Sharing under certain U.S. Privacy Laws.

We may disclose each category of PI and Sensitive PI in the table above to the following categories of recipients in a manner that does not constitute Sale or Sharing:

• The Consumer or to other parties at your direction or through your intentional action (such as where you direct us to provide information to third-party promotional partners).
• The government or private parties to comply with law or legal process.
• Assignees as part of a Corporate Transaction.
• In addition, our Vendors and the other recipients listed in the below table may, subject to contractual restrictions imposed by us and/or legal obligations, also use and disclose your PI for business purposes. For example, our Vendors and other categories of recipients listed in the table below may themselves engage service providers or subcontractors to enable them to perform services for us or process PI for our business purposes.

Processing Purposes Implicating Sale, Sharing, and Targeted Advertising
When you provide us PI for the following Processing Purposes, we may use certain information, such as your email address, that you provide for such purposes, to advertise to you. This may include making available your PI to certain third parties in way that may constitute a Sale and/or Sharing, as well as using your PI for purposes of Targeted Advertising.

• roviding our products and services
• Administering accounts and loyalty programs
• Sweepstakes, contests, and other promotions
• For purposes disclosed at the time you provide your personal information

Processing Purposes that may implicate Selling, Sharing, and/or Targeted Advertising include the following:

• Targeting advertisements to you or your devices
• Ad measurement, attribution, and other ad administration
• Sweepstakes, contests, and other promotions
• For purposes disclosed at the time you provide your personal information

We reserve the right to convert, or permit others to convert, your PI into deidentified data or aggregate consumer information. We will not attempt to reidentify data that we maintain as deidentified.

Sources of PI
As described in our Privacy Policy above, we collect PI directly from you or from your device, other users of the Service, Third-Party Services and other third parties (including Third-Party Digital Businesses), Vendors, authorized operators, and our affiliates.

Data Retention
Because there are numerous types of PI in each category, and various uses for each PI type, actual retention periods vary. We retain specific PI pieces based on how long we have a legitimate purpose for the retention. We apply the same criteria for determining if we have a legitimate purpose for retaining your PI that you ask us to delete. If you make a deletion request, we will conduct a review of your PI to confirm if legitimate ongoing retention purposes exist, will limit the retention to such purposes for so long as the purpose continues, and will respond to you with information on any retention purposes on which we rely for not deleting your PI. For more information on deletion requests see the Right to Delete section.

B. Your Consumer Rights and How to Exercise Them
As described further below, we provide Consumers – which are, for clarity, residents of certain states – the privacy rights described in this section. For residents of states without Consumer privacy rights, we will consider requests but will apply our discretion in how we process such requests. For states that have passed consumer privacy laws that are not yet in effect as of the Last Updated date, we will also consider applying state law rights prior to the effective date of such laws, but will do so in our discretion.

Making a Request and Scope of Requests
Certain requests you submit to us is subject to an identification and residency verification process (“Verifiable Consumer Request”) as described in the Verifying Your Request section below. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI.

Some PI we maintain about Consumers is not sufficiently associated with enough personal information about the Consumer for us to be able to verify that it is a particular Consumer’s personal information (e.g., clickstream data tied only to a pseudonymous browser ID). As required by the U.S. Privacy Laws, we do not include that personal information in response to Verifiable Consumer Requests. If we cannot comply with a request, we will explain the reasons in our response.

We will make commercially reasonable efforts to identify PI that we collect, process, store, disclose, and otherwise use and to respond to your Consumer privacy rights requests. We will typically not charge a fee to fully respond to your requests, but we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded, or overly burdensome.

To make a request (other than a Do Not Sell/Share/Target request with respect to cookie PI (defined further below)) according to your rights to know or to request deletion of your PI set forth below, please visit Consumer Rights Request page and following the instructions there, or call us at 877-212-0465 (U.S. toll-free). For instructions on how to submit a Do Not Sell/Share/Target request with respect to cookie PI, please go to the Do Not Sell/Share/Target section below.

