This Privacy Policy describes how Waiter.com, Inc. (“Waiter.com,” “we“, “us” or “our“) handles personal information that we collect through our websites and mobile applications that link to this Privacy Policy (collectively, the “Service”), as well as through our marketing and other activities described in this Privacy Policy. Use of the Service is subject to our Terms of Service.

California Notice at Collection/State Privacy Rights: See our State privacy rights notice below for important disclosures required by applicable state privacy laws.

We and the third parties we work with may monitor and record your interactions and communications with us and the Service for the purposes described in this Privacy Policy.

If you have any questions or concerns about our use of your personal information, please contact us.

Index

You can click the links below to jump to specific sections, but we recommend that you read this Privacy Policy in its entirety.

Scope of this Privacy Policy

Personal information we collect

How we use your personal information

How we share your personal information

Your choices

Other sites and services

Security and retention

International data transfers

Children

Changes to this Privacy Policy

How to contact us

State privacy rights notice

Scope of this Privacy Policy

Waiter.com facilitates food ordering and delivery for consumers and businesses through its Service. Orders placed through the Service are conveyed to the user’s selected restaurants and Waiter.com to ensure they are processed and delivered. The restaurants you order from have their own privacy policies and we are not responsible for their privacy practices.

Personal information we collect

The personal information we collect from you, either directly or indirectly, will depend on whether you use the Service as a consumer or business representative, and how you interact with us and with our Service. The sources from which we collect personal information include the following:

Information you provide to us. Personal information you may provide to us through the Service or otherwise includes:

• Contact data. Your full name, professional title, organization name, email address, mailing address, phone number, social media handle, and other contact details.
• Account data. Your full name, email address, phone number, organization name, mailing address, username, the password for your Service account, your time zone, and any other information you choose to add to your Service profile or associate with your account.
• Order data. Information we collect when you place orders, including food and restaurant choices, food preferences you share, and payment card information.
• Communications data. Information in your communications with us, including when you communicate with us through the Service, our chat channels, email, social media, events, or otherwise, including any feedback you provide about the Service and your responses to surveys.
• Marketing data. Information regarding your preferences for receiving communications about our Services.
• Other data. If we collect personal information not specifically listed above, we will use it consistent with this Privacy Policy or as otherwise explained at the time of collection.

Information automatically collected. As you navigate the Service, our communications, and other online services, we, our service providers, and our advertising partners may automatically log, monitor and record information about you, your computer or device, and your usage activity over time on the Service and other online services, such as:

• Device data. Technical information about your computer or mobile device, including operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique device identification numbers or other identifiers (language settings, mobile device/cellular carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information associated with IP address (e.g., city/town).
• Usage data. Page and screen views, search terms, authentication details, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages/screens, information about your activity on a page/screen, access times and duration of access, whether you have opened our emails or clicked links within them, and other functional information on Service performance (like diagnostics and crash logs).
• Precise geolocation. Location of your device when you grant access to it in your device settings.

Cookies and other technologies. We, our service providers and our advertising partners use the following technologies to facilitate some of the automatic collection of personal information described above, including to enable Service functionality, analytics on how the Service is used, and targeted advertising:.

• Cookies, which are text files that websites store on a visitor’s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, helping us understand user activity and patterns, and facilitating online advertising if conducted. Some cookies store information only during a user session, others are persistent in your browser and collect data from multiple sessions. You can learn more about cookies and how to control them at www.allaboutcookies.org.
• Web beacons, also known as pixel tags or clear GIFs, which are typically used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked, typically to compile statistics about usage of websites and the success of marketing campaigns.
• Chat technologies provided by third parties that operate the chat features that you can use to communicate with us through the Service. These third parties may access and use the data described in the automatic collection section above, and monitor and record your chats, for the purposes described in this Privacy Policy.
• Software development kits, or SDKs, which are used to incorporate third-party computer code into our Service that allows our third-party service providers or advertising partners to collect data directly from it for a variety of purposes, including to provide us with analytics regarding the use of the Service, to integrate with social media, add features or functionality to our Service or to facilitate targeted advertising.
• Embedded scripts, which use software code temporarily downloaded to your device to collect information about your interactions with the Service such as the links you click on.

