Privacy Policy

This Privacy Policy describes how churchzchicken.rest ("we," "us," "our," or "the Company") collects, uses, discloses, retains, and protects your personal information when you visit our website at churchzchicken.rest, place orders, interact with our digital services, or otherwise engage with us. We are committed to protecting your privacy and handling your personal data in a transparent, responsible, and lawful manner consistent with applicable United States federal and state privacy laws.

Please read this Privacy Policy carefully. By accessing or using our website, submitting an order, creating an account, or interacting with any of our digital services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our website and services immediately.

For any privacy-related questions, concerns, or requests, you may contact us at any time using the information provided in the Contact Us section of this policy.

1. Company Information

This Privacy Policy applies to the following business entity:

2. Scope and Applicability

This Privacy Policy applies to all personal information collected through our website (churchzchicken.rest), our online ordering system, any mobile applications we may operate, our social media pages, email communications, telephone interactions, in-store data collection practices, and any other means by which you interact with us as a customer or visitor.

This policy applies to residents of the United States, including but not limited to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Florida, and all other states. Where state-specific rights or obligations apply — particularly under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) — those rights are described in dedicated sections of this policy.

Our services are directed toward individuals who are 18 years of age or older. We do not knowingly collect personal information from children under the age of 13 without verifiable parental consent. Please refer to the Children's Privacy section for more details.

3. Information We Collect

We collect various categories of personal information depending on how you interact with us. Below is a comprehensive description of the types of information we may collect:

3.1 Personal Identification Information

When you create an account, place an order, sign up for our loyalty program, or contact us, we may collect:

• Full name (first and last name)
• Email address
• Phone number (mobile or landline)
• Mailing or delivery address (including street, city, state, and ZIP code)
• Username and password (for registered accounts)
• Date of birth (where required for promotional purposes or age verification)
• Profile photo (if voluntarily provided)

3.2 Payment and Financial Information

When you make a purchase through our website, we collect payment-related information necessary to process your transaction. This may include:

• Credit or debit card number (last four digits only, as full card numbers are processed by our payment processors)
• Billing name and billing address
• Payment method type (e.g., Visa, Mastercard, American Express, PayPal)
• Transaction amounts and order history

Full payment card details are handled by our third-party PCI-DSS compliant payment processors and are not stored on our servers. We retain only the minimum necessary transaction data for order fulfillment, legal compliance, and fraud prevention.

3.3 Order and Food Preference Data

As a food service business, we collect information related to your orders and preferences, including:

• Items ordered, customizations, and special instructions
• Delivery or pickup location preferences
• Dietary preferences or restrictions (if voluntarily provided)
• Order history and frequency
• Loyalty program activity and reward redemptions

3.4 Usage Data and Technical Information

When you visit our website, we automatically collect certain technical and behavioral information, including:

• IP address and approximate geographic location derived from IP
• Browser type, version, and language settings
• Operating system and device type (desktop, mobile, tablet)
• Device identifiers (e.g., mobile advertising ID)
• Pages visited, time spent on pages, and navigation paths
• Referring URLs (the website that directed you to ours)
• Date and time stamps of visits
• Search queries entered on our website
• Links clicked and buttons activated
• Error logs and crash reports

3.5 Communications Data

If you contact us via email, phone, live chat, or our contact form, we may collect and retain:

• The content of your messages and correspondence
• Your contact details as provided in your communication
• Records of phone calls (where permitted by law and with appropriate notice)
• Feedback, reviews, and survey responses
• Customer service tickets and resolution notes

3.6 Cookies and Tracking Technologies

We use cookies, web beacons, pixel tags, local storage objects, and similar tracking technologies to collect information about your interactions with our website. Please refer to the Cookie Usage section of this policy for detailed information.