Verifying Your Request
When you contact us to make a request, we will ask you to provide certain information that we will use to verify your identity in accordance with the requirements of applicable law. We will use the information that you provide in order to determine if it matches with information in our systems. We reserve the right to follow up and request additional information in order to verify your identity; please respond to any follow up inquiries we make.
At a minimum, we will need you to provide at least your name and email address. Depending on the nature of the request and whether we have the email address you have provided in our systems, we may request further information from you in order to verify that you are the Consumer about whom we have collected information. We will review the information provided as part of your request, and we may ask you to provide additional information via e-mail or other means as part of this verification process. We will not fulfill your Right to Know (Categories), Right to Know (Specific Pieces), Right to Delete, or Right to Correction request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. The same verification process does not apply to opt-outs of sale or sharing, or limitation of Sensitive PI requests, but we may apply some authentication measures if we suspect fraud (such as verifying access to the email address or phone number provided when making the request).
The verification standards we are required to apply for each type of request vary. We verify your categories requests and certain deletion and correction requests (e.g., those that are less sensitive in nature) to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you. For certain deletion and correction requests (such as those that relate to personal information that is more sensitive in nature) and for specific pieces requests, we apply a verification standard of a reasonably high degree of certainty. This standard includes matching at least three data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you, and may include obtaining a signed declaration from you, under penalty of perjury, that you are the individual whose personal information is the subject of the request.
If we cannot verify you in respect of certain requests, such as if you do not provide the requested information, we will still take certain action as required by certain U.S. Privacy Laws. For example, if you are a California Consumer:

• If we cannot verify your deletion request, we will refer you to this State Notice for a general description of our data practices.
• If we cannot verify your specific pieces request, we will treat it as a categories request

Authorizing an Agent
You may designate an authorized agent to submit your Consumer request on your behalf by submitting a request in the manners described above. If you are an authorized agent who would like to make a request, the U.S. Privacy Laws require that we ensure that a request made by an agent is a Verifiable Consumer Request, as applicable, and allow us to request further information to ensure that the Consumer has authorized the agent to make the request on their behalf. Generally, we will request that an agent provide proof that the Consumer gave the agent signed permission to submit the request, and, as permitted under the U.S. Privacy Laws, we also may require the Consumer to either verify their own identity or directly confirm with us that they provided the agent permission to submit the request.

YOUR CONSUMER PRIVACY RIGHTS

Right to Limit Sensitive PI Processing
Certain PI qualifies as sensitive data or Sensitive PI under the U.S. Privacy Laws. Certain U.S. Privacy Laws require us to state that you have the right to direct businesses to limit the use and disclosure of Sensitive PI if they use or disclose it beyond certain internal business purposes. We do not process Sensitive PI in a way that would make that limitation right applicable.

Right to Know/Access
Based on your state of residence, we may apply a limit on the number of “right to know”/access requests that you make over a particular time period, as permitted by U.S. Privacy Laws.

Right to Know – Categories of PI (available for California Residents only)
You have the right to request any of the following information, for the period that is 12 months prior to the request date:

• The categories of PI we have collected about you.
• The categories of sources from which we collected your PI.
• The business or commercial purposes for our collecting your PI.
• The categories of PI, if any, that we have sold or shared to third parties in the prior 12 months, and for each, the categories of recipients, or that no sale has occurred.
  The business or commercial purpose for selling or sharing your PI.
• The categories of PI, if any, that we have disclosed for a business purpose to third parties, and for each, the categories of recipients, or that no sale has occurred.

Right to Know – Specific Pieces
You have the right to make or obtain a transportable copy, no more than twice in a 12-month period, of the specific pieces of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining. Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.

Right to Confirm Processing
You have the right to confirm if we are processing your PI, which you can request pursuant to the methods above, and to access your personal information as just stated in the two immediately prior paragraphs.

Right to Delete
You may request that we delete your PI that we have collected directly from you (or about you, depending on where you reside) and are maintaining, subject to certain exceptions which we will explain (if they apply). After we confirm that your deletion request is a Verifiable Consumer Request, subject to permitted retention exceptions, we will carry out one or more of the following: (i) permanently erase your PI on our existing systems with the exception of archived or back-up systems, (ii) deidentify your PI, or (iii) aggregate your PI with other information. In our response to your request to delete, we will tell you the method for deleting your PI. Where legal exceptions will apply to your request for deletion, we will tell you which one(s) and will limit retention to the permitted purpose(s). You may alternatively exercise more limited control of your PI by instead exercising one of the following more limited opt-outs: commercial email opt-out or deletion of your MOD Rewards account.