Third party sources. We combine personal information we receive from you or collect automatically when you use the Service with personal information we obtain from other sources, such as:

• Our business contacts who share details about their professional contacts and friends, including potential customers and partners.
• Public sources, such as government agencies, public records, social media platforms, and other publicly available sources.
• Data brokers, such as information services and data licensors.
• Authentication services you can use to log into the Service, such as those provided by Google, Facebook, and Apple, which may share information about you to facilitate the authentication as described in the service’s settings or privacy policy.

How we use your personal information

We use your personal information for the following purposes or as otherwise described in this Privacy Policy or at the time of collection:

• Service delivery. We use your personal information to register your Service account, to manage and administer your Service account, provide the Service and to communicate with you about our Service (including support and administrative messages that we may send via email, chat features, text messages in the Service or other channels).
• Business operations. We use your personal information to administer and maintain our Service and our IT systems (including monitoring, troubleshooting, data analysis, testing, system maintenance, repair and support, reporting and hosting of data) and to operate our business.
• Research and development. We use your personal information for research and development purposes, including to analyze and improve the Service and our business in an informed way. As part of these activities, we may create aggregated, de-identified and/or anonymized data from personal information we collect. We make personal information into de-identified or anonymized data by removing information that makes the data personally identifiable to you. We may use this aggregated, de-identified or otherwise anonymized data and share it with third parties for our lawful business purposes, including to analyze, improve and promote the Service and our business.
• Marketing. We, our service providers, and third party advertising partners may collect and use your personal information for the following purposes:
• Direct marketing. We may contact you about our products and services via mail, email, or phone as permitted by law. You may Opt-out of marketing as described in the section below.
• Targeted advertising. Social media platforms and other third party advertising partners that we could engage may use the technologies described in the Cookies and other technologies section above to collect information about your interaction with the Service (including the device data and usage data described above), our communications, and other online services over time and with different browsers and devices. They use that information to serve online ads that they think will interest you on other online services and to measure their effectiveness.
• Compliance and protection. We use your personal information to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities. We also use your personal information to protect our, your or others’ rights, privacy, safety, or property (including by establishing and defending legal claims), including by conducting internal audits against our policies; enforcing the terms and conditions that govern the Service; and taking steps to prevent, investigate and deter fraud, cyberattacks or other unauthorized, unethical, or illegal activity.

How we share your personal information

We may share your personal information with the following categories of recipients, at your direction, and as otherwise described in this Privacy Policy or at the time of collection.

• Affiliates. We may share personal information with corporate affiliates that we control, are controlled by, or with which we are under common control, for purposes consistent with this Privacy Policy.
• Service providers. We may share personal information with third parties that provide services on our behalf or help us operate the Service or our business (such as hosting, information technology and software, customer support, email and telephone communications, call recording, marketing, advertising, payment processing, user authentication, market/survey research, and analytics).
• Restaurants and delivery services. We may share your personal information with third party restaurants and delivery partners to fulfill your orders. For example, when you place an order through our Service and select a meal from the provided list of restaurants or you select a delivery option, we share order information with the restaurant you have selected or the relevant delivery partner for the delivery option you selected in order to fulfill the order. The restaurants and delivery partners we work with handle the personal information we share with them according to their own privacy policies.
• Payment processors. Third party payment processors, such as PayPal, that collect your payment card data and other transaction data to process your payment card transactions when you pay for the Service. You can learn about how PayPal handles your personal information in its privacy policy available here: PayPal Privacy Policy.
• Authentication services. When you log into the Service by using your credentials on a third party service, such as Google, Facebook, or Apple, the service will collect contact data, device data and usage data from you to facilitate the authentication as described in the service’s relevant settings or privacy policy.
• Advertising partners. Third party advertising companies may collect, and we may share with them, personal information for targeted advertising purposes as described above. Their use of personal information is subject to their own privacy policies.
• CAPTCHA providers. To enhance the security of our Service, we use captcha features that require users to complete a task to authenticate to the Service. Third party providers of these CAPTCHA services collect device data and usage data, as described above to enable the CAPTCHA features and as described in their privacy policies. For example, we use the Google reCAPTCHA service. Your use of the Google reCAPTCHA feature is subject to its Terms of Service and Privacy Policy.
• Other users and the public. Your reviews of restaurant menu items are visible to other users of our Service and may be published on public review sites.
• Professional advisors. We may share personal information with professional advisors, such as lawyers, auditors,and bankers, where necessary in the course of the professional services that they render to us.
• Authorities and others. We may share personal information with law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
• Business transferees. Parties (and their advisors) to business transactions involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Waiter.com or our affiliates (including, in connection with a bankruptcy or similar proceedings) may acquire all categories of personal information that we handle in connection with such transactions or we may share it with them in the context of negotiations of or due diligence for such transactions.