3.7 Information from Third Parties

We may receive personal information about you from third-party sources, including:

• Social media platforms (if you log in using a social media account or interact with our social media pages)
• Third-party delivery platforms (e.g., DoorDash, Uber Eats, Grubhub) that process orders on your behalf
• Advertising and analytics partners
• Fraud prevention and identity verification services
• Publicly available sources

4. How We Use Your Information

We use the personal information we collect for a variety of purposes related to providing, improving, and promoting our food services. The primary purposes include:

4.1 Service Provision and Order Fulfillment

• Processing and fulfilling your food orders (delivery, pickup, or dine-in)
• Managing your account and loyalty program membership
• Communicating order confirmations, updates, and delivery notifications
• Processing payments and issuing refunds or credits
• Resolving customer service inquiries, complaints, and disputes
• Personalizing your experience based on past orders and preferences

4.2 Analytics and Service Improvement

• Analyzing website traffic, usage patterns, and user behavior to improve our digital services
• Understanding which menu items are popular and how customers interact with our ordering system
• Monitoring system performance, identifying errors, and debugging technical issues
• Conducting internal research and analysis to develop new products, services, and features
• Measuring the effectiveness of promotions and marketing campaigns

4.3 Marketing and Promotional Communications

• Sending you promotional emails, newsletters, and special offers (with your consent where required)
• Notifying you about new menu items, seasonal specials, and limited-time offers
• Delivering personalized offers and recommendations based on your order history
• Conducting loyalty program communications and reward notifications
• Serving targeted advertising on our website and third-party platforms (see Cookie Usage)

You may opt out of marketing communications at any time by clicking the "Unsubscribe" link in any marketing email, by updating your communication preferences in your account settings, or by contacting us at [email protected].

4.4 Legal and Compliance Purposes

• Complying with applicable federal and state laws and regulations
• Responding to legal process, court orders, or government agency requests
• Enforcing our Terms of Service and other applicable policies
• Detecting, preventing, and investigating fraud, security breaches, and other illegal activities
• Protecting the rights, property, and safety of our company, customers, and the public
• Maintaining records as required by applicable food safety, tax, and business regulations

4.5 Business Operations

• Managing our business relationships and vendor contracts
• Facilitating corporate transactions such as mergers, acquisitions, or asset sales
• Training staff and improving service quality
• Conducting food safety audits and quality assurance programs

5. How We Share Your Information

We do not sell your personal information to third parties for their own marketing purposes. However, we may share your information in the following limited circumstances:

5.1 Service Providers and Business Partners

We engage trusted third-party service providers who perform services on our behalf, including:

• Payment processors: To securely process your payment transactions
• Delivery service partners: To facilitate food delivery to your address
• Cloud hosting and IT providers: To store and manage our data and systems
• Email marketing platforms: To send promotional and transactional communications
• Customer support tools: To manage customer service interactions
• Analytics providers: To analyze website usage and performance (e.g., Google Analytics)
• Advertising technology companies: To serve targeted ads on our behalf
• Fraud prevention services: To detect and prevent fraudulent transactions

All service providers are contractually required to handle your personal information in a manner consistent with this Privacy Policy and applicable law, and are prohibited from using your data for any purpose other than providing services to us.

5.2 Legal Requirements and Law Enforcement

We may disclose your personal information when we believe disclosure is necessary or required to:

• Comply with applicable law, regulation, legal process, or governmental request
• Enforce our Terms of Service or other agreements
• Protect the rights, property, or safety of our company, our customers, or others
• Detect, prevent, or address fraud, security, or technical issues

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

5.4 With Your Consent

We may share your personal information with third parties for other purposes when you have provided explicit consent to do so.

5.5 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties for research, analytics, marketing, or other business purposes.

6. Cookie Usage and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze website traffic, and support our marketing activities. Cookies are small text files stored on your device by your web browser.

6.1 Types of Cookies We Use

You may manage your cookie preferences through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or receive alerts when a new cookie is set. Please note that disabling certain cookies may affect the functionality of our website and your ability to place orders.

For more detailed information about our use of cookies, including a full list of the cookies we use and instructions on how to opt out, please review our dedicated Cookie Policy available on our website.

6.2 Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) signal. Our website does not currently respond to DNT signals in a uniform manner. We encourage you to review the privacy settings available in your browser and use our cookie management tools to exercise control over tracking technologies.

7. Data Security

We take the security of your personal information seriously and implement a variety of technical, administrative, and physical safeguards to protect your data from unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• Encryption: We use industry-standard SSL/TLS encryption to protect data transmitted between your browser and our website. Sensitive data such as payment information is encrypted in transit and at rest.
• Access Controls: Access to personal data is restricted to authorized personnel who need it to perform their job responsibilities. All staff with data access receive privacy and security training.
• Secure Payment Processing: We use PCI-DSS compliant payment processors and do not store full payment card details on our own servers.
• Regular Security Assessments: We conduct periodic security reviews, vulnerability assessments, and penetration testing to identify and address potential weaknesses in our systems.
• Data Minimization: We collect only the personal information necessary for the specified purposes and limit retention periods as described in this policy.
• Incident Response: We maintain a documented data breach response plan and will notify affected individuals and relevant authorities as required by applicable law (including state breach notification laws) in the event of a confirmed security incident.