Right to Correct
You have the right to request that we correct inaccuracies that you find in your personal information maintained by us. Your request to correct is subject to our verification (discussed above) and the response standards in the applicable U.S. Privacy Laws.

Do Not Sell/Share/Target
Under the various U.S. Privacy Laws, Consumers have the right to opt-out of certain processing activities. California and certain other states have opt-outs specific to targeted advertising activities – which California’s law refers to as “cross-context behavioral advertising,” and others simply as targeted advertising – which involve the use of PI from different businesses or services to target advertisements to you. California provides Consumers the right to opt-out of Sharing, which includes providing or making available PI to third parties for such targeted advertising activities, while other states provide Consumers the right to opt-out from processing PI for Targeted Advertising more broadly. There are broad and differing concepts of the Sale of PI under the various U.S. State Privacy Laws, all of which at a minimum require providing or otherwise making available PI to a third party.

Third-party digital businesses (“Third-Party Digital Businesses”) may associate Tracking Technologies that collect PI about you on our Services, or otherwise collect and process PI that we make available about you, including digital activity information. Giving access to PI on our Services, or otherwise, to Third-Party Digital Businesses could be deemed a sale and/or sharing, and could implicate targeted advertising under some state laws. Therefore, we will treat such PI collected by Third-Party Digital Businesses (e.g., cookie ID, IP address, other online IDs, and internet or other electronic activity information) as such, and subject to the opt-out requests described above. In some instances, the PI we make available about you is collected directly by such Third-Party Digital Businesses using Tracking Technologies on our Services or our advertisements that are served on third-party sites (which we refer to as “cookie PI”). However, certain PI which we make available to Third-Party Digital Businesses is information that we have previously collected directly from you or otherwise about you, such as your email address (which we refer to below as “non-cookie PI”).

When you opt out pursuant to the instructions below, it will have the effect of opting you out of sale, sharing, and targeted advertising, such that our opt-out process is intended to combine all of these state opt-outs into a single opt-out. Instructions for opting out are below. Please note that there are distinct instructions for opting out of cookie PI and non-cookie PI, which we explain further, below.

Opt-out for non-cookie PI: If you would like to submit a request to opt-out of our processing of your non-cookie PI (e.g., your email address) for targeted advertising, or opt-out of the Sale or Sharing of such data, make an opt-out request here or call us at 877-212-0465 (U.S. toll-free).

Opt-out for cookie PI: If you would like to submit a request to opt-out of our processing of your cookie-related PI for targeted advertising, or opt-out of the sale/sharing of such PI, you can exercise an opt-out request by visiting here and following the instructions. You must exercise your preferences on each of our websites you visit, from each browser you use, and on each device that you use. Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective, and you will need to enable them again via our cookie management tool.

Your Additional Cookie Choices
Advertisers and service providers may use cookies and other Tracking Technologies to recognize your computer or device and/or to collect and record information about your visits to the MOD Services and other websites so that they can facilitate feature functionality, measure the effectiveness of ads, track page usage and paths followed during visits, and provide interest-based advertisements to you. These companies may provide this data to us. If you would like more information about this practice and to know your choices about certain kinds of online interest-based advertising, please visit National Advertising Initiative Consumer Opt Out, Digital Advertising Alliance Your AdChoices, or AdChoices for your mobile device. MOD does not provide any assurances that these third-party tools, programs, or statements are complete or accurate.
Some of the U.S. Privacy Laws also require us to state that we do not knowingly Sell or Share the PI of Consumers under 16.

We may disclose your PI for the following purposes, which are not a sale or sharing: (i) if you direct us to share your PI; (ii) to comply with your requests under the U.S. Privacy Laws; (iii) disclosures amongst the entities that constitute MOD as defined above, to MOD’s service providers, or as part of a Corporate Transaction; and (iv) as otherwise required or permitted by applicable law.