Your choices

This section applies to all users. Some users may also have additional rights under applicable privacy laws, as described in the state privacy rights notice below. If you do not provide information we identify as required or mandatory, we may not be able to provide features or services that require that information.

• Access or update your information. You may review and update certain Service account information by logging into your account.
• Opt-out of marketing communications. You may opt-out of marketing emails at any time by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. Please note that if you opt-out of promotional emails, you may continue to receive service-related and other non-marketing emails.
• Opt-out of text messages. If you receive text messages from us, you may opt out of receiving further text messages from us by replying STOP to our message.
• Request deletion. You may request deletion of your information by contacting us with your request.
• Cookies. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings.
• Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.
• Authentication services. You may be able to limit the information shared with us by third party services that you use to sign in to the Service, such as Google. See your settings and the privacy policy for that service for details.
• Targeted ads. You may use the following industry opt-out tools to opt-out of targeted ads:
• Network Advertising Initiative
• Digital Advertising Alliance
• AppChoices mobile app, which will allow you to opt-out of targeted ads in mobile apps served by participating members of the Digital Advertising Alliance.
• Mobile settings. You can use your mobile device settings to limit use of the advertising ID associated with your mobile device for targeted marketing purposes.

Other sites and services

The Service may contain links to or integrations of websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or other online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites and other online services you use.

Security and retention

We use technical and organizational safeguards designed to protect the personal information we collect and process about you. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information. We retain personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for the compliance and protection purposes described above.

International data transfers

We are headquartered in the United States and may use service providers that operate in the United States and other countries other than the country in which you are resident. These countries may have data protection laws that differ from those of your country (and, in some cases may not be as protective as those in your state, province, or country).

Children

The Service is not intended for use by children under 18 years of age. If you are a parent or guardian of a child under 18 from whom you believe we have collected personal information in a manner prohibited by law, please contact us. If we learn that we have collected personal information through the Service from a child under 18 without the consent of the child’s parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Service after the effective date of any modified Privacy Policy indicates your acknowledgment that the modified Privacy Policy applies to your interactions with the Service and our business.

How to contact us

If you have questions or concerns about this Privacy Policy or our practices, please contact us at privacy@waiter.com.

State privacy rights notice

This section applies to residents of California, Colorado, Oregon and Texas and any other U.S. state with privacy laws applicable to us that grant their residents the rights or requires the disclosures described below (collectively the “State Privacy Laws”). Waiter.com is the controller of your personal information for purposes of these laws.

This section describes how we collect, use, and share Personal Information of residents of these states and the rights these users may have with respect to their Personal Information. Please note that not all rights listed below may be afforded to all users and that if you are not a resident of one of the states referenced above, you may not be able to exercise these rights.

For purposes of this section, the term “Personal Information” has the meaning given to “personal data”, “personal information” or other similar terms, and “Sensitive Personal Information” has the meaning given to “sensitive personal information,” “sensitive data”, or other similar terms in the State Privacy Laws, except that in neither case do such terms include information exempted from the scope of the State Privacy Laws.

Your privacy rights. State Privacy Laws grant the rights listed below. However, these rights are not absolute and, in certain cases, we may decline your request in certain cases as permitted by law or where the laws in your state do not afford you these rights.

