California Privacy Notice

 

Last Updated: October 21, 2024

 

This California Privacy Notice (this “Notice”) supplements the information contained in our Privacy Policy and applies solely to California residents.

 

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 and its implementing regulations (collectively, the “CCPA”) provides California residents with certain rights with respect to their personal information. Pursuant to the CCPA, this Notice provides details regarding our collection, use, and disclosure of California residents’ personal information. This Notice also describes the rights available to California residents in relation to their personal information and how they can exercise their rights.

 

Unless otherwise expressly stated, all terms used in this Notice have the same meanings ascribed to them in our Privacy Policy.

 

Personal information collection and disclosure

The following chart details which categories of personal information we have collected from and about California residents in the past twelve (12) months, the source(s) of each category of information, the categories of third parties to whom we have disclosed each category of information for a business purpose, and the categories of third parties to whom we have “sold” or with whom we have “shared” each category of information (as such terms are defined in the CCPA) (where applicable). Please note that the first column in the chart lists by category the types of information described in the “Collection of Personal Information” section of our Privacy Policy, as required by the CCPA.

 

Category of Personal Information	Categories of Sources	Disclosures of Personal Information for a Business Purpose	Sale or Sharing of Personal Information
Identifiers, including names, postal addresses, email addresses, online identifiers, IP addresses, account names, and other similar identifiers (e.g., social media identifiers).	Directly from individuals   Through automated means   Third-party sources	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:    - Our service providers   - Our research partners   - Our analytics partners	Panera has sold or shared this category of information in the past twelve (12) months to or with the following categories of third parties:   - Our analytics partners   - Our marketing and advertising partners (including social media networks)   - Third-party data providers (including data aggregator and data brokers)
Personal information categories listed in the California Customer Records statute, including names, postal addresses, telephone numbers, and credit and debit card information.	Directly from individuals	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:   - Our service providers	Panera has sold or shared this category of information in the past twelve (12) months to or with the following categories of third parties:   - Third-party data providers (including data aggregator and data brokers)
Protected classification characteristics under California law or federal law, including age (over 40) and sex/gender expression.	Directly from individuals	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:   - Our service providers
Commercial information, including items purchased, obtained, or considered and other purchasing or consuming histories or tendencies.	Directly from individuals   Through automated means   Third-party sources	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:   - Our service providers   - Our research partners   - Our analytics Partners	Panera has sold or shared this category of information in the past twelve (12) months to or with the following categories of third parties:   - Our analytics partners   - Our marketing and advertising partners (including social media networks)   - Third-party data providers (including data aggregator and data brokers)
Internet or other electronic network activity information, including internet browsing history, search history, and information about interactions with the Digital Properties and advertisements.	Through automated means   Third-party sources	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:   - Our service providers   - Our analytics partners	Panera has sold or shared this category of information in the past twelve (12) months to or with the following categories of third parties:  - Our analytics partners   - Our marketing and advertising partners (including social media networks)
Geolocation data, such as IP location.	Through automated means	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:   - Our service providers   - Our analytics partners	Panera has sold or shared this category of information in the past twelve (12) months to or with the following categories of third parties:   - Our analytics partners   - Our marketing and advertising partners (including social media networks)
Audio, electronic, visual, or similar information, such as recordings of phone calls or drive-thru interactions (where permitted by law) and CCTV video footage.	Directly from individuals   Through automated means	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:   - Our service providers
Professional or employment-related information, including job roles/titles and employer names.	Directly from individuals	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:   - Our service providers
Inferences, meaning inferences drawn from any of the information in the above-listed categories of information.	Through automated means    Third-party sources	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:   - Our service providers
Sensitive personal information, including log-in information for accounts in combination with passwords allowing access to the accounts and individuals’ precise geolocation.	Directly from individuals   Through automated means	Panera has disclosed this category of information for a business purpose in the past twelve (12) months to the following categories of third parties:   - Our service providers

 

 Purposes for collecting personal information

As described in more detail in the “Use of Personal Information” section of our Privacy Policy, we collect the above-listed categories of personal information to provide and manage the Services, to process and fulfill orders, and as otherwise necessary or appropriate to support and market our business and fulfill other legitimate business or commercial purposes.