Global Privacy Control or GPC
Some of the U.S. Privacy Laws require businesses to process GPC signals, referred to in some states as “opt-out preference signals” and in other states as “universal opt-out mechanisms.” GPC is a signal sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the Sale and Sharing of PI and processing of PI for Targeted Advertising. To use GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the GPC. In the meantime, to our knowledge, we have configured our website to receive and honor GPC signals pursuant to the specification and implementation instructions at https://globalprivacycontrol.org/.
Please note that when we receive and process a GPC signal, we will apply such signal as an opt-out of Sale and Sharing as to cookie PI. In order to make a Do Not Sell/Share/Target request as to non-cookie PI, please visit the DO NOT SELL/SHARE/TARGET Section above. We do not: (1) charge a fee for use of our website if you have enabled GPC; (2) change your experience with websites if you use GPC; or (3) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the GPC.

Automated Decision Making and Profiling
We may engage in processing that constitutes automated decision-making or profiling under the CCPA. However, as of the effective date of this State Notice, the definitions of these concepts, and any associated opt-out and access rights have not been added to the updated regulations of the CCPA.
We do not believe we carry out profiling in furtherance of decisions that produce legal or similarly significant effects in a manner that requires providing an opt-out. If we change our practices, we will change this policy and provide you with the right to opt-out of such activities as required by Virginia law, subject to any applicable exceptions.

Right to Appeal
Residents of Colorado, Connecticut, and Virginia may appeal MOD’s decision regarding a request as will be described in our response to your request.

Right to Non-Discrimination
You have the right not to receive discriminatory treatment for the exercise of your privacy rights.

Incentive/Loyalty Programs Notice
This incentive programs notice applies to Consumers in states where such a notice is required. We will not discriminate against you in a manner prohibited by the U.S. Privacy Laws because you exercise your Consumer privacy rights. However, we may charge a different price or rate, or offer a different level or quality of good or service, to the extent that doing so is reasonably related to the value of the applicable data. In addition, we may offer you financial incentives for, or related to, the collection, sale, and retention and use of your PI as permitted by the U.S. Privacy Laws that can, without limitation, result in reasonably different prices, rates, or quality levels. The material aspects of any incentive program will be explained and described in its program terms.

To review our MOD Rewards Program Terms, click here.
The categories of PI we collect and retain in connection with our incentive programs includes identifiers and contact information, personal records, consumer characteristics, commercial information, Services usage information, location data, and inferences from PI we may collect in connection with your interaction with our Services and/or participation in any of our incentive programs. We do not collect Sensitive PI as part of our incentive programs, and Sensitive PI is not required to take advantage of any incentive program benefits. Of the categories of PI collected through our incentive programs mentioned previously in this paragraph, all will be sold or processed for targeted advertising except location data. The categories of recipients that will receive the PI collected in respect of incentive programs are Business Vendors, Marketing Vendors, Payment Processing Vendors, Ordering and Delivery Platforms, Authorized Operators, Affiliates, and Third-Party Digital Businesses. We do not disclose PI to Data Brokers, including PI collected in respect of incentive programs. We do not utilize any partners referred to under Colorado law as “Bona Fide Loyalty Program Partners” to provide benefits of our incentive programs. Please note that participating in incentive programs is entirely optional, you will have to affirmatively opt-in to the program and you can opt-out of each program (i.e., terminate participation and forgo the ongoing incentives) prospectively by following the instructions in the applicable program description and terms. We may add or change incentive programs and/or their terms by posting notice on the program descriptions and terms linked to above so check them regularly.

For purposes of U.S. Privacy Laws, we treat the value of your PI collected through our incentive programs as equivalent to the value of the program benefits, including free products, discounts, and coupons, the calculation of the value of which will depend on individual customer participation. By participating in an incentive program, you acknowledge that the benefits are reasonably related to the value of the PI collected and retained.

As discussed above, you will no longer be able to participate in our incentive program known as MOD Rewards if you make a request to delete PI. This is because we need the PI collected in relation to the MOD Rewards program, including certain information that falls within the identifiers and contact information, personal records, commercial information, Services usage information, and inferences categories mentioned above, in order to administer the MOD Rewards program. Therefore, if you request that we delete your PI, we will do so, subject to legal exceptions mentioned above, because without that information it will not be possible to provide you with the MOD Rewards program (e.g., to communicate with you regarding your rewards, collect and retain your purchase information which rewards are based on, etc.).

Our Rights and the Rights of Others
Notwithstanding anything to the contrary, we may collect, use, and disclose your PI as required or permitted by applicable law and this may override your rights under U.S. Privacy Laws. In addition, we need not honor any of your requests to the extent that doing so would infringe upon our or any other person or party’s rights or conflict with applicable law.