• Information. You can request whether we have collected your personal information, and in certain cases, categorical information about the personal information we collect, the purposes for which we use them, the sources from which we collected personal information, the third parties with whom personal information is/was sold, shared or disclosed for a business purpose, and the personal information sold/disclosed. The specific categorical information that may be requested varies depending on your state of residence.
• Access. You can request a copy of certain Personal Information that we have collected about you in a portable format that can be transmitted to another entity.
• Deletion. You can ask us to delete certain Personal Information that we have collected about you
• Correction. You can ask us to correct inaccurate Personal Information that we have collected about you.
• Opt-out of
• Processing/sharing for targeted advertising purposes. You can opt-out of certain sharing and other processing of Personal Information for targeted advertising purposes described in our targeted advertising section above.
• Sales of personal information. You can opt-out of other sales of your Personal Information as defined by applicable state privacy laws. We do not “sell” personal information as defined in applicable state privacy laws, except to the extent the use of targeted marketing services described above constitutes a ”sale” under such laws.
• Profiling. You can request to opt-out of the processing of personal information for the purposes of “profiling” as defined in applicable privacy laws that will have a legal or similarly significant effect on you. However, we do not currently engage in such profiling.
• Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the State Privacy Laws.

Residents of some states have additional rights described in the state-specific disclosures at the bottom of this Privacy Policy.

How to exercise your rights

• Right to information/know, access, deletion, correction. You may submit requests to exercise your right to information/know, access, appeal, correction, or deletion by contacting us.
• Right to opt-out of processing/sharing/selling for targeted advertising. Use of the targeted advertising services described above may constitute the processing, “sharing”, “sale” of Personal Information under State Privacy Laws from which you have the right to opt-out. You can request to opt-out of this activity where enabled by cookies and other web technologies on the Service by:
• Clicking the “Your Privacy Choices” link in the footer of this webpage and following the instructions.
• transmitting your opt-out request through the Global Privacy Control or another universal opt-out mechanism or preference signal recognized by State Privacy Laws, which we will recognize to the extent required by law with respect to the browser from which it is transmitted and otherwise as required by law. For more info visit globalprivacycontrol.org.

Your request to opt-out will apply only to the browser and the device from which you submit the request.

• Verification of Identity. We may need to verify your identity in order to process your information/know, access, appeal, correction, or deletion requests and reserve the right to confirm your residency. To verify your identity, we may require you to authenticate into your Service account if you have one, verify your email address, provide personal identifiers we can match against information we may have collected from you previously, confirm your request using contact details stated in the request, provide government identification, or provide a declaration under penalty of perjury, where permitted by law..
• Authorized agents. Under some State Privacy Laws, you may enable an authorized agent to make a request on your behalf. However, we may need to verify your authorized agent’s identity and authority to act on your behalf. We may require a copy of a valid power of attorney given to your authorized agent pursuant to applicable law. If you have not provided your agent with such a power of attorney, we may ask you to take additional steps permitted by law to verify that your request is authorized, such as by providing your agent with written and signed permission to exercise your State Privacy Laws rights on your behalf, the information we request to verify your identity, and confirmation that you have given the authorized agent permission to submit the request.
• Appeals. If we deny your request to exercise your privacy rights, you can appeal the denial through the same mechanism this Privacy Policy designates for the submission of the relevant request.

Sensitive data. With the exception of the username and password you use to access your Service account, payment card data you use to place orders, and your device’s precise geolocation when you grant us access to it, we do not require you to provide us with data considered “sensitive” under U.S. state privacy laws. For example, this includes but may not be limited to data revealing racial or ethnic origin, religious/philosophical beliefs, a mental or physical health condition /treatment/ diagnosis, data related to pregnancy and reproductive health, genetic data, biometric data, sex life/sexuality/sexual orientation, status as transgender or nonbinary, personal data of a known child under age 13, union membership, citizenship or citizenship/immigration status, status as victim of a crime, government-issued IDs, and financial account data. However, it is possible that some users may voluntarily provide this sensitive data to us. Do not provide us with this sensitive data if you do not consent to our handling of it as described in this Privacy Policy. By providing this sensitive data you affirmatively confirm that you freely give your informed, unambiguous agreement to our use and disclosure of it for the purposes explained or apparent at the time of collection or otherwise as described in this Privacy Policy. You can withdraw this consent at any time by contacting us but we will not be able to provide services or grant requests that require it.