 

Disclosures of personal information

As described in more detail in the “Disclosure of Personal Information” section of our Privacy Policy, we disclose the above-listed categories of personal information to fulfill the purposes described above. We will also disclose certain categories of personal information to government and public authorities and other third parties as necessary or appropriate, including when we have a legal or contractual obligation to disclose the information.

 

Sale and sharing of personal information

As detailed in the chart above, we “sell” and “share” (as such terms are defined in the CCPA), certain categories of personal information to and with third parties and have “sold” and “shared” certain categories of personal information in the past twelve (12) months. Please refer to the chart above for additional details.

 

We do not “sell” or “share” the personal information of individuals we know to be under 16 years of age, unless we receive consent from either an individual who is between 13 and 16 years of age or the parent or guardian of an individual less than 13 years of age.

 

Use and disclosure of sensitive personal information

As detailed in the chart above, we collect certain “sensitive personal information” (as defined in the CCPA). However, we do not use or disclose sensitive personal information for any purpose outside of the limited permissible purposes set forth in the regulations implementing the CCPA. Such purposes include providing the Services; preventing, detecting, and investigating security incidents; and verifying, maintaining the quality of, and improving the Services.

 

Individual rights and requests

As a California resident, you have the right to request that we:

- Disclose to you the following information covering the twelve (12) months preceding your request:

- the categories of personal information we have collected about you and the categories of sources from which we collected such information;

- the specific pieces of personal information we have collected about you;

- the business or commercial purpose for collecting, selling, or sharing personal information about you;

- the categories of third parties to whom we disclosed such personal information; and

- if we sold, shared, or disclosed your personal information for a business purpose, two separate lists disclosing:

- sales and shares, identifying the personal information categories that each category of recipient received; and

- disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

- Correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of the processing.

- Delete the personal information that we have collected from you, subject to certain exceptions.

 

We will not discriminate against you if you decide to exercise your rights under the CCPA. Please note that certain rights are subject to applicable exceptions under the CCPA.

 

If you are a California resident and interested in exercising any of the above-listed rights, you can do so by:

 

- completing and submitting the form available here;

- calling us at 1-855-3-PANERA and asking to exercise your California privacy rights; or

- asking the manager of a California café for assistance (if available).

 

Exercising your rights does not require you to create an account with us. However, in order to protect your privacy, we will require the matching of up to three (3) pieces of personal information provided with your request with information we maintain in order to verify that it is you making the request. Where applicable, we will use the requested information for verification purposes only. Please note that we may decline a request where we are unable to verify your identity and confirm the personal information we maintain relates to you.

 

Authorized agents

You may authorize someone to submit a privacy rights request on your behalf (an “authorized agent”). An authorized agent will need to demonstrate that you’ve authorized them to act on your behalf, unless you have provided the agent with power of attorney pursuant to applicable probate law. Depending on the evidence provided, we may also contact you to verify your identity with us or request confirmation from you that the agent is authorized to submit the request on your behalf.

 

Exercising your sale and sharing opt-out right

As detailed in the chart above, we “sell” and “share” certain categories of personal information to and with third parties. If you are a California resident who is 16 years of age or older, you have the right to direct us to not “sell” or “share” your personal information at any time. To exercise your opt-out right, you may submit a request to us by:

 

- clicking the “Do Not Sell or Share My Personal Information” link located in the footer of a Website and following the instructions (the opt-out request will only apply to your current browser/browser profile and your MyPanera account (if you are logged into your account)); and/or

- navigating to the “Security & Privacy” section of your settings in the Mobile App and following the instructions (the opt-out request will only apply to your current mobile device and your MyPanera account (if you are logged into your account)).