Despite our best efforts, no method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. You are also responsible for maintaining the confidentiality of your account credentials.

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal and regulatory obligations, to resolve disputes, and to enforce our agreements. Retention periods vary depending on the category of data:

When personal information is no longer required for any legitimate purpose, we will securely delete or anonymize it in accordance with our data retention and disposal procedures.

9. Your Privacy Rights

Depending on your state of residence, you may have various rights with respect to your personal information. We are committed to honoring these rights in accordance with applicable law.

9.1 General Rights Available to All U.S. Residents

• Right to Know / Access: You have the right to request information about what personal data we have collected about you, the sources from which it was collected, the purposes for which it is used, and the categories of third parties with whom it has been shared.
• Right to Correction: You have the right to request that we correct inaccurate or incomplete personal information we hold about you.
• Right to Deletion: You may request that we delete personal information we hold about you, subject to certain exceptions (e.g., where retention is required by law or for legitimate business purposes).
• Right to Opt Out of Marketing: You have the right to opt out of receiving marketing communications from us at any time.

9.2 Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you are entitled to the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), effective January 1, 2023:

• Right to Know (Categories and Specific Pieces): You may request disclosure of the specific pieces of personal information we have collected about you in the past 12 months, as well as the categories of personal information, sources, business purposes, and third-party disclosures.
• Right to Delete: You may request deletion of personal information we have collected about you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. To exercise this right, please contact us at [email protected] or use the "Do Not Sell or Share My Personal Information" link on our website.
• Right to Limit Use of Sensitive Personal Information: Where we collect sensitive personal information (as defined under CPRA), you may have the right to limit its use to certain permitted purposes.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge different prices, provide a different level of service quality, or suggest that you will receive different treatment for exercising your privacy rights.

California residents may submit a privacy rights request by emailing [email protected] with the subject line "California Privacy Rights Request." You may designate an authorized agent to submit requests on your behalf, subject to verification requirements.

9.3 Rights for Residents of Other States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas, and other states with active privacy legislation may have similar rights including access, correction, deletion, data portability, and the right to opt out of targeted advertising and profiling. We will respond to verified requests in accordance with applicable state law. Please contact us at [email protected] to submit a request.

9.4 How to Submit a Privacy Rights Request

To exercise any of your privacy rights, please contact us through one of the following methods:

• Email: [email protected] (Subject: "Privacy Rights Request")
• Website: churchzchicken.rest

We will acknowledge receipt of your request within 10 business days and provide a substantive response within 45 days. If we require additional time, we will notify you and may extend the response period by an additional 45 days where permitted by law.

We may need to verify your identity before processing your request to protect against fraudulent requests. Verification may involve confirming information you have previously provided to us (such as your email address, order history, or account details).

10. Children's Privacy

Our website and services are intended for use by individuals who are 18 years of age or older. We do not knowingly collect, use, or disclose personal information from children under the age of 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506.

If you are a parent or guardian and believe that your child under the age of 13 has provided us with personal information without your consent, please contact us immediately at [email protected]. We will promptly investigate and, if confirmed, take appropriate steps to delete such information from our records.

We also encourage parents and guardians to supervise their children's online activities and to familiarize themselves with the parental controls available through their internet service providers and device manufacturers.

Individuals between the ages of 13 and 17 should not use our website or services without the direct supervision and consent of a parent or legal guardian. If we discover that we have inadvertently collected information from a minor, we will take immediate steps to delete that information.

11. International Data Transfers

Our primary operations are based in the United States, and the personal information we collect is generally stored and processed within the United States. However, some of our service providers, technology partners, and affiliated entities may be located in or operate from countries outside the United States.

If your personal information is transferred internationally, we take appropriate steps to ensure that such transfers are carried out in compliance with applicable data protection laws and that your information receives an adequate level of protection. These steps may include:

• Ensuring that receiving parties are located in countries with adequate privacy protections
• Requiring contractual data protection terms with international service providers
• Using standard contractual clauses or other recognized transfer mechanisms where applicable

By using our services, you acknowledge and consent to the transfer of your personal information to the United States and, where applicable, to other countries where our service providers operate. We are committed to ensuring that any international data transfers comply with the requirements of the FTC Act and applicable state privacy laws.