Additional information for California residents

• Collection and disclosure. We have summarized the Personal Information we collect and may disclose to third parties by reference below to both the categories defined in the “Personal information we collect” section of this Policy above and the categories of Personal Information specified in the CCPA (Cal. Civ. Code §1798.140) and describes our practices currently and during the 12 months preceding the effective date of this Privacy Policy. Information you voluntarily provide to us, such as in free-form webforms, may contain other categories of Personal Information not described below. We may also disclose personal information to professional advisors, law enforcement and government authorities, and business transferees as described above in the How we share your personal information section of this Privacy Policy.

Statutory category/personal information we collect	Categories of third parties to whom we disclose the personal information for a business purpose
Identifiers Contact data Account data Communications data Device data	Affiliates Service providers Restaurant and delivery services Payment processors Authentication services
California Customer Records (as defined in California Civil Code §1798.80) Contact data Account data Order data Communications data	Affiliates Service providers Payment processors Restaurant and delivery services
Commercial information Device data Usage data Order data Account data	Affiliates Service providers Payment processors Authentication services
Internet or Network Information Device data Usage data	Affiliates Service providers
Geolocation data Usage data Precise geolocation data	Affiliates Service providers
Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information Communications data Device data Usage data	Affiliates Service providers
Professional or Employment Information Contact data Account data	Affiliates Service providers
Sensitive personal information Account data Order data (payment card information) Precise geolocation data	Affiliates Service providers Payment processors Authentication services
Inferences May be derived from all the above	Affiliates Service providers

• Sources and purposes. We collect all categories of personal information from the sources and use them for the business/commercial purposes described above in the Privacy Policy.
• Children. Although our Service is not intended for children under 16 years of age, we are required to inform you that we do not have actual knowledge that we have sold the personal information of California residents under the age of 16.
• Sensitive personal information. We do not use or disclose sensitive personal information for restricted purposes that California residents have a right to limit under California privacy law.
• Retention. We retain personal information as described in the Security and Retention section above.
• Sale and sharing of personal information. We do not sell or share personal information except as described in the  Opt-out of sharing/selling/processing for targeted advertising section above.
• Notice of financial incentive. We offer a rewards program that provides certain perks, such as points that can be redeemed for gift cards, in exchange for participating in the program and our use of the Personal Information participants provide. The material terms and conditions applicable to participation in the rewards program are described in our Terms of Service. Members sign up for our rewards program when they register for the Service. The information we collect through the rewards program includes all of the categories described in the “Collection and disclosure” section above. Members have a right to cancel participation in the rewards program at any time and may do so by contacting us. Our good faith estimate of the value of the personal information we collect is the value of the benefits we offer to you. The factors considered in calculating this estimate include the benefit, insights and goodwill that we realize and expect to realize when they participate in the program and remain a customer; sales directly or indirectly generated from participation in the Rewards Program; and the costs of the program.
• Shine the light law. Under California’s Shine the Light law (California Civil Code Section 1798.83), California residents may ask companies with whom they have formed a business relationship primarily for personal, family or household purposes to provide the names of third parties to which they have disclosed certain personal information (as defined under the Shine the Light law) during the preceding calendar year for those third parties’ own direct marketing purposes, and the categories of personal information disclosed. You may email us at privacy@waiter.com with your requests for this information. In your request, you must include the statement “Shine the Light Request,” and provide your first and last name and mailing address and certify that you are a California resident. We reserve the right to require additional information to confirm your identity and California residency. Please note that we will not accept requests via telephone, mail, or facsimile, and we are not responsible for notices that are not labeled or sent properly, or that do not have complete information.

Additional information for Colorado residents

If you are a Colorado resident, please note the following with respect to the Waiter.com rewards program (“Rewards Programs”):

All categories of personal information collected through the Rewards Program, including your name, email address, device data, and usage data may be processed for targeted advertising as described above in the  Opt-out of sharing/selling/processing for targeted advertising section.

The categories of third parties that will receive personal information collected through the Rewards Program are listed above in the section entitled How we share your personal information. Such data is not provided to data brokers.

If you exercise your right to delete the personal information we collect through the Rewards Program, we will not be able to provide Rewards Program benefits because we will not have the information necessary to keep track of the rewards to which you are entitled and otherwise administer the program.

Additional information for Oregon residents

Oregon residents can request a list of specific third parties, other than natural persons, to which we have disclosed personal information. The list we provide may be limited to the third parties to which we have disclosed your personal information. You can submit this request by following the instructions in the how to exercise your rights section above.