 

Please note that if you interact with and use multiple Websites (either as a MyPanera member or as a guest), you will need to submit your opt-out request on each Website. Additionally, if you do not have a MyPanera account (or if you are not logged into your MyPanera account) and submit an opt-out request using one of the methods outlined above, please note that you will have to submit your opt-out request again if you delete or reset your browser’s cookies, change browsers/browser profiles, use a different device, or uninstall the Mobile App from your device.

 

Alternatively, where available, you can use certain preference signals to exercise your  opt-out right automatically with all businesses that you interact with online, including Panera. If you enable a browser-based opt-out preference signal that complies with the CCPA, such as the Global Privacy Control (GPC), upon receipt or detection, we will treat the signal as a valid request to opt out of the sale or sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.

 

You can also submit an opt-out request by completing and submitting the form available here. Please note that an opt-out request submitted via the form will apply to offline sales or sharing of your personal information only.

 

An authorized agent may also use the methods described above to submit an opt-out request on your behalf if you provide the agent with signed permission to do so. Please note that we may request from the agent documentation demonstrating that they have your authority to act on your behalf.

 

“Shine the Light” notice

In addition to the rights described above, California’s “Shine the Light” law permits California residents that have an established business relationship with us to request certain information regarding our disclosure of certain types of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year.

 

To make such a request, please contact us using the mailing address included in the “Contact us” section below. This request may be made no more than once per calendar year. We will respond to your request in accordance with applicable law. We reserve the right not to respond to requests submitted other than to the mailing address specified in this section.

 

Notice of financial incentive

We currently offer the MyPanera Program (the “Program”), which allows members to earn personalized rewards and discounts. Participation is free for eligible customers. Additional Program terms can be found here. To join the Program, please visit this page and click “Join MyPanera.”

 

We may also provide discounts or promotions when you agree to receive marketing messages and communications from us or claim a specific offer when you interact with us and/or the Services (each, an “Offer”). The terms of each Offer will be provided to you when it is made available. You may opt out of marketing messages and communications from us at any time as described in our messages to you and as described in the “Your Choices and Legal Rights” section ofour Privacy Policy.

 

We collect and retain personal information to support and fulfill the Program and certain Offers, which may include information in the following categories:

 

- Identifiers

- Personal information categories listed in the California Customer Records statute

- Commercial information

- Internet or other electronic network activity information

- Geolocation data

- Inferences

 

The personal information we collect and retain is also used to make or to supplement your MyPanera account information (where applicable). Additional details regarding our use of personal information can be found in the “Use of Personal Information” section of our Privacy Policy.

 

Because we collect and retain personal information in connection with our administration of the Program and certain Offers, they may be considered “financial incentives” or “price or service differences” under California law. The value of the personal information we collect will vary based on the Program or Offer and is calculated based on expenses related to offering the Program or Offer, which may include the costs associated with providing discounts or promotions, IP or marketing-related costs, and other related expenses.

 

You have the right to opt out of the Program and any Offer at any time in accordance with the terms of the Program or Offer or by contacting our Customer Care Center (contact details are available here).

 

Updates to this Notice

We may change or modify this Notice from time to time to reflect changes in our practices with respect to the collection, use, and disclosure of personal information and/or changes in applicable law.

 

The “Last Updated” date at the top of this page indicates when this Notice was last revised. If we make changes, we will revise the date at the top of this Notice and, in the case of material changes to this Notice, we may provide you with additional notice.

 

Unless otherwise stated, the current version of this Notice applies to the personal information of California residents under our control. We encourage you to review this Notice periodically to remain informed about our information handling and privacy practices.

 

Contact us

If you have any questions regarding this Notice, please contact us by accessing our Customer Care Center at https://www.panerabread.com/customercare or write to us at:

 

Panera, LLC

1400 South Highway Drive, Suite 100,

Fenton, Missouri 63026

Attn: Data Privacy Office