12. Legal Basis for Processing (FTC and U.S. Law Context)

While the United States does not currently have a single comprehensive federal privacy law equivalent to the EU General Data Protection Regulation (GDPR), we process personal information in accordance with the following legal frameworks and principles:

• Federal Trade Commission Act (15 U.S.C. § 45): We process personal information in a fair and non-deceptive manner consistent with FTC consumer protection principles and our representations in this Privacy Policy.
• Contractual Necessity: Processing necessary to fulfill your orders, manage your account, and deliver the services you have requested.
• Legitimate Business Interests: Processing for fraud prevention, security, analytics, and service improvement, balanced against your privacy interests.
• Consent: Where required by applicable state law (including CCPA/CPRA), we rely on your consent for certain processing activities, particularly marketing communications and certain uses of cookies.
• Legal Obligations: Processing required to comply with federal and state laws, regulations, and legal processes.
• California Consumer Privacy Act / California Privacy Rights Act (Cal. Civ. Code §§ 1798.100–1798.199.100)
• Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506
• CAN-SPAM Act of 2003 (15 U.S.C. §§ 7701–7713) for email marketing
• Applicable state breach notification laws

13. Third-Party Websites and Links

Our website may contain links to third-party websites, social media platforms, delivery apps, or other online services that are not operated by us. This Privacy Policy applies only to our website and services. We are not responsible for the privacy practices of third-party websites or services.

When you click on a link to a third-party website, you will be directed away from our website and your interactions with that website will be governed by that website's own privacy policy and terms of service. We encourage you to review the privacy policies of any third-party websites you visit.

We are not responsible for the content, privacy practices, or data handling of third-party delivery platforms (such as DoorDash, Uber Eats, or Grubhub) that may fulfill your orders. If you place an order through a third-party platform, that platform's privacy policy governs the personal information you provide to them.

14. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time in response to changes in our business practices, applicable laws, or our data handling activities. When we make material changes to this policy, we will:

• Post the updated Privacy Policy on this page with a revised "Last Updated" date
• Notify registered account holders by email where required by applicable law
• Display a prominent notice on our website for a reasonable period following material changes

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal information. Your continued use of our website or services after the posting of changes constitutes your acceptance of the updated Privacy Policy.

If you disagree with any changes to this Privacy Policy, you should discontinue your use of our website and services and may request deletion of your personal information as described in the Your Privacy Rights section above.

15. Filing Complaints with Data Protection Authorities

If you believe we have not handled your personal information in accordance with applicable law, we encourage you to first contact us directly so we have the opportunity to address your concerns. You may contact us at [email protected] and we will make reasonable efforts to resolve your complaint promptly.

If you are not satisfied with our response, you have the right to file a complaint with the relevant government authority in your jurisdiction:

15.1 Federal Trade Commission (FTC)

The FTC enforces federal consumer protection laws, including those governing unfair or deceptive privacy practices. You may file a complaint with the FTC at:

• Website: www.ftc.gov/complaint
• Phone: 1-877-382-4357
• Address: Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580

15.2 California Privacy Protection Agency (CPPA)

California residents may file complaints with the California Privacy Protection Agency, which enforces the CCPA and CPRA:

• Website: cppa.ca.gov
• Email: [email protected]
• Address: 2101 Arena Boulevard, Sacramento, CA 95834

15.3 California Attorney General

California residents may also file privacy complaints with the California Attorney General's office:

• Website: oag.ca.gov/privacy/ccpa
• Phone: 1-800-952-5225

15.4 Other State Attorneys General

Residents of other states may file complaints with their respective state Attorney General's office regarding potential violations of state privacy laws. Contact information for each state Attorney General is available through the National Association of Attorneys General at www.naag.org.

16. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please do not hesitate to contact us. We are committed to addressing your inquiries promptly and transparently.

When contacting us regarding a privacy rights request, please include your full name, email address associated with your account (if applicable), a description of your request, and your state of residence so that we may properly identify you and respond to your request within the timeframes required by applicable law.

We strive to respond to all privacy inquiries within 10 business days of receipt, and to provide a complete response within the time periods required by applicable law (generally 45 days, extendable to 90 days where permitted).