Other State Law Disclosures

1. California Additional Disclosures
   We provide California residents with the option to opt out of sharing “personal information,” as defined by California’s “Shine the Light” law, with third parties, such as our authorized operators, for such third parties’ own direct marketing purposes. California residents may exercise that opt-out, and/or request information about MOD’s compliance with the Shine the Light law, by sending a letter to MOD at 2035 158th Ct NE, Suite 200 Bellevue, WA 98008 (Attention: Customer Service). Requests must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that MOD is only required to respond to one request per customer each year.
   Any California residents under the age of eighteen (18) who have registered to use the Services, and who posted content or information on the Services, can request removal by contacting MOD at 2035 158th Ct NE, Suite 200 Bellevue, WA 98008 (Attention: Customer Service). Requests must include “California Privacy Rights Request” in the first line of the description and include your street address, city, state, and ZIP code. Requests must detail where the content or information is posted and attest that you posted it. MOD will then make reasonable good faith efforts to remove the post from prospective public view or anonymize it so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content by search engines and others that MOD does not control.
2. Nevada. Under Nevada law, Nevada residents may opt out of the sale of certain “covered information” collected by operators of websites or online services. We currently do not sell covered information, as “sale” is defined by such law, and we don’t have plans to sell this information. However, if you would like to be notified if we decide in the future to sell personal information covered by the Act, please visit our webform linked above in the “Your Consumer Rights and How to Exercise Them” section, and provide the information requested. You are responsible for updating any change in your email address by the same method, and we are not obligated to cross-reference other emails you may have otherwise provided us for other purposes. We will maintain this information and contact you if our plans change. At that time, we will create a process for verifying your identity and providing an opportunity to verified consumers to complete their opt-out. Please become familiar with our data practices as set forth in this Privacy Policy. We may share your data as explained in this Privacy Policy, such as to enhance your experiences and our services, and those activities will be unaffected by a Nevada Do Not Sell Request. You may also have other choices regarding our data practices as set forth elsewhere in this Privacy Policy.

California HR Data Privacy Notice

LAST UPDATED: February 6, 2024

This California HR Data privacy notice (“CA HR Notice”) describes MOD Pizza’s processing of California residents’ personal information in various human resources (HR) contexts, as required under California’s privacy law, the California Consumer Privacy Act, which is also known as the “CCPA.” We are providing this CA HR Notice to you to meet our obligations under the CCPA. In this CA HR Notice, “we,” “us,” “our,” and “MOD Pizza” are used to refer to MOD Super Fast Pizza, LLC and/or its affiliates or authorized operators (collectively, “MOD Pizza”).

If you are a California resident and have interacted with us or otherwise provided us with personal information in the following HR contexts in the bulleted lists below, please read this policy carefully as it describes how we collect, use, retain, disclose, and otherwise process your personal information, and the rights you have under California law as to your personal information.

• Current/Former Employees. You are a current or former employee of MOD Pizza.
• Independent Contractor. You are a current or former contractor of MOD Pizza.
• Job Applicant. You have applied to a position with MOD Pizza previously, such as on https://jobs.modpizza.com/ or in person at a MOD Pizza location.

This CA HR Notice also applies to California residents whose family member or friend has provided information about you to MOD Pizza in an HR context, such as if:

• You are listed as an emergency contact for a MOD Pizza employee or former employee.
• You are a beneficiary or dependent of a MOD Pizza employee or former employee.

If you have interacted with a MOD Pizza authorized operator (e.g., a franchise location) in an HR context, then this CA HR Notice does not apply to you. Please contact the MOD franchise location for any questions about its data processing and handling activities.
Importantly, this CA HR Notice does not apply to our data practices outside of the HR context. For example, if you visit the consumer-facing aspects of our website (www.modpizza.com) or our mobile application, or visit one of our California stores as a consumer, the posted privacy policy (https://modpizza.com/privacy-policy/ or such other URL as MOD Pizza may provide and as may be amended from time to time) will apply, and describes our data practices in that context.

In the event of a conflict between any other MOD Pizza policy, statement or notice and this CA HR Notice, this CA HR Notice will prevail as to personal information collected in an HR context, unless stated otherwise.

• Section 1 of this CA HR Notice provides notice of our data practices, including our collection, use, and disclosure of California residents’ personal information in an HR context.
• Section 2 of this CA HR Notice provide information regarding California residents’ rights under the CCPA and how you may exercise them.
• Sections 3-5 include other information required by the CCPA or information that we believe is helpful to provide to you as part of this CA HR Notice

NOTICE OF DATA PRACTICES

As required by the CCPA, this CA HR Notice is designed to provide you with notice of our recent, historical data practices over the prior 12 months (from the Last Updated listed at the top of this CA HR Notice). This CA HR Notice will be updated at least annually.

This CA HR Notice also applies to our current data practices such that it is also meant to provide you with notice of personal information we collect and the purposes for which we process personal information, among other things required by the CCPA. For any new or substantially different processing activities that are not described in this CA HR Notice, we will notify you as required by the CCPA, including by either notifying you at the time of collecting personal information, or by updating this CA HR Notice earlier than required.

PI Collection and Retention
The first column in the table below lists the categories of personal information we collect, while the second column provides examples of types of personal information within such category. We collect the following categories of personal information listed in the below table. We disclose or otherwise make available personal information to our vendors and affiliates, and other parties for the purposes as more fully set forth in the table below. Generally, we disclose personal information for business purposes, and may be considered to “sell” and/or “share” certain categories of personal information to Cookie Operators (defined below), as more fully discussed in the Do Not Sell/Share section below where we describe your rights to opt out of the “sale” and “sharing” of personal information.

Scope of PI: There may be additional information that we collect that meets the definition of PI under the CCPA but is not reflected by a category above, in which case we will treat it as PI as required, but will not include it when we describe our practices by category of PI.

Retention Details: The CCPA requires us to either disclose length of time we intend to retain each category of personal information listed above, or if that is not possible, the criteria used to determine the period of time it will be retained. Because there are so many different types of personal information in each category, and so many purposes and use cases for different data, we have determined that it is not possible to disclose in a clear manner how long we intend to retain each category. The criteria for determining the retention period is whether we have a legitimate purpose for the retention consistent with the collection purposes and applicable law, and/or a legal obligation or right to retain the data. For instance, we may maintain business records for so long as relevant to our business, and/or may have a legal obligation to hold PI for so long as potentially relevant to prospective or actual litigation or government investigation.

Sources of PI
We may collect your PI from a number of sources, including:

• You, such as when you apply for a position or become employed or engaged by us (e.g., identification/identity data, contact details, educational and employment data), or otherwise during the course of your employment or engagement
• Your devices and our equipment and systems
• From other personnel through interactions in the course of employment or engagement (e.g., performance reviews by your supervisor, information provided by a co-worker, etc.)
• From third parties (e.g., background check and vendors, references, job agencies), including third-party online services, and from public sources of data
• Our affiliates
• If you are an emergency contact, beneficiary, or dependent, from your family member or friend who is employed by us.

Use of PI
Generally, we collect, retain, use, and disclose your personal information for HR business purposes and as otherwise related to the operation of our business. Our HR business purposes include the following:

• Recruitment
• Employee Intake/Onboarding/Offboarding
• Payroll, Reimbursements, and Timekeeping
• Benefits
• Employee activation initiatives and communications
• Training programs and education
• HR IT Systems and Security
• Employee and Performance Management
• Health & Safety/Occupational Health
• Security (including electronic and of premises)
• Other purposes disclosed at the time you provide your information or done at your direction
• For our legitimate business purposes that are compatible with the purpose of collecting your personal information and that are not prohibited by law

Additional business purposes that apply to our business more broadly, and that may apply in the HR context, include:

• • To assignees or potential assignees as part of an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business
  • Compliance with legal obligations or legal process;
  • Where we believe we need to in order to investigate, prevent or take action if we think someone might be using information for illegal activities, fraud, or in ways that may threaten someone’s safety or violate our policies or legal obligations;
  • Debugging
  • Performing Services
  • Providing Advertising & Marketing Services (e.g., to potential applicants regarding open positions)
  • Quality Assurance
  • Research and Development

 

The italicized business purposes in the list are those that are specifically defined in the CCPA. Our vendors may also use your PI for business purposes, and may engage their own service providers or subcontractors to enable them to perform services for us.

YOUR HR DATA RIGHTS AND HOW TO EXERCISE THEM

MOD Pizza provides California residents the privacy rights described in this section, pursuant to our obligations under the CCPA. To exercise your privacy rights, or, if you are an authorized agent of another exercising privacy rights on behalf of someone else, you can submit a request by visiting https://privacyportal-cdn.onetrust.com/dsarwebform/0d1b297a-e5e0-4ff1-8168-93433dbc3d5c/9a642599-67cf-4662-bd2a-5c561ac9dac7.html and following the instructions there, or call us at 877-212-0465 (U.S. toll-free) and indicate that you are an employee, former employee, applicant, or have otherwise interacted us in an HR context as described in this HR CA Policy.

Please respond to any follow-up inquiries we make, including in relation to the request verification process that we describe further below. Please be aware that we do not accept or process requests through other means (e.g., via fax, chats, social media, etc.).

Right to Know/Access
You can make “right to know” (also known as “access”) requests, as described below, up to twice in a 12-month period.

Categories of Personal Information
You have the right to request that we share with you certain information about our collection, use and disclosure of your PI over the 12-month period prior to the request date. You can request that we disclose to you: (1) the categories of PI we collected about you; (2) the categories of sources for the PI; (3) our business or commercial purpose for collecting or selling that PI (i.e., if we have, in fact, sold PI); (4) the categories of third parties with whom we shared that PI; (5) a list of the categories of PI disclosed for a business purpose in the prior 12 months and, for each, the categories of recipients, or that no disclosure occurred; and (6) a list of the categories of PI sold about you in the prior 12 months and, for each, the categories of recipients, or that no sale occurred.

Specific Pieces
You have the right to request a transportable copy of the specific pieces of personal information we collected about you in the 12-month period preceding your request. Please note that personal information is retained by us for various time periods, so there may be certain information that we have collected about you that we do not even retain for 12 months (and thus, it would not be able to be included in our response to you).

Right to Limit Sensitive PI Processing
Certain personal information qualifies as “sensitive” under CCPA, which we refer to in this CA HR Notice as “Sensitive PI”. You have the right to direct businesses to limit their use and disclosure of Sensitive PI if we use or disclose it beyond certain internal business purposes.

We do not believe we use or disclose Sensitive PI beyond such internal business purposes, and therefore, this does not apply to our processing of Sensitive PI.

Do Not Sell/Share
You have the right to opt-out of the “sale” and “sharing” of your personal information, which are defined in the CCPA in ways that are different from their normal meanings as you may understand them. “Sale” of personal information includes “making available” of personal information to a third party, and “sharing” of personal information includes the “making available” of personal information to a third party for targeted advertising that is served based on an individual’s activity across different websites, applications, or services (defined in the CCPA as “cross-context behavioral advertising” and sometimes referred to as “interest-based advertising”). Neither concept requires money to be exchanged.

At this time, we do not believe that we engage in sales with respect to personal information collected in the HR context. Therefore, we do not offer an opt-out of such activities like we do as described in our non-HR State Notice above.

The CCPA also requires us to state that we do not knowingly “sell” or “share” the PI of Consumers under 16.

We may disclose your PI for the following purposes, which are not a “sale” or “sharing”: (i) if you direct us to disclose PI; (ii) to comply with a Consumer rights request you submit to us; (iii) disclosures amongst the entities that constitute Company as defined above, or as part of a Corporate Transaction; and (iv) as otherwise required or permitted by applicable law.

Opt-Out Preference Signals (also known as Global Privacy Control or GPC)
The CCPA requires businesses that “sell” or “share” personal information to process opt-out preference signals (“OOPS”), which are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the “sale” and “sharing” of personal information. One common example of the opt-out preference signal is GPC (more information can be found at https://globalprivacycontrol.org/). To use an OOPS/GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the OOPS/GPC.
Because we do not believe we “sell” or “share” personal information collected in the HR context, we do not process OOPS/GPC signals in this context.

Right to Delete
You have the right to request that we delete personal information that we collected directly from you. However, we may have retention rights or obligations that apply, such as for legal, security, or internal business purposes such as maintaining business records, which we will take into consideration when processing your request.

Correct Your Personal Information
You have the right to request that we correct inaccuracies that you find in your personal information maintained by MOD Pizza. Your request to correct is subject to our verification (discussed below) and the CCPA’s response standards.
For current employees, in addition to making a request as described above, you may be able to correct certain information in the employee management system by logging and making the appropriate changes.

Automated Decision Making/Profiling
We may engage in processing that constitutes automated decision-making or profiling under the CCPA. However, as of the Last Updated date, the definitions of these concepts, and any associated opt-out and access rights, have not been added to the updated CCPA and finalized.

Non-Discrimination/No Retaliation
You have the right not receive discriminatory treatment or retaliated against for your exercise of your privacy rights. Accordingly, we will not discriminate or retaliate against you if you exercise your CCPA rights.

VERIFYING YOUR REQUESTS, AGENT REQUESTS, AND OUR RESPONSES

Request Verification Process

As required by the CCPA, when you make a request, we will verify that you are the person you say you are, or, if you are seeking information on behalf of another person, that you are authorized to make the request on their behalf. In addition, we will compare the information you have provided to ensure that we maintain personal information about you in our systems. We may ask initially that you provide certain verifying information, including, but not limited to: last four digits of SSN, employee number, and your last known address. We will review the information provided as part of your request, and we may ask you to provide additional information via e-mail or other means as part of this verification process. We will not fulfill your Right to Know (Categories), Right to Know (Specific Pieces), Right to Delete, or Right to Correction request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. The same verification process does not apply to opt-outs of “sale” or “sharing,” or Limitation of Sensitive PI requests, but we may apply some authentication measures if we suspect fraud (such as verifying access to the email address or phone number provided when making the request).

The verification standards we are required to apply for each type of request vary.

We verify your categories requests and certain deletion and correction requests (e.g., those that are less sensitive in nature) to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you. For certain deletion and correction requests (such as those that relate to personal information that is more sensitive in nature) and for specific pieces requests, we apply a verification standard of reasonably high degree of certainty. This standard includes matching at least three data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you, and may include obtaining a signed declaration from you, under penalty of perjury, that you are the individual whose personal information is the subject of the request.

If we cannot verify you in respect of a certain requests, such as if you do not provide the requested information, we will still take certain action as required by the CCPA. For example:

• If we cannot verify your deletion request, we will refer you to this CA HR Notice for a general description of our data practices.
• If we cannot verify your specific pieces request, we will treat it as a categories request.

Agent Requests
You may use an authorized agent to make a request for you, subject to our verification of (i) the agent, (ii) the agent’s authority to submit requests on your behalf, and (iii) of you. You can learn how to do this by visiting the agent section of our Consumer Rights Request Portal. Once your agent’s authority is confirmed, they may exercise rights on your behalf subject to the agency requirements of applicable U.S. Privacy Laws.

Our Responses
Some personal information that we maintain is insufficiently specific for us to be able to associate it with an individual (e.g., clickstream data tied only to a pseudonymous browser ID). We do not include that personal information in response to those requests. If we cannot comply with a request, we will explain the reasons in our response.

We will make commercially reasonable efforts to identify personal information that we maintain to respond to your requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may suggest you receive the most recently collected PI or a summary of your PI and give you the opportunity to elect whether you want the rest. We reserve the right to direct you to where you may access and copy responsive PI yourself. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

Consistent with applicable U.S. Privacy Laws and our interest in the security of your PI, we will not deliver to you your Social Security number, driver’s license number, or other government-issued ID number, financial account number, any health or medical identification number, an account password, or security questions or answers in response to a Consumer privacy rights request; however, you may be able to access some of this information yourself through our employee management system if you are still employed with us.

Our Rights and the Rights of Others
We may collect, use, and disclose your PI as required or permitted by applicable law and this may override your rights and our obligations under the CCPA and as otherwise set forth in this CA HR Notice. In addition, we are not required to honor your requests to the extent that doing so would infringe upon our or another person’s or party’s rights or conflict with applicable law.

CONTACT US

If you have any questions or concerns about our data practices, please contact us at: feedback@modpizza.com
For current employees, please contact us on the MOD line or the email address below.
For all others who have interacted with us in an HR context, such as former employees and job applicants, please contact us at feedback@modpizza.com.